EvilZone

Community => General discussion => : parad0x May 14, 2015, 11:29:11 AM

: Where do you get malware samples to study?
: parad0x May 14, 2015, 11:29:11 AM
Well, the title says it all. In some days I am going to start malware analysis but haven't came across any decent malware repo from where I can dl them and then study them. IF you have some links that you use to dl malware from, post it here. :)
: Re: Where do you get malware samples to study?
: Kulverstukas May 14, 2015, 01:24:54 PM
What about VX heavens, they have a huge DB - like 60GB worth.
: Re: Where do you get malware samples to study?
: ColonelPanic May 14, 2015, 01:28:13 PM
I've been wondering this myself lately. Thanks man!
: Re: Where do you get malware samples to study?
: parad0x May 14, 2015, 04:09:23 PM
What about VX heavens, they have a huge DB - like 60GB worth.
But most of them are quite old, really old that will be fun to study but as the advancements in OS implementations, some may cease to work and with this net connection, I can't dl 60GB torrent even in 2 lives. Any other repo that, you know has some recent malware?
: Re: Where do you get malware samples to study?
: Schalla May 14, 2015, 07:17:55 PM
https://www.reddit.com/r/Malware/comments/35pd40/good_database_sites/
https://www.reddit.com/r/Malware/comments/2yclnp/is_there_any_database_i_could_download_malware/
: Re: Where do you get malware samples to study?
: 0E 800 May 14, 2015, 11:53:24 PM
I am guessing your talking about malware sourcecode. If not, then I suggest downloading any number of keygens or cracks from torrents.

: Re: Where do you get malware samples to study?
: parad0x May 15, 2015, 02:37:10 AM
I am guessing your talking about malware sourcecode. If not, then I suggest downloading any number of keygens or cracks from torrents.
I was talking about executable malwares but if you have any resources that have source code of malwares, I would love to have it. :)

https://www.reddit.com/r/Malware/comments/35pd40/good_database_sites/
https://www.reddit.com/r/Malware/comments/2yclnp/is_there_any_database_i_could_download_malware/

Thanks you man. :) +1 for you. That link has some good resources.
: Re: Where do you get malware samples to study?
: xor May 15, 2015, 03:14:29 AM
If you're not talking about malware source code and you just want executables, just open up those spam emails you get and start clicking all the links. Easiest way to get the latest malware.
: Re: Where do you get malware samples to study?
: parad0x May 15, 2015, 04:27:20 AM
If you're not talking about malware source code and you just want executables, just open up those spam emails you get and start clicking all the links. Easiest way to get the latest malware.
To be honest, I have 0 spam mails in my inbox and as I said to 0E 800, if you have resources that have malware source code, let me know.
: Re: Where do you get malware samples to study?
: Psycho_Coder May 15, 2015, 01:51:22 PM
Google would have fetched you much better results. Searching Google with terms like "Malware samples download" or "Malware dataset" or "Malware samples for research" will fetch you lots of results.

The following link will help you not just with Datasets but much more.

https://github.com/rshipp/awesome-malware-analysis
: Re: Where do you get malware samples to study?
: M1lak0 May 15, 2015, 10:14:26 PM
Well, google helped me..

http://syrianmalware.com/

http://secuboxlabs.fr/kolab/

http://practicalmalwareanalysis.com/labs/

http://sourceforge.net/projects/pmalabs/

http://www.virusign.com/

http://ytisf.github.io/theZoo/

http://malshare.com/

http://androidmalwaredump.blogspot.in/

Good Day!!
: Re: Where do you get malware samples to study?
: nozzlechunks June 18, 2015, 04:37:04 PM
Just go to your google junk mail bin and detonate all the attachments in VM with Wireshark on.

A lof of the lures are macro-enabled docs that actually POLITELY ASK the victim to enable macros. I wrote a Python script using oletools to extract the VBA from from these docs, then insert the VBA into a new doc, comment out all the AutoRun and Shell lines, and step through it.

You'll see callbacks, the location of the instructions its pull, as well as what the file names itself and its path.