Take the 2-minute tour ×
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It's 100% free, no registration required.

It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.

The bottleneck here for people aspiring to break into the security industry through this path seems to be easy access to new malicious code samples to practice on and build heuristics for.

Are there any good resources for a person unaffiliated with any organization to download malware in bulk to run analysis on?

share|improve this question

13 Answers 13

up vote 55 down vote accepted

There's a number of interesting resources you can get malware from

  • The premier Malware sample dump Contagio
  • KernelMode.info (Focuses on Win32 and novel rootkit techniques)
  • DamageLab.org (People occassionally will post their unpacked executables here, which differ from 'in the wild' executables they are seeking to drop on victim's computers, but interesting none the less, many many rips of more well known techniques and software ranging from TDL to Zeus can be found at sites like this)
  • The multitude of malware dump sites such as MalwareBlacklist
  • As qbi kindly pointed out, Malware.lu (You have to register for the samples)

In addition to these, you can always live dangerously and click on shady affiliate marketing ads or find various signatures for the multitude of "BEPs" (Browser Exploit Packs) that malware authors frequently use to get installs and analyze the payload to try to find what they are trying to download and exec.

share|improve this answer
    
That's fantastic, I've been loving checking out DamageLab.org. –  mrduclaw Mar 25 '13 at 19:13
1  
Also there is VirusShare.com –  Steel City Hacker Apr 4 '13 at 16:09
    
I Suggest turning this into community wiki, it will allow easy access for the info in all the answers. –  Mellowcandle Apr 15 '13 at 8:28
    
I just wanted to add one that I have run across: VX Heaven. It includes forums, virus archives, and a bunch of interviews with old-school virus writers. –  hololeap Jul 6 at 20:41

There are many great options to get malware samples in all the comments but, also, I want to point you to 2 more options:

  • Malware URLs. This is a list I maintain myself and is updated daily. Here you will find many live malware samples. Be careful and don't open the URLs in a browser.
  • Open Malware. This is the new site for the old Offensive Computing.
share|improve this answer
1  
MalwareURLs is pretty awesome! Can I ask where you get the URLs from? –  mrduclaw Mar 25 '13 at 19:15
    
Crawlers, sandboxes, 3rd party public & private URL feeds, etc... –  joxeankoret Mar 26 '13 at 7:05
    
Thanks, I guess I was hoping more for a list of URL feeds that I can walk as well. –  mrduclaw Mar 29 '13 at 19:05

I use VirusShare.com, which has about 5.6 million samples. You will need to request access, but I just explained the research I was doing (as a person unaffiliated with any organisation) and they let me in.

Your question mentioned downloading in bulk. The site says:

Want more than a few samples? Want to download really large samples of malware? Want to download almost the entire corpus? No problem.

The site provides torrents, each consisting of over 100k samples (ranging in size from 13GB to 85GB). Each torrent is a single zip file. You can also download individual files, but if you don't want to download them in bulk, you may be better off looking at one of the other excellent answers.

share|improve this answer

I'd suggest Malware.lu. The website writes (as of 2013-03-23):

Currently the database contains 5,356,052 samples.

First you have to request an account. The website lists an email address. You can send a few words why you want to have an account there. After some time they send you your login data.

You can access the data through the website, but they also provide an API. See example Python code.

share|improve this answer

You may start to look from your junk email folder and antivirus quarantine.

If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.

Here is a list I created once for my readers:

  1. Malware Domain List

  2. URL Query

  3. Malekal.com list of malware

  4. VX Vault

  5. Site Inspector (by Comodo)

  6. Scumware.org

  7. Malc0de Database

  8. Sucuri Malware Labs

  9. Clean-MX Realtime database

  10. Sourcefire Vulnerability Research Team Labs

  11. Zeus Tracker

  12. NovCon Minotaur Analysis System

Credit goes to: http://ondailybasis.com/blog/?p=1188

share|improve this answer

There is also the option of putting out your own HoneyPot to capture live malware. This does take a bit of effort and some resources (purchasing Internet addressable IP address). However, the advantage of this method is that you are virtually guaranteed to capture malware that are actively being used currently in the wild. There is the possibility that you might hit a jackpot and also get infected with a brand new malware that might even exploit 0-day vulnerabilities. This approach is very helpful for people who are already well-versed in the field of reversing. I have used Dionaea (http://dionaea.carnivore.it/) in the past to set up my own honeypot with very good results. It's replete with instructions, background, and references.

For beginners and for people who don't want to put too much effort gathering samples, I would advise taking the route of downloading the malware from the sites the other posters have indicated.

share|improve this answer

There are a couple options when it comes to getting samples for analysis.

Scraping

This one is extremely common and is what is used by a lot of researches to build sample databases.

Recommendation: You could build your own scraper of common sources or build upon ones like: https://github.com/technoskald/maltrieve

Malware Farms

Other researches will at times allow access to their collections. An example of this is malware.lu

Recommendation: Try requesting access to malware.lu and similiar repos. Check the list at the bottom for more. This is a great way to get access to a lot of samples fast.

Honeypots

Researchers can use server and client side honeypots to try and collect malware.

Recommendation:

Checkout http://dionaea.carnivore.it/ for a server side honeypot. These are great for collecting self propagating malware.

Checkout https://github.com/buffer/thug for a client side honeypot.

Manually

You can browse the shady portions of the internet and look for samples yourself.

This is pretty much the standard list of sample sources: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308

Each one of the above samples has its own pros and cons. Recommend you play with each to find out which produces what you need.

share|improve this answer

If you ask nicely, you may be able to get researcher access to VirusTotal.

share|improve this answer
    
Would that work even though I'm just some random guy on the Internet that wants to learn with no credentials? –  mrduclaw Mar 29 '13 at 21:12
    
There's only one way to find out :-) –  harley Apr 1 '13 at 13:04
    
Yes you should give a try –  accfews Apr 2 '13 at 14:32
    
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Why do you recommend this? What does it offer? –  AsheeshR Jan 22 at 2:37

I like to run Kyle Maxwells Maltrieve https://github.com/technoskald/maltrieve, which will collect malware from various resources.

Additionally, I have some samples up for download on my site TekDefense.com http://www.tekdefense.com/downloads/

share|improve this answer

I just wanted to add one that I found on reddit, just so it's here:

http://www.malshare.com

The nice thing about this place is that there is absolutely no sign-up or anything.

share|improve this answer

Related Reddit topic.

[Edit]Here is the content of the page :

"Search youtube for facebook, msn, gmail, yahoo etc password hacking tools or things like xbox points generators and your guaranteed to find a few RATs." --ashtrae

-

"Try browsing through the recent results at urlquery.net If you see any recent searches/scans that were tagged as malicious, chances are they haven't been fixed yet. There are plenty of other sites out there where you can download samples packed in password protected .zips, but I'm assuming you're looking for something live, like a drive by exploit in this case? If that's true, urlquery should help." -- NattyBroh

-

"On top of what is already mentioned. Your spam folder. Some malware is spread via email campaigns. Torrents/Usenet - many pirated apps come bundled with a little extra. new unverified torrents on public trackers is a good place to start. Small sketchy ad networks. Even big guys, like adwords, get malware ads once in a while, small companies don't have resources to scan everything thoroughly. ... Check ads for various blackhat services, click links, you'll find some fun stuff. Bad guys are not above infecting each other. Generally, What Would Black Hat Do? is a good motto to stick by. If you were distributing malware, how would you go about it?" --choleropteryx

https://malwr.com/ // posted by highentropy1337
http://malwaretips.com/forums/virus-exchange.104/ // posted by Websly http://contagiodump.blogspot.in/ // posted by bhumish
http://www.kernelmode.info/forum/ // posted by idkbtc

Posted by loualbano:

  1. http://www.scumware.org/reports.scumware
  2. http://minotauranalysis.com/malwarelist.aspx (might be dead)
  3. http://www.malc0de.com/database/
  4. http://www.malwareblacklist.com/showMDL.php
  5. http://cybercrime-tracker.net/
  6. https://zeustracker.abuse.ch/monitor.php?browse=binaries
  7. http://vxvault.siri-urz.net/ViriList.php
  8. https://palevotracker.abuse.ch/
  9. https://spyeyetracker.abuse.ch/monitor.php?browse=binaries
  10. http://www.sacour.cn/m/ (part chinese and part english, click around to find .exe links)
  11. http://www.nothink.org/viruswatch.php
  12. http://www.blade-defender.org/eval-lab/ (dead?)
  13. http://www.malwaredomainlist.com/forums/index.php?topic=3270.0
  14. http://www.malwaredomainlist.com/update.php
  15. http://malwaredb.malekal.com/
  16. http://avcaesar.lu/
  17. http://malwareurls.joxeankoret.com/normal.txt (dead?)
  18. http://virusshare.com/
  19. http://contagiodump.blogspot.com/
  20. http://www.kernelmode.info/forum/viewforum.php?f=16
  21. http://malshare.com/
  22. http://www.malwareblacklist.com/showMDL.php (dead?)
  23. http://openmalware.org/
  24. http://secuboxlabs.fr/ (dead?)
  25. http://support.clean-mx.de/clean-mx/viruses.php
  26. http://www.offensivecomputing.net/
  27. https://forums.malwarebytes.org/index.php?s=fab929606b2191a7ecc31194dec7118f&showforum=51
  28. http://jsunpack.jeek.org/?list=1
  29. http://malwared.ru/database.php?page=1
share|improve this answer
    
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  0xC0000022L Dec 26 '13 at 22:57
    
@0xC0000022L Corrected. –  Dominik Antal Dec 27 '13 at 13:38
    
and thanks for reacting to it and of course +1. –  0xC0000022L Dec 27 '13 at 14:26

Here a website I like which wasn't mentioned before

  • malwaretips.com - "Virus Exchange" forum with active community sharing samples, also contains references to other malware sharing sites.
share|improve this answer
2  
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. –  Peter Andersson Apr 2 '13 at 15:39
    
Please give us more details - why are these sites worth mentioning? –  Ange Apr 10 '13 at 12:53
    
This does not provide an answer to the question. To critique or request clarification from an author, leave a comment below their post - you can always comment on your own posts, and once you have sufficient reputation you will be able to comment on any post. –  perror Apr 11 '13 at 19:55

I give a good one: http://www.virussign.com/downloads.html, It also contains a behavior analysis report.

share|improve this answer
    
While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Why do you recommend this? What does it offer? –  AsheeshR Jan 22 at 2:37

protected by AsheeshR Jul 11 '13 at 12:32

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.