5

I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?

Note: I know some websites to get android malware samples using YARA. But, I need Windows OS based malware.

3 Answers 3

6

An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara rules on every sample processed through virustotal and every sample from the last 3 months. This is a paid service but it's definitely worth it.

Here's an image that shows the retro-hunt and yara search web UI:

yara ruleset search example

4
  • I'm curious - is it possible to obtain the yara rules to use it "offline" ?
    – knx
    Commented Apr 13, 2017 at 5:52
  • There are online yara rule repositories. This is one example: github.com/Yara-Rules/rules
    – NirIzr
    Commented Apr 13, 2017 at 5:56
  • I am aware of github.com/Yara-Rules/rules (see my answer above). I thought perhaps VT manages its own repository.
    – knx
    Commented Apr 13, 2017 at 5:59
  • I don't think VT exposes other users rules for obvious reasons. I think they have a single ruleset at the backend but a user can only see his own rules.
    – NirIzr
    Commented Apr 13, 2017 at 6:03
3

afaik shadowserver offers a service like this to business partners (you send yara rules and get matching samples from honeypots in return), but there is no such service for free or personal use.

You can try to set up your won honeypot for current malware samples (there is a broad range of software for this) or try to run your yara rules on your own malware repository (i.e. collect all samples you can find from free sources and apply your yara rules).

If you are not in that business, you will not be able to rely on services like virustotal intelligence who offer the biggest malware corpus I know of.

That being said, a lot of community-driven or free malware sample collections failed at some point. Please be aware of that when starting a service of your own.

1
  • Thank you very much Nordwald.. Thanks for the valuable reply.:)
    – xoreax
    Commented Apr 12, 2017 at 7:29
2

So let me google that for you... What about:

2
  • Thanks for your kind reply :). Is there is any site to download the yara rule detected samples?
    – xoreax
    Commented Apr 12, 2017 at 7:27
  • @xoreax VT, see Nirlzr's answer below. Commented Apr 13, 2017 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.