5

I want to know, Is there any websites which has malware files (Windows OS) that are detected by YARA rules?

Note: I know some websites to get android malware samples using YARA. But, I need Windows OS based malware.

6

An additional source of such samples, which I don't know why nobody listed, is virustotal.com. It lets you execute what they call "ruleset" and "retrohunt" searches which are basically running yara rules on every sample processed through virustotal and every sample from the last 3 months. This is a paid service but it's definitely worth it.

Here's an image that shows the retro-hunt and yara search web UI:

yara ruleset search example

  • I'm curious - is it possible to obtain the yara rules to use it "offline" ? – kn0x Apr 13 '17 at 5:52
  • There are online yara rule repositories. This is one example: github.com/Yara-Rules/rules – NirIzr Apr 13 '17 at 5:56
  • I am aware of github.com/Yara-Rules/rules (see my answer above). I thought perhaps VT manages its own repository. – kn0x Apr 13 '17 at 5:59
  • I don't think VT exposes other users rules for obvious reasons. I think they have a single ruleset at the backend but a user can only see his own rules. – NirIzr Apr 13 '17 at 6:03
3

afaik shadowserver offers a service like this to business partners (you send yara rules and get matching samples from honeypots in return), but there is no such service for free or personal use.

You can try to set up your won honeypot for current malware samples (there is a broad range of software for this) or try to run your yara rules on your own malware repository (i.e. collect all samples you can find from free sources and apply your yara rules).

If you are not in that business, you will not be able to rely on services like virustotal intelligence who offer the biggest malware corpus I know of.

That being said, a lot of community-driven or free malware sample collections failed at some point. Please be aware of that when starting a service of your own.

  • Thank you very much Nordwald.. Thanks for the valuable reply.:) – xoreax Apr 12 '17 at 7:29
2

So let me google that for you... What about:

  • Thanks for your kind reply :). Is there is any site to download the yara rule detected samples? – xoreax Apr 12 '17 at 7:27
  • @xoreax VT, see Nirlzr's answer below. – Vitaly Osipov Apr 13 '17 at 5:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.