It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.

The bottleneck here for people aspiring to break into the security industry through this path seems to be easy access to new malicious code samples to practice on and build heuristics for.

Are there any good resources for a person unaffiliated with any organization to download malware in bulk to run analysis on?


14 Answers 14


There's a number of interesting resources you can get malware from

  • The premier Malware sample dump Contagio
  • KernelMode.info (Focuses on Win32 and novel rootkit techniques)
  • DamageLab.org (People occassionally will post their unpacked executables here, which differ from 'in the wild' executables they are seeking to drop on victim's computers, but interesting none the less, many many rips of more well known techniques and software ranging from TDL to Zeus can be found at sites like this)
  • The multitude of malware dump sites such as MalwareBlacklist
  • As qbi kindly pointed out, Malware.lu (You have to register for the samples)

In addition to these, you can always live dangerously and click on shady affiliate marketing ads or find various signatures for the multitude of "BEPs" (Browser Exploit Packs) that malware authors frequently use to get installs and analyze the payload to try to find what they are trying to download and exec.

  • That's fantastic, I've been loving checking out DamageLab.org.
    – mrduclaw
    Commented Mar 25, 2013 at 19:13
  • 2
    Also there is VirusShare.com
    – JZeolla
    Commented Apr 4, 2013 at 16:09
  • I Suggest turning this into community wiki, it will allow easy access for the info in all the answers. Commented Apr 15, 2013 at 8:28
  • 1
    I just wanted to add one that I have run across: VX Heaven. It includes forums, virus archives, and a bunch of interviews with old-school virus writers.
    – hololeap
    Commented Jul 6, 2014 at 20:41
  • 1
    Don't forget grandma's computer. Commented Mar 28, 2019 at 13:57

There are many great options to get malware samples in all the comments but, also, I want to point you to 2 more options:

  • Open Malware. This is the new site for the old Offensive Computing.
  • I used to host a MalwareURLs list on My Blog but it seems to be down ATM. I'll update with a new URL as soon as it's back up.
  • 1
    MalwareURLs is pretty awesome! Can I ask where you get the URLs from?
    – mrduclaw
    Commented Mar 25, 2013 at 19:15
  • Crawlers, sandboxes, 3rd party public & private URL feeds, etc... Commented Mar 26, 2013 at 7:05
  • 1
    Thanks, I guess I was hoping more for a list of URL feeds that I can walk as well.
    – mrduclaw
    Commented Mar 29, 2013 at 19:05
  • 1
    Both of these seem to be down now.
    – learnerX
    Commented Sep 8, 2018 at 22:38

I use VirusShare.com, which has about 5.6 million samples. You will need to request access, but I just explained the research I was doing (as a person unaffiliated with any organisation) and they let me in.

Your question mentioned downloading in bulk. The site says:

Want more than a few samples? Want to download really large samples of malware? Want to download almost the entire corpus? No problem.

The site provides torrents, each consisting of over 100k samples (ranging in size from 13GB to 85GB). Each torrent is a single zip file. You can also download individual files, but if you don't want to download them in bulk, you may be better off looking at one of the other excellent answers.

  • 1
    Update: virusshare.com has as of now 20,395,749 samples. Edit: Now it has 20,395,769...
    – polym
    Commented Aug 5, 2015 at 19:39

You may start to look from your junk email folder and antivirus quarantine.

If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.

Here is a list I created once for my readers:

  1. Malware Domain List

  2. URL Query

  3. Malekal.com list of malware

  4. VX Vault

  5. Site Inspector (by Comodo)

  6. Scumware.org

  7. Malc0de Database

  8. Sucuri Malware Labs

  9. Clean-MX Realtime database

  10. Sourcefire Vulnerability Research Team Labs

  11. Zeus Tracker

  12. NovCon Minotaur Analysis System

Credit goes to: http://ondailybasis.com/blog/?p=1188


I'd suggest Malware.lu. The website writes (as of 2013-03-23):

Currently the database contains 5,356,052 samples.

First you have to request an account. The website lists an email address. You can send a few words why you want to have an account there. After some time they send you your login data.

You can access the data through the website, but they also provide an API. See example Python code.


There is also the option of putting out your own HoneyPot to capture live malware. This does take a bit of effort and some resources (purchasing Internet addressable IP address). However, the advantage of this method is that you are virtually guaranteed to capture malware that are actively being used currently in the wild. There is the possibility that you might hit a jackpot and also get infected with a brand new malware that might even exploit 0-day vulnerabilities. This approach is very helpful for people who are already well-versed in the field of reversing. I have used Dionaea (http://dionaea.carnivore.it/) in the past to set up my own honeypot with very good results. It's replete with instructions, background, and references.

For beginners and for people who don't want to put too much effort gathering samples, I would advise taking the route of downloading the malware from the sites the other posters have indicated.


There are a couple options when it comes to getting samples for analysis.


This one is extremely common and is what is used by a lot of researches to build sample databases.

Recommendation: You could build your own scraper of common sources or build upon ones like: https://github.com/technoskald/maltrieve

Malware Farms

Other researches will at times allow access to their collections. An example of this is malware.lu

Recommendation: Try requesting access to malware.lu and similiar repos. Check the list at the bottom for more. This is a great way to get access to a lot of samples fast.


Researchers can use server and client side honeypots to try and collect malware.


Checkout http://dionaea.carnivore.it/ for a server side honeypot. These are great for collecting self propagating malware.

Checkout https://github.com/buffer/thug for a client side honeypot.


You can browse the shady portions of the internet and look for samples yourself.

This is pretty much the standard list of sample sources: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308

Each one of the above samples has its own pros and cons. Recommend you play with each to find out which produces what you need.


If you ask nicely, you may be able to get researcher access to VirusTotal.

  • Would that work even though I'm just some random guy on the Internet that wants to learn with no credentials?
    – mrduclaw
    Commented Mar 29, 2013 at 21:12
  • There's only one way to find out :-)
    – harley
    Commented Apr 1, 2013 at 13:04
  • Yes you should give a try
    – qwerty
    Commented Apr 2, 2013 at 14:32
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Why do you recommend this? What does it offer?
    – asheeshr
    Commented Jan 22, 2014 at 2:37
  • 3
    Even though this is an old post, I feel that I should say that I contacted VIrusTotal last year about gaining access and they just gave me a price list.
    – Daniel
    Commented Apr 27, 2015 at 21:57

I like to run Kyle Maxwells Maltrieve https://github.com/technoskald/maltrieve, which will collect malware from various resources.

Additionally, I have some samples up for download on my site TekDefense.com http://www.tekdefense.com/downloads/

Legend of random: https://tuts4you.com/download.php?view.3554

The last is for those who want to begin from scratch.I think it's great for you to get start with Ollydbg.Unluckily it's main website already down right now.So you can get only PDF.Grab it before it's gone!


I just wanted to add one that I found on reddit, just so it's here:


The nice thing about this place is that there is absolutely no sign-up or anything.


Related Reddit topic.

[Edit]Here is the content of the page :

"Search youtube for facebook, msn, gmail, yahoo etc password hacking tools or things like xbox points generators and your guaranteed to find a few RATs." --ashtrae


"Try browsing through the recent results at urlquery.net If you see any recent searches/scans that were tagged as malicious, chances are they haven't been fixed yet. There are plenty of other sites out there where you can download samples packed in password protected .zips, but I'm assuming you're looking for something live, like a drive by exploit in this case? If that's true, urlquery should help." -- NattyBroh


"On top of what is already mentioned. Your spam folder. Some malware is spread via email campaigns. Torrents/Usenet - many pirated apps come bundled with a little extra. new unverified torrents on public trackers is a good place to start. Small sketchy ad networks. Even big guys, like adwords, get malware ads once in a while, small companies don't have resources to scan everything thoroughly. ... Check ads for various blackhat services, click links, you'll find some fun stuff. Bad guys are not above infecting each other. Generally, What Would Black Hat Do? is a good motto to stick by. If you were distributing malware, how would you go about it?" --choleropteryx

https://malwr.com/ // posted by highentropy1337
http://malwaretips.com/forums/virus-exchange.104/ // posted by Websly http://contagiodump.blogspot.in/ // posted by bhumish
http://www.kernelmode.info/forum/ // posted by idkbtc

Posted by loualbano:

  1. http://www.scumware.org/reports.scumware
  2. http://minotauranalysis.com/malwarelist.aspx (might be dead)
  3. http://www.malc0de.com/database/
  4. http://www.malwareblacklist.com/showMDL.php
  5. http://cybercrime-tracker.net/
  6. https://zeustracker.abuse.ch/monitor.php?browse=binaries
  7. http://vxvault.siri-urz.net/ViriList.php
  8. https://palevotracker.abuse.ch/
  9. https://spyeyetracker.abuse.ch/monitor.php?browse=binaries
  10. http://www.sacour.cn/m/ (part chinese and part english, click around to find .exe links)
  11. http://www.nothink.org/viruswatch.php
  12. http://www.blade-defender.org/eval-lab/ (dead?)
  13. http://www.malwaredomainlist.com/forums/index.php?topic=3270.0
  14. http://www.malwaredomainlist.com/update.php
  15. http://malwaredb.malekal.com/
  16. http://avcaesar.lu/
  17. http://malwareurls.joxeankoret.com/normal.txt (dead?)
  18. http://virusshare.com/
  19. http://contagiodump.blogspot.com/
  20. http://www.kernelmode.info/forum/viewforum.php?f=16
  21. http://malshare.com/
  22. http://www.malwareblacklist.com/showMDL.php (dead?)
  23. http://openmalware.org/
  24. http://secuboxlabs.fr/ (dead?)
  25. http://support.clean-mx.de/clean-mx/viruses.php
  26. http://www.offensivecomputing.net/
  27. https://forums.malwarebytes.org/index.php?s=fab929606b2191a7ecc31194dec7118f&showforum=51
  28. http://jsunpack.jeek.org/?list=1
  29. http://malwared.ru/database.php?page=1
  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
    – 0xC0000022L
    Commented Dec 26, 2013 at 22:57
  • @0xC0000022L Corrected. Commented Dec 27, 2013 at 13:38
  • and thanks for reacting to it and of course +1.
    – 0xC0000022L
    Commented Dec 27, 2013 at 14:26

Here a website I like which wasn't mentioned before

  • malwaretips.com - "Virus Exchange" forum with active community sharing samples, also contains references to other malware sharing sites.
  • Please give us more details - why are these sites worth mentioning?
    – Ange
    Commented Apr 10, 2013 at 12:53

I give a good one: http://www.virussign.com/downloads.html, It also contains a behavior analysis report.

  • While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes. Why do you recommend this? What does it offer?
    – asheeshr
    Commented Jan 22, 2014 at 2:37

theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.
Malware Source
Malware Binaries

Not the answer you're looking for? Browse other questions tagged or ask your own question.