It seems that a popular use of software reverse engineering skills is to reverse malicious code in an effort to build better protection for users.
The bottleneck here for people aspiring to break into the security industry through this path seems to be easy access to new malicious code samples to practice on and build heuristics for.
Are there any good resources for a person unaffiliated with any organization to download malware in bulk to run analysis on?
There's a number of interesting resources you can get malware from
In addition to these, you can always live dangerously and click on shady affiliate marketing ads or find various signatures for the multitude of "BEPs" (Browser Exploit Packs) that malware authors frequently use to get installs and analyze the payload to try to find what they are trying to download and exec.
There are many great options to get malware samples in all the comments but, also, I want to point you to 2 more options:
I use VirusShare.com, which has about 5.6 million samples. You will need to request access, but I just explained the research I was doing (as a person unaffiliated with any organisation) and they let me in.
Your question mentioned downloading in bulk. The site says:
Want more than a few samples? Want to download really large samples of malware? Want to download almost the entire corpus? No problem.
The site provides torrents, each consisting of over 100k samples (ranging in size from 13GB to 85GB). Each torrent is a single zip file. You can also download individual files, but if you don't want to download them in bulk, you may be better off looking at one of the other excellent answers.
You may start to look from your junk email folder and antivirus quarantine.
If you need something in particular, you may try to grab them live, from URLs posted by other researchers, and after you find something you want to share, add there too.
Here is a list I created once for my readers:
Credit goes to: http://ondailybasis.com/blog/?p=1188
I'd suggest Malware.lu. The website writes (as of 2013-03-23):
Currently the database contains 5,356,052 samples.
First you have to request an account. The website lists an email address. You can send a few words why you want to have an account there. After some time they send you your login data.
You can access the data through the website, but they also provide an API. See example Python code.
There is also the option of putting out your own HoneyPot to capture live malware. This does take a bit of effort and some resources (purchasing Internet addressable IP address). However, the advantage of this method is that you are virtually guaranteed to capture malware that are actively being used currently in the wild. There is the possibility that you might hit a jackpot and also get infected with a brand new malware that might even exploit 0-day vulnerabilities. This approach is very helpful for people who are already well-versed in the field of reversing. I have used Dionaea (http://dionaea.carnivore.it/) in the past to set up my own honeypot with very good results. It's replete with instructions, background, and references.
For beginners and for people who don't want to put too much effort gathering samples, I would advise taking the route of downloading the malware from the sites the other posters have indicated.
There are a couple options when it comes to getting samples for analysis.
This one is extremely common and is what is used by a lot of researches to build sample databases.
Recommendation: You could build your own scraper of common sources or build upon ones like: https://github.com/technoskald/maltrieve
Other researches will at times allow access to their collections. An example of this is malware.lu
Recommendation: Try requesting access to malware.lu and similiar repos. Check the list at the bottom for more. This is a great way to get access to a lot of samples fast.
Researchers can use server and client side honeypots to try and collect malware.
Recommendation:
Checkout http://dionaea.carnivore.it/ for a server side honeypot. These are great for collecting self propagating malware.
Checkout https://github.com/buffer/thug for a client side honeypot.
You can browse the shady portions of the internet and look for samples yourself.
This is pretty much the standard list of sample sources: http://www.kernelmode.info/forum/viewtopic.php?f=16&t=308
Each one of the above samples has its own pros and cons. Recommend you play with each to find out which produces what you need.
If you ask nicely, you may be able to get researcher access to VirusTotal.
I like to run Kyle Maxwells Maltrieve https://github.com/technoskald/maltrieve, which will collect malware from various resources.
Additionally, I have some samples up for download on my site TekDefense.com http://www.tekdefense.com/downloads/
Legend of random: https://tuts4you.com/download.php?view.3554
The last is for those who want to begin from scratch.I think it's great for you to get start with Ollydbg.Unluckily it's main website already down right now.So you can get only PDF.Grab it before it's gone!
I just wanted to add one that I found on reddit, just so it's here:
The nice thing about this place is that there is absolutely no sign-up or anything.
[Edit]Here is the content of the page :
"Search youtube for facebook, msn, gmail, yahoo etc password hacking tools or things like xbox points generators and your guaranteed to find a few RATs." --ashtrae
-
"Try browsing through the recent results at urlquery.net If you see any recent searches/scans that were tagged as malicious, chances are they haven't been fixed yet. There are plenty of other sites out there where you can download samples packed in password protected .zips, but I'm assuming you're looking for something live, like a drive by exploit in this case? If that's true, urlquery should help." -- NattyBroh
-
"On top of what is already mentioned. Your spam folder. Some malware is spread via email campaigns. Torrents/Usenet - many pirated apps come bundled with a little extra. new unverified torrents on public trackers is a good place to start. Small sketchy ad networks. Even big guys, like adwords, get malware ads once in a while, small companies don't have resources to scan everything thoroughly. ... Check ads for various blackhat services, click links, you'll find some fun stuff. Bad guys are not above infecting each other. Generally, What Would Black Hat Do? is a good motto to stick by. If you were distributing malware, how would you go about it?" --choleropteryx
https://malwr.com/ // posted by highentropy1337
http://malwaretips.com/forums/virus-exchange.104/ // posted by Websly http://contagiodump.blogspot.in/ // posted by bhumish
http://www.kernelmode.info/forum/ // posted by idkbtc
Posted by loualbano:
Here a website I like which wasn't mentioned before
I give a good one: http://www.virussign.com/downloads.html, It also contains a behavior analysis report.
theZoo
theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.
Malware Source
Malware Binaries