3

I've got the following problem:

I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis).

Is there a database of binaries somewhere where I can write a query like the following:

Give me samples that are homologous to an input binary (or collection thereof) using fuzzy hashing as the distance metric and then filter by date seen?

To clarify, the samples don't use packing.

  • 1
    AV companies (and some security companies) spend a large amount of resources creating these databases. I know of no public system that allows you to search for homologous samples using just a sample (or set of samples) as input. You may want to search based on strings in your sample, and if you don't find anything with that approach, reach out to friends in the AV industry to see if they can help you find related samples. – Jason Geffner Aug 21 '14 at 22:18
2

I am afraid that most of these databases aren't public, the malware analysis companies tries to keep it for them.

Yet, I recommend you to take a look at VirusTotal (see its Wikipedia page for more information about it) which is probably the most furnished database available on-line.

You may also want to take a look at the IRMA (Incident Response Malware Analysis) framework if you want to run your own server.

Finally, here is a collection of tools and papers on methods to find similarities in binary blobs:

This list is far from being complete, but I think that this is a good starting point...

Hope this will help you !

2

VirusTotal has import hash to match: http://blog.virustotal.com/2014/02/virustotal-imphash.html

  • In fact, imphash (Import Hashing) correspond just to the hash of the import table of the executable. It is a good signature for software using an unusual set of API functions, but if you manage to use only very common ones you will remain unnoticed. Better than the link you gave, prefer this one (much more detailed). – perror Aug 22 '14 at 12:36
1

I work on the team for darkpoint. Our platform can compare and cluster submitted malware based on feature vectors. Basically, we do static and dynamic analysis to determine the characteristics of all the software we see. Then we use machine learning to discover matches. You can also do explicit matches based on normal search terms.

1

malshare.com - Request an API Key and pull all the samples you want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.