Search remote malware zoo for homologous samples

Question

I've got the following problem:

I'd like to find new binaries of a certain malware family -- unpacked -- for subsequent analysis (active C&C comms analysis).

Is there a database of binaries somewhere where I can write a query like the following:

Give me samples that are homologous to an input binary (or collection thereof) using fuzzy hashing as the distance metric and then filter by date seen?

To clarify, the samples don't use packing.

Answer 1

I am afraid that most of these databases aren't public, the malware analysis companies tries to keep it for them.

Yet, I recommend you to take a look at VirusTotal (see its Wikipedia page for more information about it) which is probably the most furnished database available on-line.

You may also want to take a look at the IRMA (Incident Response Malware Analysis) framework if you want to run your own server.

Finally, here is a collection of tools and papers on methods to find similarities in binary blobs:

• sdhash tool (see also this blog post);
• ssdeep tool;
• BinSlayer: Accurate Comparison of Binary Executables, by Bourquin, King and Robbins , 2013 (GitHub Project);
• mvHash - a new approach for fuzzy hashing, by Knut Petter Åstebø, 2012;
• An evaluation of forensic similarity hashes, by Vassil Roussev, 2011.

This list is far from being complete, but I think that this is a good starting point...

Hope this will help you !

Answer 2

VirusTotal has import hash to match: http://blog.virustotal.com/2014/02/virustotal-imphash.html

Answer 3

I work on the team for darkpoint. Our platform can compare and cluster submitted malware based on feature vectors. Basically, we do static and dynamic analysis to determine the characteristics of all the software we see. Then we use machine learning to discover matches. You can also do explicit matches based on normal search terms.

Answer 4

malshare.com - Request an API Key and pull all the samples you want.