/malware-samples

Malware samples, analysis exercises and other interesting resources.

Primary LanguageHTML

Tweet  Github Discussions

Malware Samples

This repository is intended to provide access to a wide variety of malicious files and other artifacts.

All of the samples are in a password protected ZIP archive using a password of: infected

Malware Analysis Exercises

In addition to providing artifacts from samples, I will regularly post malware anlaysis exercises. These exercises will cover a wide range of malware analysis topics and come with detailed solutions and walk-throughs.

2022

2021

2020

Training PCAPs

PCAP files that exhibit specific network activity, to help with analysis, rule writing or whatever comes your way! Relevant capture filters are applied to help limit the scope of what is in the PCAP file.

-> Training PCAPs

Summary of Samples

Samples from Trainings and Workshops

Sample files and other artifacts from public trainings, talks and workshops.

2021

2020

Maldocs

Will contain Office documents identified to be used to distribute malware based on organizing folder structure. For example, the emotet folder will contain maldocs identified to have dropped Emotet. These samples are organized by year/month that I obtained and executed them - this may deviate slightly from when they were first discovered in the wild (for example, first submission date on VirusTotal).

To the max extend possible I will also include associated PCAPs. PCAPs may contain the resuling Emotet binary that was dropped, as well as follow-on C2 communication. However, I can not guarantee that each PCAP will contain this full sequence of events.

Current maldocs include:

  • AgentTesla
  • Banload
  • Emotet
  • Hancitor
  • IcedId
  • Lokibot
  • Trickbot
  • Unknown

Maldoc Templates

The image analysis script used to generate maldoc image graphs can be found at: https://github.com/jstrosch/graph-maldoc-similar-images

Memory Dumps

Will contain full VM memory and individual process memory dumps from malware samples. Most will come from dumpming memory via Cuckoo Sandox. Due to the size of the memory dumps, links to an archived version of them are provided for download. Current memory dumps include:

  • Emotet
  • LokiBot

Binaries

This will contain binaries (i.e. PE/.NET, Java, etc) from known malware families. Currently, this archive contains samples from:

  • Agenttesla
  • Ave Maria / Warzone RAT
  • Azorult
  • Blue Botnet
  • Buer Loader
  • Dridex
  • Emotet
  • Gandcrab
  • Lokibot
  • Nanocore
  • Remcos
  • Socelars
  • Trickbot
  • Troldesh
  • Turkojan
  • Vidar

Warnings and Disclaimers

This repository is intended for educational and research purposes. The samples provided here are all real-world malware, please handle with all of the necessary caution.

Please note, all samples/artifacts will be in a password-protected archive using a password of: infected