Malware collections - Page 2

Re: Share litle malware collection part I

#4657 by EP_X0FF
Sun Jan 23, 2011 10:55 am

gigaz wrote:@EP_X0FF
May I ask you a question, how did you sort these malware, is there any specific application or a script?

Well it was simple. Collection was uploaded to server and then scanned through network by specially configured Dr.Web console scanner, the output scanner log was slightly corrected and then simple sorted in Excel.

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: Share litle malware collection part I

#4660 by Xylitol
Sun Jan 23, 2011 11:44 am

EP_X0FF wrote:
gigaz wrote:@EP_X0FF
May I ask you a question, how did you sort these malware, is there any specific application or a script?
Well it was simple. Collection was uploaded to server and then scanned through network by specially configured Dr.Web console scanner, the output scanner log was slightly corrected and then simple sorted in Excel.

wut that a nice idea, personally i've coded my own bot, released here: http://www.kernelmode.info/forum/viewto ... f=11&t=683
not really advanced but... :)

Registration Problems and FAQ - Rules For Malware Requests

Username

Xylitol

Rank

Global Moderator

Posts

1706

Joined

Sat Apr 10, 2010 5:54 pm

Location

Seireitei, Soul Society

Contact

Re: Share litle malware collection part I

#4698 by positronvx
Mon Jan 24, 2011 1:56 pm

Username

positronvx

Posts

1

Joined

Mon Jan 17, 2011 9:46 am

Re: Share litle malware collection part I

#4699 by EP_X0FF
Mon Jan 24, 2011 2:22 pm

Hello,

that cool.

So total size is about 30Gb?

what kind of malware inside and how old is it?

Regards.

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: Share litle malware collection part I

#4828 by Meriadoc
Mon Jan 31, 2011 7:45 am

positronvx wrote:Here is a small collection:

If positronvx and positron are one of the same then they are also part of (added to) the vxheavens collection.

Who controls the past controls the future
Who controls the present controls the past

Username

Meriadoc

Posts

195

Joined

Sat Mar 13, 2010 7:36 pm

Location

Cymru

Latest Malware Collection (19.02.2011)

#5102 by Avinash
Sat Feb 19, 2011 9:37 am

Please note that these samples are only for analysis purpose and not for any criminal activities.

URL:- http://cramitin.us/364a02k51y78

URL:- http://cramitin.us/1yd4btjn42l2

It contains more than 7,000 latest malicious files for testing and analysis. Please Use at your own risk.

Username

Avinash

Posts

11

Joined

Mon May 03, 2010 3:17 pm

Re: Latest Malware Collection (19.02.2011)

#5106 by Meriadoc
Sat Feb 19, 2011 4:07 pm

Hi Avinash,

thanks for sharing :) was the collection gleaned by yourself, what does it contain?

url1 657.2 Mb
url2 500.6 Mb

Who controls the past controls the future
Who controls the present controls the past

Username

Meriadoc

Posts

195

Joined

Sat Mar 13, 2010 7:36 pm

Location

Cymru

Re: Latest Malware Collection (19.02.2011)

#5108 by EP_X0FF
Sat Feb 19, 2011 4:56 pm

Mirroring somewhere will be good idea, because of 50 Kb/sec limit of cramitin.us

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact

Re: Latest Malware Collection (19.02.2011)

#5110 by Xylitol
Sat Feb 19, 2011 7:59 pm

downloaded the first archive of 657.2 Mb and there is only 1k9 files
archive password: infected

with alot of folders who are finally empty

like:
2011-02-17\M\MalwareScope\Backdoor\Hupigon\17\MalwareScope.Backdoor.Hupigon.17
2011-02-17\O\OScope\Dialer\GMHA\OScope.Dialer.GMHA
2011-02-17\R\Rootkit\Win32\Koobface\ff\Rootkit.Win32.Koobface.ff
2011-02-17\T\Trojan-Dropper\MSIL\StubRC\gve\Trojan-Dropper.MSIL.StubRC.gve
2011-02-17\T\Trojan-Dropper\Scared\Trojan-Dropper.Scared
2011-02-17\T\Trojan-PWS\Stealer\Trojan-PWS.Stealer
lol really... 3k6 folders and 1k9 files.. ok have fun creating empty folders, full waste of time.
where are your 7k files ?

edit: the 2nd archive (500mb) is also password protected and password like 'infected' or 'malware' dont work so i hope you have a good zip brute forcer.
according to winrar the 2nd archive: 2262 other archives.

Registration Problems and FAQ - Rules For Malware Requests

Username

Xylitol

Rank

Global Moderator

Posts

1706

Joined

Sat Apr 10, 2010 5:54 pm

Location

Seireitei, Soul Society

Contact

Re: Latest Malware Collection (19.02.2011)

#5112 by EP_X0FF
Sun Feb 20, 2011 4:48 am

Password was infected.
First archive include samples sorted in directories by malware name.
Second archive contains zip archives named by MD5 hash of sample.
I assume this is two different collections.

Not so many really new files, maybe few percents. Some files dated back to 2006, 2009. Total count is 4191. How many clean, empty or duplicate files I don't know.

I've combined both archives in one with only MD5 named files inside (directories removed), split it on 4 parts and uploaded them to megaupload.

pass for archive - malware

http://www.megaupload.com/?d=7WZAB1VP (350 MB, part 1)
http://www.megaupload.com/?d=ZOD4Q052 (350 MB, part 2)
http://www.megaupload.com/?d=NXFTGLZL (350 MB, part 3)
http://www.megaupload.com/?d=NMK9DG7J (58.54 MB, part 4)

Files will be deleted by megaupload after 21 day.

Ring0 - the source of inspiration

Username

EP_X0FF

Rank

Global Moderator

Posts

4947

Joined

Sun Mar 07, 2010 5:35 am

Location

Russian Federation

Contact