KernelMode.info

Below is the list of rootkit samples available here (only most notorious). Follow the links for download.
Several malware listed here not really rootkits in terms of original meaning of this word, but malware with driver agents.

Win32 Rootkits

• Demo Rootkits (not malicious)
• Collection of old malware rootkits for testing (2005 - 2009 years)
• Avatar (TDL3 clone)
• Black Energy
• Carberp
• Cutwail
• Dorkbot
• MaxSS, TDL3 and later TDL4 fork
• Rustock
• Sinowal
• SpyEye
• Stuxnet
• TDL2
• TDL3
• Turla
• ZeroAccess aka Sirefef, MaxPlus

Win64 Rootkits

• Cidox / Mayachok.2
• Simda (BkLoader based)
• MaxSS TDL4+
• Necurs
• PlusDriver
• TDL4
• Turla

You can find list of malware with bootkits (note: not all of them are actual rootkits) here -> http://www.kernelmode.info/forum/viewto ... =16&t=1648
Some viruses may also include rootkit functionality, see list here -> http://www.kernelmode.info/forum/viewto ... =16&t=1644

Moderator wrote:If you have modern rootkit that is not listed here and you want to share sample - start new dedicated thread, link to it will be added here.