A forum for reverse engineering, OS internals and malware analysis 

Obtaining New Malware and Improving

Forum for analysis and discussion about malware.

Obtaining New Malware and Improving

 #30052  by Mondragon
 Wed Mar 01, 2017 12:10 am
Hi, I'm currently a software developer who is getting into malware analysis and reverse engineering; this is where my passion lies.

One question I have is, what can I do to further develop myself as an analyst? I'm currently working through Practical Malware Analysis and Practical Reverse Engineering. When I'm done with the labs, I'll be moving onto Malware Analysis Cookbook... Soon I'm going to start going and downloading known malware samples to analyze on my lab machine... But of course there is limited "value" (aside from my personal education) in doing this for the market since these are already classified and they already have definitions. So my questions are:

1. Is it necessary for me to be a "good" analyst that I work on all or mostly unclassified malware?
2. How do I do this? I currently have no idea where to obtain "fresh" unanalyzed malware. I'd like to do this both in my own time and eventually for a company as well... But if I could do it independently, I'd love to do that too. Thanks.

Re: Obtaining New Malware and Improving

 #30151  by syntx
 Thu Mar 23, 2017 10:53 am
I think you might be jumping a bit far ahead in going for unclassified samples. As you say, you are currently working through the Practical Malware Analysis book which is good. But I think you may be overwhelmed when going from that to more real-world "unclassified" malware.

I would recommend that you work on some well documented malware families without looking at the documentation, if you find yourself stuck somewhere you can always turn to the many posts, whitepapers and talks available. The important part is that you try, try, try again, try harder until you eventually succeed, RE malware isn't easy.

When you've been working with different kind of samples and families for some time you will start to build up your own knowledge base and have more valuable experience when digging into unclassified samples.

As for obtaining samples you can turn to http://www.kernelmode.info/forum/viewto ... f=16&t=308, also check the feed on hybrid-analysis.com. I would also recommend follow people on twitter which are into malware analysis, @malwrhunterteam for example tweets about "fresh" samples.
 Return to “Malware”