theZoo - A repository of LIVE malwares for your own joy and

项目说明

theZoo - A Li Repository

![Contributions Welcome]()
![HitCount]()
![GitHub stars]()
![made-with-python]()

!Logo

theZoo is a project created to make the possibility of malware analysis open and a to the public. Since we ha out that almost all of malware are very hard to come by in a way which will allow analysis, we ha to gather all of them for you in an accessible and safe way.
theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.

theZoo is open and welcoming !

If you are about to interact with our community please make sure to read our CODE-OF-CONDUCT.md prior to doing so. If you plan to contribute, first - thank you. However, do make sure to follow the standards on CONTRIBUTING.md.

Disclaimer

theZoo's purpose is to allow the study of malware and enable people who are interested in malware analysis (or maybe even as a part of their job) to ha to li, analyse the ways they operate, and maybe e ad and sav to block specific malware within their own en.

Please remember that these are live and dangerous malware! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!

We recommend running them in a has no internet connection (or an internal network if you must) and without guest additions or any equi. Some of them are worms and will automatically try to spread out. Running them unconstrained means that you will infect yourself or others with and dangerous malware!!!

Getting Started

Clone the repository with git clone . Go to the directory and run pip install --user -r requirements.txt. This should install all latest requirements needed. In total can be "scripted" like so:

Start by running the console:

python theZoo.py

License

theZoo - the most awesome free malware database on the air
Copyright (C) 2015-2021, Yu, Lahad Ludar, 5fingers

This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either 3 of the License, or
(at your option) any later .

This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

You should ha a copy of the GNU General Public License
along with this program. If not, see <

You can also find more information in LICENSE.md.

License section does not apply to any of malicious samples in theZoo's repository which includes samples and source code, re or otherwise.

Documentation and Notes

Background

theZoo's objective is to offer a fast and easy way of retrieving malware samples and source code in an organized fashion in hopes of promoting malware research.

Root Files

Since 0.42 theZoo has been undergoing dramatic changes. It now runs in both CLI and ARG. You can call the program with the same command line arguments as before.
The current default state of theZoo runtime is the CLI. The following files and directories are responsible for the application's behaviour.

/conf - The conf folder holds files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf and more.

/imports - Contains .py import files used by the rest of the application

/malware/Binaries - The actual malwares samples - be careful! These are very live.

/malware/Source - Malware source code.

Malware under the folder Original is supposed to be (NO PROMISES!) the original source of the malware that leaked. Malware under the folder Re is either re, decompiled or partially reconstructed.

Directory Structure:

Each directory is composed of 4 files:

Malware files in an encrypted ZIP archive.

SHA256 sum of the 1st file.

MD5 sum of the 1st file.

Password file for the archive.

Bugs and Reports

The repository holding all files is currently

Submit Malware

Get the file you want to submit and just run python prep_file.py file_tosubmit.exe. It will create a directory for you. Then just submit that along with the changes to the conf/maldb.db so that we know which malware it is.

Change Log for v0.60:

[x] Moved DB to SQLite3.

[x] Searching o to a freestyle fashion.

[x] Fixed "get" command.

[x] More & more malwares.

Change Log for v0.50:

[x] Better and easier UI.

[x] Aligned printing of malwares.

[x] Command line arguments are now working.

[x] Added 10 more malwares (cool ones) to the DB.

Change Log for v0.42:

[x] Fix EULA for proper disclaimer.

[x] More precise searching and indexing including platform and more.

[x] Added 10 new malwares.

[x] Git update of platform and new malware.

[x] Fix display of search.

[x] Enable support for platform and architecture in indexing.

[x] Separate between database and application.

[x] UI impro.

Change Log for v0.43:

[X] argv to be working properly. (fixes in v0.5)

[X] upload and indexing module. - Not possible due to restrictions of VT.

[X] Automatic reporting system for malwares which are not indexed in the framework.

Change Log for v0.50:

[X] Malware analysis pack has been removed to reduce clone size.

[X] More documentation has been added.

[X] Remo function which were dead in the code.

Predicted Change Log for v1.0

[X] Fix auto-complete for malware frameworks. (thanks to 5fingers)

[X] Consider changing DB to XML or SQLite3. (Sheksa - done :))

[X] Better UI features.

[ ] Fix and make 'light' without malwares with _MalwareFetch function.

Hopeful

[ ] A GUI.

[ ] Package releases.

If you have any suggestions or malware that you ha (in the manner laid out in the documentation) please send it to us to - thezoo-submissions [a-t] morirt [.d0t.] com - so we can add it for e's enjoyment.

Shout outs

Thanks to for the licensing change submission.

项目信息

开发语言：Python

Star 数：13438

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A repository of LIVE malwares for your own joy and pleasure. theZoo is a project created to make the possibility of malware analysis open and available to the public.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。