malware-samples - Malware samples, analysis exercises and other inte

项目说明

![Tweet]()  ![Github Discussions]()

Malware Samples

This repository is intended to provide access to a wide of malicious files and other artifacts.

> All of the samples are in a password protected ZIP archi a password of: *infected*

Malware Analysis Exercises

In addition to pro artifacts from samples, I will regularly post malware anlaysis exercises. These exercises will cover a wide range of malware analysis topics and come with detailed solutions and walk-throughs.

2022

* October: Tracing Shellcode Execution from

2021

* December: Maldocs - Automating Download URL Extraction with Python
* February: Maldocs - Getting Started with Excel 4 Macros (XLM Macros)
* August: Ja - Deobfuscating a Turla JS Backdoor

2020

* December: Maldocs - Living Off The Land with Powershell

Training PCAPs

PCAP files that exhibit specific network activity, to help with analysis, rule writing or whate your way! Relevant capture filters are applied to help limit the scope of what is in the PCAP file.

-> <a href="training_pcaps/">Training PCAPs</a>

Summary of Samples

* 2023-02-17: YouTube Video: OneNote Malware Trends - In Script Execution that Leads to QuakBot
* 2023-02-07: YouTube Video: A .NET Downloader and an Open Directory - Unra the Encrypted Payload That Leads to CryptBot
* 2023-02-04: YouTube Video Series: In NullMixer - Identifying Packing Techniques, Identifying and Unra ASPack, and In Network Traffic with Suricata and Evebox
* 2023-01-23: YouTube Video: OneNote Malware - Tips and Tricks for In OneNote Malware Used to Deli
* 2023-01-12: YouTube Video Series: Getting Started with Detect-It-Easy, Identifying Signs of Packing, Unpacking Vidar Stealer with Time-Tra
* 2023-01-02: YouTube Video: The Basics of O in PE Files w/ DCRat
<br><br>
* 2022-12-15: YouTube: Getting Started with dnSpyEx - Unra a .NET Formbook Dropper
* 2022-03-26: Maldoc Templates - Heodo, AgentTesla, NanoCore, Loki, SilentBuilder, Hancitor, NONE, Quakbot
* 2022-03-12: Maldoc Templates - Heodo, Formbook, AgentTesla, Loki, NanoCore, NONE, Quakbot
* 2022-03-05: Maldoc Templates - OskiStealer, RemcosRAT, Loki, NONE, NanoCore, Quakbot, SnakeKeylogger, Formbook, Heodo
* 2022-02-26: Maldoc Templates - SilentBuilder, Heodo, Quakbot, NanoCore, NONE, Loki
<br><br>
* 2022-01-22: Maldoc Templates - QuasarRAT, SnakeKeylogger, NONE, Formbook, Loki, A, AsyncRAT, SilentBuilder, GuLoader, Heodo
<br><br>
* 2021-12-31: Maldoc Templates - NONE, SnakeKeylogger, QuasarRAT, Quakbot, IcedID
* 2021-12-25: Maldoc Templates - TrickBot, Dridex, AsyncRAT, SnakeKeylogger, QuasarRAT, RemcosRAT, SilentBuilder, Quakbot, A, NONE, Heodo, BitRAT, BazaLoader
* 2021-12-22: Excel document uses to execute cmd.exe to run Powershell script -> Downloads WarzoneRAT o
* 2021-12-17: Maldoc Templates - Maldoc Templates - Quakbot, Formbook, IcedID, SilentBuilder, Dridex, Loki, AgentTesla, AsyncRAT, QuasarRAT, NONE
* 2021-12-16: Excel document uses XLM macros to execute cmd.exe to download/run MSHTA script -> Downloads Powershell script -> Downloads Emotet DLL
* 2021-12-11: Maldoc Templates - Heodo, Loki, BluStealer, Dridex, Quakbot, NONE, IcedID, AgentTesla, TrickBot
* 2021-12-04: Maldoc Templates - Heodo, Quakbot, Loki, Hancitor, SilentBuilder, NONE, Formbook, Dridex, BitRAT, IcedID
<br><br>
* 2021-11-17: BlackNET 3.7.0.0 source code found in an opendir
* 2021-11-13: Word Document uses Packager Shell Object to Execute , Run Powershell to Download AgentTesla
<br><br>
* 2021-10-30: Maldoc Templates - AsyncRAT, Quakbot, A, Formbook, Loki, TrickBot, AgentTesla, SnakeKeylogger, ArkeiStealer, Hancitor, NONE, Dridex
* 2021-10-15: Word downloads Formbook EXE
<br><br>
* 2021-09-27: Excel drops Qakbot (qbot) EXE
<br><br>
* 2021-08-28: Maldoc Templates - BazaLoader, Loki, NONE, Hancitor, CobaltStrike, Dridex, RedLineStealer
* 2021-08-07: Maldoc Templates - a310Logger, NONE, AZORult, BuerLoader, Loki, Formbook, TrickBot, Hancitor
<br><br>
* 2021-07-17: Maldoc Templates - IcedID, Gozi, RustyLoader, NONE, njrat, Loki, CobaltStrike, Formbook, Dridex, TrickBot
* 2021-07-03: Maldoc Templates - Quakbot, TrickBot, FickerStealer, Dridex, AgentTesla, NONE
<br><br>
* 2021-06-19: Maldoc Templates - NONE, Adwind, Quakbot, AgentTesla, IcedID, Formbook, Gozi, TrickBot, SnakeKeylogger, Dridex
* 2021-06-12: Maldoc Templates - NONE, Dridex, TrickBot, BazaLoader, NanoCore, Loki, AsyncRAT, IcedID, SnakeKeylogger, njrat, SilentBuilder, Formbook, RemcosRAT, OskiStealer, Gozi, Quakbot
* 2021-06-12: Excel drops TransparentTribe (.NET) with CNC Check-in
* 2021-06-09: Excel downloads AsyncRAT
* 2021-06-05: Maldoc Templates - Adwind, NONE, Formbook, IcedID, Dridex, RemcosRAT, Loki, DoubleBack, AgentTesla, SnakeKeylogger, Gozi, Quakbot, njrat
<br><br>
* 2021-05-22: Maldoc Templates - Dridex, NONE, Adwind, RemcosRAT, TrickBot, AgentTesla, FickerStealer, IcedID, Loki, BazaLoader, SilentBuilder, Hancitor, Quakbot
* 2021-05-17: Diamondfox opendir w/ several modules and documentation
* 2021-05-15: Maldoc Templates - NONE, njrat, TrickBot, ArkeiStealer, CrimsonRAT, SilentBuilder, Quakbot, Dridex, SnakeKeylogger, IcedID, Adwind, RedLineStealer, AZORult, Hancitor, AgentTesla, Loki
* 2021-05-08: Maldoc Templates - IcedID, SilentBuilder, AgentTesla, BuerLoader, TrickBot, Loki, ArkeiStealer, RaccoonStealer, AsyncRAT, NONE, Quakbot, Dridex, Hancitor
<br><br>
* 2021-04-30: Maldoc Templates - SnakeKeylogger, Dridex, Quakbot, AgentTesla, NONE, Hancitor, Loki, TrickBot, SilentBuilder, Heodo, njrat, Formbook, Gozi, AZORult
* 2021-04-24: Maldoc Templates - April 19 - April 23: Dridex, AgentTesla, IcedID, NONE, Quakbot, RedLineStealer, Loki, Gozi, TrickBot
* 2021-04-21: Ja Launch Protocol (jnlp) / JAR, Downloads Gozi DLL
* 2021-04-20: Word Document Uses Template Injection that downloads an RTF Document, Exploits C to Drop Nanocore
* 2021-04-17: Maldoc Templates - April 12 - April 16: Formbook, TrickBot, Dridex, SilentBuilder, AgentTesla, SnakeKeylogger, njrat, Quakbot, AZORult, Hancitor, Heodo, Loki, Gozi
* 2021-04-10: Maldoc Templates - April 05 - April 09: TrickBot, IcedID, NONE, BuerLoader, Formbook, Heodo, Hancitor, SilentBuilder, Dridex, Gozi
* 2021-04-08: Purple Fox Exploit Kit Activity - Landing Page and Other Artifacts
* 2021-04-03: Maldoc Templates - March 29 - April 02: Gozi, BuerLoader, AgentTesla, BitRAT, IcedID, Loki, SilentBuilder, NONE, gozi, Dridex, Quakbot
* 2021-04-01: Excel drops IcedId - Uses to execute Excel 4 macros in hidden sheet/hidden columns
<br><br>
* 2021-03-31: QBot Open directory w/ Access to Proxy Scripts, .HTACCESS File
* 2021-03-26: Rig EK, unalbe to obtain payload(s)
* 2021-03-27: Maldoc Templates - March 22 - 22, 2021: AgentTesla, SilentBuilder, IcedID, AsyncRAT, Loki, Dridex, Formbook, NanoCore, TrickBot, BazaLoader, Quakbot, LemonDuck
* 2021-03-16: Maldoc Templates - March 15 - 19, 2021: Dridex, TrickBot, QuakBot, AgentTesla, SilentBuilder, Gozi, IcedID, Hancitor
* 2021-03-13: Maldoc Templates - March 08 - 12, 2021: BuerLoader, SilentBuilder, TrickBot, Gozi, AgentTesla, BazaLoader, NetWire, A, Loki, NONE, Quakbot, IcedID, ZLoader, Dridex, BazarCall
* 2021-03-06: Maldoc Templates - March 01 - 05 - Gozi, BazarCall, SilentBuilder, Quakbot, Loki, CobaltStrike, SnakeKeylogger, TrickBot, AgentTesla, Dridex, NONE, Hancitor
<br><br>
* 2021-02-27: Maldoc Templates for February 22 - 26, 2021: SilentBuilder, TrickBot, Hancitor, Dridex, AsyncRAT, Quakbot, MassLogger, Formbook
* 2021-02-20: Maldoct Templates for February 15 - 19: NetWire, TrickBot, SilentBuilder, AgentTesla, A, SnakeKeylogger, njrat, NONE, ZLoader, Dridex, Loki, Quakbot, RemcosRAT, FickerStealer
* 2021-02-13: Maldoc Templates for February 08 - 12, 4 groups: Dridex, Heodo/Emotet, Unknown
* 2021-02-06: Maldoc templates for Feb 01 - 05, 3 groups: SilentBuilder and Emotet
<br><br>
* 2021-01-30: Maldoc templates for Jan 25 - 29, 2 groups: Emotet, Unknown
* 2021-01-30: Maldoc templates for Jan 18 - 22, 4 groups: Emotet, Dridex
* 2021-01-23: Maldoc templates for Jan 11 - 15, 8 groups: Emotet, Dridex
* 2021-01-15: Excel drops Qakbot (qbot) DLL
* 2021-01-15: Word doc w/ embedded Hancitor loader, IP check and C2 activity
* 2021-01-09: Maldoc templates for Jan 04 - 08, 6 groups: Emotet, Trickbot, Dridex
* 2021-01-07: Excel doc drops Raccoon
* 2021-01-02: Maldoc templates for Dec 28 - Jan 01, 3 groups: Emotet, Dridex, Emotet
<br><br>
* 2020-12-26: Maldoc templates Dec 21 - Dec 25, 11 groups: Emotet, Dridex and 1 unknown
* 2020-12-19: Maldoc templates Dec 14 - Dec 18. 17 groups: Dridex, TA505 and Emotet
* 2020-12-15: Maldoc templates Dec 07 - Dec 11. 7 groups: 1 - 5 Dridex, 6 BitRat, 7 Emotet
* 2020-12-15: Excel Decodes DLL (Campo Loader) w/ Certutil for next stage retrieval - includes analysis on YouTube and IDA Plugin for String Deobfuscation
* 2020-12-05: Maldoc templates for the week of Nov 30 - Dec 04
<br><br>
* 2020-11-28: Maldoc templates for the week of Nov 23 - Nov 27
* 2020-11-27: Excel drops Qakbot (qbot) DLL
* 2020-11-24: FickerStealer w/ IP check
* 2020-11-24: Word document drops Smokeloader
* 2020-11-24: Word document drops Dridex DLL w/ Check-In
* 2020-11-21: Maldoc templates for the week of Nov 16 - Nov 20
* 2020-11-14: Maldoc templates for the week of Nov 09 - Nov 13
* 2020-11-10: Emotet maldoc - Embedded DLL and CertUtil for Base64 Decoding, includes analysis on YouTube
* 2020-11-07: Maldoc templates for the week of Nov 02 - Nov 06
<br><br>
* 2020-10-31: Maldoc templates for the week of Oct 26 - Oct 30
* 2020-10-29: Excel doc drops Qakbot
* 2020-10-24: Maldoc templates for the week of Oct 19 - Oct 23
* 2020-10-16: Emotet templates for the week of Oct 12 - Oct 16
* 2020-10-09: Emotet templates for the week of Oct 05 - Oct 09
* 2020-10-02: Emotet templates for the week of Sept 28 - Oct 02
* 2020-10-05: Word doc uses Lua for follow-on activity
<br><br>
* 2020-09-17: Word doc drops Betabot (Uses C)
<br><br>
* 2020-08-29: ArkeiStealer sample with data exfil
* 2020-08-21: Azorult drops AsyncRat, REMCOS possible others
* 2020-08-15: Cerber ransomware with check-in
* 2020-08-02: Raccoon stealer drops crypto-currency miner
<br><br>
* 2020-07-24: Amadey bot with payloads and check-in
* 2020-07-24: Raccoon stealer w/ CnC check-in
* 2020-07-19: Excel doc drops GuLoader
* 2020-07-13: Word doc drops Hancitor loader
<br><br>
* 2020-06-29: Trickbot 1000512 and gtag ono51, drops new nwormDll64 module - includes 12hour PCAP
* 2020-06-29: Two Excel docs that drop Netwire, includes C2 check-ins
* 2020-06-20: ZLoader with chekc-in
* 2020-06-01: Excel doc drops Guloader
* 2020-06-01: IcedID with Image used for Steganography
<br><br>
* 2020-05-29: Maldoc uses template injection for macro execution
* 2020-05-13: Gamma Ransomware with HTTP check-in
* 2020-05-13: Cryptbot sample
* 2020-05-13: Danabot sample with beaconing
* 2020-05-04: Trickbot w/ GTAG tt002 and 1000509, 12 hour PCAP w/ beacons
<br><br>
* 2020-04-26: Gomorrah stealer (.NET binary)
* 2020-04-16: Trickbot w/ GTAG MAN6 and 1000507 - Uses re.txt config
* 2020-04-16: AgentTesla data exfil through SMTP
* 2020-04-14: Vidar sample with data exfil via ZIP file
* 2020-04-13: Azorult drops Blackout Ransomware
* 2020-04-04: A/Warzon RAT
<br><br>
* 2020-03-27: Word drops Ursnif through MSHTA.exe
* 2020-03-26: Word drops Banload banking trojan
* 2020-03-26: Excel drops AgentTesla
* 2020-03-26: Word drops IcedId
* 2020-03-25: NanoCore sample with dumped plugins (.NET assemblies)
* 2020-03-24: Blue Botnet
* 2020-03-19: Formbook
* 2020-03-14: Excel drops LokiBot
<br><br>
* 2020-02-29: Buer loader
* 2020-02-18: Remcos
* 2020-02-13: Turkojan
<br><br>
* 2016-02-28: Angler EK from Alexu.edu.eg

Samples from Trainings and Workshops

Sample files and other artifacts from public trainings, talks and workshops.

2021

* 2021-01-13: FloCon - Workshop: Intrusion Analysis and Threat Hunting with Open Source Tools - Demo files and Workshop on YouTube
* 2021-08-08: DefCon 29 Workshop - Modern Malware Analysis for Threat Hunters
* 2021-06: R0 Vegas: Malware Unpacking
* 2021-08-26: HITBLab: Modern Malware Analysis for Threat Hunters (HITB Singapore)

2020

* 2020-11-19: Hack-in-the-Box Cyber Week Workshop: Analyzing Malicious Word and Excel Documents - Demo files and Workshop on YouTube

Maldocs

Will contain Office documents identified to be used to distribute malware based on organizing folder structure. For example, the *emotet* folder will contain maldocs identified to ha Emotet. These samples are organized by year/month that I obtained and executed them - this may deviate slightly from when they were first discovered in the wild (for example, first submission date on ).

To the max extend possible I will also include associated PCAPs. PCAPs may contain the resuling Emotet binary that was dropped, as well as follow-on C2 communication. However, I can not guarantee that each PCAP will contain this full sequence of events.

Current maldocs include:

* AgentTesla
* Banload
* Emotet
* Hancitor
* IcedId
* Lokibot
* Trickbot
* Unknown

Maldoc Templates

The image analysis script used to generate maldoc image graphs can be found at:

Memory Dumps

Will contain full and indi process memory dumps from malware samples. Most will come from dumpming memory Sandox. Due to the size of the memory dumps, links to an archi of them are provided for download. Current memory dumps include:

* Emotet
* LokiBot

Binaries

This will contain binaries (i.e. PE/.NET, Java, etc) from known malware families. Currently, this archi samples from:

* Agenttesla
* A / Warzone RAT
* Azorult
* Blue Botnet
* Buer Loader
* Dridex
* Emotet
* Gandcrab
* Lokibot
* Nanocore
* Remcos
* Socelars
* Trickbot
* Troldesh
* Turkojan
* Vidar

Warnings and Disclaimers

This repository is intended for educational and research purposes. The samples provided here are all real-world malware, please handle with all of the necessary caution.

Please note, all samples/artifacts will be in a password-protected archi a password of: *infected*

项目信息

开发语言：HTML

Star 数：1684

技术要点

该项目属于病毒分析方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Malware samples, analysis exercises and other interesting resources.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。