diff --git a/README.md b/README.md index 25499bb..a8e9f8f 100644 --- a/README.md +++ b/README.md @@ -1,12 +1,12 @@ About ====== -theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. +theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. Disclaimer ========== theZoo's purpose is to allow the study of malware and enable people who are interested in malware analysis or maybe even as a part of their job to have access to live malware, analyse the ways they operate and maybe even enable advanced and savvy people to block specific malwares within their own environment. -**Please remember that there are live and dangerous malwares! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!** +**Please remember that these are live and dangerous malware! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!** We recommend running them in a VM which has no internet connection (or an internal virtual network if you must) and without guest additions or any equivalents. Some of them are worms and will automatically try to spread out. Running them unconstrained meaning the you **will infect yourself or others with vicious and dangerous malwares!!!** @@ -34,14 +34,14 @@ Documentation and Notes ======================== ## Background: -The idea behind theZoo it to allow it to be modular and let you enter more malwares of your own. Each malware should have a directory of it's own. +The idea behind theZoo is to allow it to be modular and let you add malware of your own. Each malware should have a directory of it's own. ## Root Files: -Since version 0.42 theZoo have been going dramatic changes. It now runs in both CLI and ARGVS mode. You can all the program with the same command line agreements as before. -The current default state of theZoo at runtime is the CLI which is inspired by MSF. The following files and directories are responsible for the application's behaviour. +Since version 0.42 theZoo have been going dramatic changes. It now runs in both CLI and ARGVS mode. You can call the program with the same command line arguments as before. +The current default state of theZoo runtime is the CLI which is inspired by MSF. The following files and directories are responsible for the application's behaviour. ### /conf -The conf folder hold files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf, the current database version, the CSV indexed file and more. +The conf folder holds files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf, the current database version, the CSV index file and more. ### /imports Contains .py and .pyc import files used by the rest of the application ### /malwares @@ -65,9 +65,9 @@ The structure is al follows: uid,location,type,name,version,author,language,date -- UID - Determined base on the indexing process. +- UID - Determined based on the indexing process. - Location The location on the drive of the malware you have searched for. -- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomeware, 1Spyware +- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomeware, Spyware - Name - Just the name of the malware. - Version - Nothing to say here as well. - Author - ... I'm not that into documentation... diff --git a/conf/index.csv b/conf/index.csv index 65df56f..07e60e2 100644 --- a/conf/index.csv +++ b/conf/index.csv @@ -57,6 +57,7 @@ 58,Binaries/Win32.Fareit,botnet,Fareit,Unknown,Unknown,bin,23/06/2014,x86,win32,0 59,Binaries/BlackEnergy2.1,rootkit,Black Energy,2.1,Unknown,bin,23/06/2014,x64,win64,1 60,Binaries/SpyEye,botnet,SpyEye,Unknown,Unknown,bin,23/06/2014,x86,win32,0 -61,Binaries/Powerliks,botnet,Powerliks,Unknown,Unknown,bin,09/08/2014,x86,win32,1 +61,Binaries/Poweliks,botnet,Poweliks,Unknown,Unknown,bin,09/08/2014,x86,win32,1 62,Binaries/ZeroLocker,ransomware,Zerolocker,A,Unknown,bin,09/08/2014,x86,win32,0 63,Sources/Original/TinyBanker_Jan2012,botnet,Tiny Banker,A,Russia,asm,00/01/2012,x86,win32,0 +64,Source/Original/XtremeRAT_March2009,botnet,XtremeRat,Unknown,Unknown,c,00/03/2009,x86,0 \ No newline at end of file diff --git a/imports/globals.py b/imports/globals.py index 34650e0..3eb79bb 100644 --- a/imports/globals.py +++ b/imports/globals.py @@ -29,8 +29,8 @@ class init: fulllicense += "This program comes with ABSOLUTELY NO WARRANTY; for details type '" + sys.argv[0] +" -w'.\n" fulllicense += "This is free software, and you are welcome to redistribute it." - useage = '\nUsage: ' + sys.argv[0] + ' -s search_query -t trojan -p vb\n\n' - useage += 'The search engine can search by regular search or using specified arguments:\n\nOPTIONS:\n -h --help\t\tShow this message\n -t --type\t\tMalware type, can be virus/trojan/botnet/spyware/ransomeware.\n -p --language\tProgramming language, can be c/cpp/vb/asm/bin/java.\n -u --update\t\tUpdate malware index. Rebuilds main CSV file. \n -s --search\t\tSearch query for name or anything. \n -v --version\tPrint the version information.\n -w\t\t\tPrint GNU license.\n' + usage = '\nUsage: ' + sys.argv[0] + ' -s search_query -t trojan -p vb\n\n' + usage += 'The search engine can search by regular search or using specified arguments:\n\nOPTIONS:\n -h --help\t\tShow this message\n -t --type\t\tMalware type, can be virus/trojan/botnet/spyware/ransomeware.\n -p --language\tProgramming language, can be c/cpp/vb/asm/bin/java.\n -u --update\t\tUpdate malware index. Rebuilds main CSV file. \n -s --search\t\tSearch query for name or anything. \n -v --version\tPrint the version information.\n -w\t\t\tPrint GNU license.\n' column_for_pl = 6 column_for_type = 2 @@ -67,8 +67,8 @@ class vars: fulllicense += "This program comes with ABSOLUTELY NO WARRANTY; for details type '" + sys.argv[0] +" -w'.\n" fulllicense += "This is free software, and you are welcome to redistribute it." - useage = '\nUsage: ' + sys.argv[0] + ' -s search_query -t trojan -p vb\n\n' - useage += 'The search engine can search by regular search or using specified arguments:\n\nOPTIONS:\n -h --help\t\tShow this message\n -t --type\t\tMalware type, can be virus/trojan/botnet/spyware/ransomeware.\n -p --language\tProgramming language, can be c/cpp/vb/asm/bin/java.\n -u --update\t\tUpdate malware index. Rebuilds main CSV file. \n -s --search\t\tSearch query for name or anything. \n -v --version\tPrint the version information.\n -w\t\t\tPrint GNU license.\n' + usage = '\nUsage: ' + sys.argv[0] + ' -s search_query -t trojan -p vb\n\n' + usage += 'The search engine can search by regular search or using specified arguments:\n\nOPTIONS:\n -h --help\t\tShow this message\n -t --type\t\tMalware type, can be virus/trojan/botnet/spyware/ransomeware.\n -p --language\tProgramming language, can be c/cpp/vb/asm/bin/java.\n -u --update\t\tUpdate malware index. Rebuilds main CSV file. \n -s --search\t\tSearch query for name or anything. \n -v --version\tPrint the version information.\n -w\t\t\tPrint GNU license.\n' column_for_pl = 6 column_for_type = 2 diff --git a/imports/muchmuchstrings.py b/imports/muchmuchstrings.py index b9f35e6..57755e1 100644 --- a/imports/muchmuchstrings.py +++ b/imports/muchmuchstrings.py @@ -34,7 +34,7 @@ class banners: print "Is licensed under:\t" + globals.vars.licensev print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~" print globals.vars.fulllicense - print globals.vars.useage + print globals.vars.usage def print_available_payloads(self, array): answer = str(array[globals.vars.column_for_uid]) + "\t" + str(array[globals.vars.column_for_name]) + "\t" + str(array[globals.vars.column_for_version]) + "\t\t" diff --git a/malwares/Binaries/Powerliks/Powerliks.md5 b/malwares/Binaries/Poweliks/Poweliks.md5 similarity index 100% rename from malwares/Binaries/Powerliks/Powerliks.md5 rename to malwares/Binaries/Poweliks/Poweliks.md5 diff --git a/malwares/Binaries/Powerliks/Powerliks.pass b/malwares/Binaries/Poweliks/Poweliks.pass similarity index 100% rename from malwares/Binaries/Powerliks/Powerliks.pass rename to malwares/Binaries/Poweliks/Poweliks.pass diff --git a/malwares/Binaries/Powerliks/Powerliks.rar b/malwares/Binaries/Poweliks/Poweliks.rar similarity index 100% rename from malwares/Binaries/Powerliks/Powerliks.rar rename to malwares/Binaries/Poweliks/Poweliks.rar diff --git a/malwares/Binaries/Powerliks/Powerliks.sha256 b/malwares/Binaries/Poweliks/Poweliks.sha256 similarity index 100% rename from malwares/Binaries/Powerliks/Powerliks.sha256 rename to malwares/Binaries/Poweliks/Poweliks.sha256 diff --git a/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.md5 b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.md5 new file mode 100644 index 0000000..65abaf7 --- /dev/null +++ b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.md5 @@ -0,0 +1 @@ +aae1c3a61466412850b682a2038edc9e XtremeRat.zip diff --git a/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.pass b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.pass new file mode 100644 index 0000000..cba4e8b --- /dev/null +++ b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.pass @@ -0,0 +1 @@ +infected diff --git a/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.sha256 b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.sha256 new file mode 100644 index 0000000..eed8963 --- /dev/null +++ b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.sha256 @@ -0,0 +1 @@ +1892a065fd4b4d5d60799fd3e10178de2452fc23014d0388c65f30aa7e103c8d XtremeRat.zip diff --git a/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.zip b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.zip new file mode 100644 index 0000000..084e378 Binary files /dev/null and b/malwares/Source/Original/XtremeRAT_March2009/XtremeRat.zip differ