-Welcome to Malware-DB's page
+About --About
- -Malware DB is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way.
+theZoo (or Malware DB) is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way.
![]()
-Disclaimer
++Disclaimer
Malware DB's purpose is to allow the study of malware and enable people who are interested in malware analysis or maybe even as a part of their job to have access to live malware, analyse the ways they operate and maybe even enable advanced and savvy people to block specific malwares within their own environment.
@@ -50,8 +55,8 @@We recommend running them in a VM which has no internet connection (or an internal virtual network if you must) and without guest additions or any equivalents. Some of them are worms and will automatically try to spread out. Running them unconstrained meaning the you will infect yourself or others with vicious and dangerous malwares!!!
--GPL 3
++GPL 3
Malware DB - the most awesome free malware database on the air Copyright (C) 2014, Yuval Nativ, Lahad Ludar, 5fingers
@@ -69,25 +74,42 @@ GNU General Public License for more details.You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.
--Documentation and Notes
++Documentation and Notes
--Background:
++Background:
The idea behind Malware DB it to allow it to be modular and let you enter more malwares of your own. Each malware should have a directory of it's own.
++Root Files:
+ +Since version 0.42 theZoo have been going dramatic changes. It now runs in both CLI and ARGVS mode. You can all the program with the same command line agreements as before. +The current default state of theZoo at runtime is the CLI which is inspired by MSF. The following files and directories are responsible for the application's behaviour.
+-Root Files:
+/conf -The main files you see on the root folder are:
+The conf folder hold files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf, the current database version, the CSV indexed file and more.
--
-
- index.csv - The main index of the malwares you have access to and can be searched in your local folders. -
- malware-db.py - The main indexing file. Use it to search for malware in the index.csv file on the same folder. -
- Rebuild_CSV.sh - Rebuilds index.csv based on the index.log files in all the recursive directories. -
-Directory Structure:
++/imports
+ +Contains .py and .pyc import files used by the rest of the application
+ ++/malwares
+ +The actual malwares - be careful!
+ ++/mdbv0.2
+ +Since mdbv0.2 is stable for the command line arguments (where as of 0.42 we are not yet completely sure) and since the size is relativly small we have left out the beta version for those who are interested in it or got used to it. In next version we will confirm arguments as should be.
+ ++Directory Structure:
Each directory is composed of 5 files:
@@ -97,8 +119,8 @@ along with this program. If not, see htt-Structure of index.csv
++Structure of index.csv
The main index.csv is the DB which you will look in to find malwares indexed on your drive. We use the , charachter as the delimiter to our CSVs. The structure is al follows:
@@ -107,53 +129,58 @@ The structure is al follows:-
-
- UID - Determined base on the indexing process. Does not really have any purpose yet. -
- Location The location on the drive of the malware you have searched for. This and the UID field are automatically built on run by Rebuild_CSV.sh. +
- UID - Determined base on the indexing process. +
- Location The location on the drive of the malware you have searched for.
- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomeware, 1Spyware
- Name - Just the name of the malware.
- Version - Nothing to say here as well.
- Author - ... I'm not that into documentation... -
- Language - VB/C/ASM/C++/Java or binaries (bin) -
- Date - See 'Author' section. -
-Structure of index.log:
+An example line will look as follow:
-index.log is about the only file which we cannot built automatically and you will need to write it down for your self. -The structure is to be:
- -type,name,version,author,language,date,
+4,Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004,botnet,rBot,0.3.3,unknown,cpp,00/05/2004,x86,win32
-Don't worry about the UID and Location section which are not there, they will be built by Rebuild_CSV.sh while it collects data on the malwares.
-
-
-Bugs and Reports
+
+Bugs and Reports
The repository holding all files is currently
https://github.com/ytisf/theZoo
-Stuff which are in the making:
+
+Change Log for v0.42:
-- [X] Fix EULA for proper disclaimer.
-- [ ] More precise searching and indexing including platform and more.
-- [ ] We have about 400 more malwares to map and add
-- [ ] Git update of platform and new malware.
-- [ ] Fix display of search.
-- [ ] Enable support for platform and architecture in indexing.
-
If you have any suggestions or malware that you have indexed as in the documentations please send it to us to yuvaln210 [at] your most popular mail server so we can add it for every one's enjoyment.
-