malware-analysis/theZoo
1
0
Fork 0
mirror of https://github.com/ytisf/theZoo.git synced 2026-02-21 11:18:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
j
2019-03-17 11:47:47 +07:00
parent f7ab90c7c6
commit 9206eabefb
1 changed files with 19 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

56
README.md
View File

@@ -1,11 +1,13 @@
About
======
# About
theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis, we have decided to gather all of them for you in an accessible and safe way.
theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.
**theZoo is open and welcoming visitors!**
Disclaimer
==========
If you are about to interact with our community please make sure to read our `CODE-OF-CONDUCT.md` prior to doing so. If you plan to contribute, first - thank you. However, do make sure to follow the standards on `CONTRIBUTING.md`.
# Disclaimer
theZoo's purpose is to allow the study of malware and enable people who are interested in malware analysis (or maybe even as a part of their job) to have access to live malware, analyse the ways they operate, and maybe even enable advanced and savvy people to block specific malware within their own environment.
**Please remember that these are live and dangerous malware! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!**
@@ -13,8 +15,7 @@ theZoo's purpose is to allow the study of malware and enable people who are inte
We recommend running them in a VM which has no internet connection (or an internal virtual network if you must) and without guest additions or any equivalents. Some of them are worms and will automatically try to spread out. Running them unconstrained means that you **will infect yourself or others with vicious and dangerous malware!!!**
GPL 3
======
# GPL 3
theZoo - the most awesome free malware database on the air
Copyright (C) 2015, Yuval Nativ, Lahad Ludar, 5fingers
@@ -32,8 +33,7 @@ You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
Documentation and Notes
========================
#Documentation and Notes
## Background:
theZoo's objective is to offer a fast and easy way of retrieving malware samples and source code in an organized fashion in hopes of promoting malware research.
@@ -45,11 +45,13 @@ The current default state of theZoo runtime is the CLI. The following files and
### /conf
The conf folder holds files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf and more.
### /imports
Contains .py and .pyc import files used by the rest of the application
Contains .py import files used by the rest of the application
### /malwares/Binaries
The actual malwares samples - be careful!
The actual malwares samples - be careful! These are very live.
### /malware/Source
Malware source code :)
Malware source code :)
Malware under the folder `Original` is supposed to be (NO PROMISES!) the original source of the malware that leaked. Malware under the folder `Reversed` is either reversed, decompiled or partially reconstructed.
## Directory Structure:
@@ -60,32 +62,8 @@ Each directory is composed of 4 files:
- Password file for the archive.
# Bugs and Reports
## Structure of maldb.db
maldb.db is the DB which theZoo is acting upon to find malware indexed on your drive.
The structure is as follows:
uid,location,type,name,version,author,language,date,architecture,platform,comments,tags
- UID - Determined based on the indexing process.
- Location - The location on the drive of the malware you have searched for.
- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomware, Spyware
- Name - Just the name of the malware.
- Version - Nothing to say here as well.
- Author - ... I'm not that into documentation...
- Programming Language - The state of the malware in regard to source, bin, or which type of source. c/cpp/bin...
- Date - See 'Author' section.
- Architecture - The arch the platform was build for. Can be x86, x64, arm7....
- Platform - Win32, Win64, *nix32, *nix64, iOS, android and so on.
- Comments - Any comments there may be about the item.
- Tags - Tags matching the item.
An example line will look as follow:
104,Source/Original/Dexter,trojan,Dexter,2,unknown,c,00/05/2013,x86,win32,NULL,Source
Bugs and Reports
================
The repository holding all files is currently
https://github.com/ytisf/theZoo
@@ -130,4 +108,8 @@ Get the file you want to submit and just run `python prep_file.py file_tosubmit.
- [X] Better UI features.
- [ ] Fix and make 'light' version without malwares with _MalwareFetch function.
If you have any suggestions or malware that you have indexed (in the manner laid out in the documentation) please send it to us to - yuval[]morirt [dot]com - so we can add it for everyones enjoyment.
## Hopeful
- [ ] A GUI interface.
- [ ] Package releases.
If you have any suggestions or malware that you have indexed (in the manner laid out in the documentation) please send it to us to - thezoo-submissions [a-t] morirt [.d0t.] com - so we can add it for everyone's enjoyment.