theZoo aka Malware DB
-A repository of LIVE malwares for your own joy and pleasure
+theZoo aka Malware DB
+A repository of LIVE malwares for your own joy and pleasure
+ +View the Project on GitHub ytisf/theZoo
+-
-
- Download ZIP -
- Download TAR -
- View On GitHub +
- Download ZIP File +
- Download TAR Ball +
- View On GitHub
This project is maintained by ytisf
- --About
+About -Malware DB is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way. +
theZoo is a project created to make the possibility of malware analysis open and available to the public. Since we have found out that almost all versions of malware are very hard to come by in a way which will allow analysis we have decided to gather all of them for you in an available and safe way.
+theZoo was born by Yuval tisf Nativ and is now maintained by Shahak Shalev.
theZoo is open and welcoming visitors!
+-Disclaimer
+Disclaimer -Malware DB's purpose is to allow the study of malware and enable people who are interested in malware analysis or maybe even as a part of their job to have access to live malware, analyse the ways they operate and maybe even enable advanced and savvy people to block specific malwares within their own environment.
+theZoo's purpose is to allow the study of malware and enable people who are interested in malware analysis or maybe even as a part of their job to have access to live malware, analyse the ways they operate and maybe even enable advanced and savvy people to block specific malwares within their own environment.
-Please remember that there are live and dangerous malwares! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!
+Please remember that these are live and dangerous malware! They come encrypted and locked for a reason! Do NOT run them unless you are absolutely sure of what you are doing! They are to be used only for educational purposes (and we mean that!) !!!
We recommend running them in a VM which has no internet connection (or an internal virtual network if you must) and without guest additions or any equivalents. Some of them are worms and will automatically try to spread out. Running them unconstrained meaning the you will infect yourself or others with vicious and dangerous malwares!!!
-GPL 3
+GPL 3 -Malware DB - the most awesome free malware database on the air -Copyright (C) 2014, Yuval Nativ, Lahad Ludar, 5fingers
+theZoo - the most awesome free malware database on the air +Copyright (C) 2015, Yuval Nativ, Lahad Ludar, 5fingers
This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -74,63 +66,64 @@ GNU General Public License for more details.
along with this program. If not, see http://www.gnu.org/licenses/.-Documentation and Notes
+Documentation and Notes-Background:
+Background: -The idea behind Malware DB it to allow it to be modular and let you enter more malwares of your own. Each malware should have a directory of it's own.
+theZoo's objective is to offer a fast and easy way of retrieving malware samples and source code in an organized fashion in hopes of promoting malware research.
-Root Files:
+Root Files: -Since version 0.42 theZoo have been going dramatic changes. It now runs in both CLI and ARGVS mode. You can all the program with the same command line agreements as before. -The current default state of theZoo at runtime is the CLI which is inspired by MSF. The following files and directories are responsible for the application's behaviour.
+Since version 0.42 theZoo have been going dramatic changes. It now runs both CLI and ARGVS modes. You can call the program with the same command line arguments as before. +The current default state of theZoo runtime is the CLI. The following files and directories are responsible for the application's behaviour.
-/conf
+/conf -The conf folder hold files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf, the current database version, the CSV indexed file and more.
+The conf folder holds files relevant to the particular running of the program but are not part of the application. You can find the EULA file in the conf and more.
-/imports
+/importsContains .py and .pyc import files used by the rest of the application
-/malwares
+/malwares/Binaries -The actual malwares - be careful!
+The actual malwares samples - be careful!
-/mdbv0.2
+/malware/Source -Since mdbv0.2 is stable for the command line arguments (where as of 0.42 we are not yet completely sure) and since the size is relativly small we have left out the beta version for those who are interested in it or got used to it. In next version we will confirm arguments as should be.
+Malware source code :)
-Directory Structure:
+Directory Structure: -Each directory is composed of 5 files:
+Each directory is composed of 4 files:
- Malware files in an encrypted ZIP archive.
- SHA256 sum of the 1st file.
- MD5 sum of the 1st file.
- Password file for the archive. -
- index.log file for the indexer. -
-Structure of index.csv
+ -The main index.csv is the DB which you will look in to find malwares indexed on your drive. We use the , charachter as the delimiter to our CSVs. -The structure is al follows:
++Structure of maldb.db
-uid,location,type,name,version,author,language,date
+maldb.db is the DB which theZoo is acting upon to find malwares indexed on your drive.
+The structure is as follows:
+
+uid,location,type,name,version,author,language,date,architecture,platform,comments,tags
-- UID - Determined base on the indexing process.
+- UID - Determined based on the indexing process.
- Location The location on the drive of the malware you have searched for.
-- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomeware, 1Spyware
+- Type - Sorts the different types of malware there are. So far we sort by: Virus, Trojans, Botnets, Ransomeware, Spyware
- Name - Just the name of the malware.
- Version - Nothing to say here as well.
- Author - ... I'm not that into documentation...
@@ -138,27 +131,43 @@ The structure is al follows:
- Date - See 'Author' section.
- Architecture - The arch the platform was build for. Can be x86, x64, arm7....
- Platform - Win32, Win64, *nix32, *nix64, iOS, android and so on.
-
An example line will look as follow:
+Comments - Any comments there may be about the item.
+Tags - Tags matching the item.
+
-4,Source/Original/rBot0.3.3_May2004/rBot0.3.3_May2004,botnet,rBot,0.3.3,unknown,cpp,00/05/2004,x86,win32
+An example line will look as follow:
+
+104,Source/Original/Dexter,trojan,Dexter,2,unknown,c,00/05/2013,x86,win32,NULL,Source
-Bugs and Reports
+Bugs and Reports
The repository holding all files is currently
https://github.com/ytisf/theZoo
-Change Log for v0.50:
+Change Log for v0.60:
+
+
+- [x] Moved DB to SQLite3.
+- [x] Searching overhaul to a freestyle fashion.
+- [x] Fixed "get" command.
+- [x] More & more malwares.
+
+
+
+Change Log for v0.50:
- [x] Better and easier UI.
- [x] Aligned printing of malwares.
- [x] Command line arguments are now working.
- [x] Added 10 more malwares (cool ones) to the DB.
-
-Change Log for v0.42:
+
+
+
+Change Log for v0.42:
- [x] Fix EULA for proper disclaimer.
@@ -169,27 +178,44 @@ The structure is al follows:
- [x] Enable support for platform and architecture in indexing.
- [x] Separate between database and application.
- [x] UI improvements.
-
-Change Log for v0.43:
+
+
+
+Change Log for v0.43:
- [X] Verify argv to be working properly. (fixes in v0.5)
- [X] Virus-Total upload and indexing module. - Not possible due to restrictions of VT.
- [X] Automatic reporting system for malwares which are not indexed in the framework.
-
-Predicted Change Log for v1.0
+
+
+
+Change Log for v0.50:
-- [ ] Fix auto-complete for malware frameworks.
+- [X] Malware analysis pack has been removed to reduce clone size.
+- [X] More documentation has been added.
+- [X] Removed debugging function which were dead in the code.
+
+
+
+Predicted Change Log for v1.0
+
+
+- [X] Fix auto-complete for malware frameworks. (thanks to 5fingers)
+- [X] Consider changing DB to XML or SQLite3. (Sheksa - done :))
+- [ ] Move malwares to another repo.
- [ ] Better UI features.
-- [ ] Consider changing DB to XML or SQLite3.
-
If you have any suggestions or malware that you have indexed as in the documentations please send it to us to yuval[]morirt [dot]com so we can add it for every one's enjoyment.
+
+
+If you have any suggestions or malware that you have indexed as in the documentations please send it to us to yuval[]morirt [dot]com so we can add it for every one's enjoyment.