{"slug": "malware", "title": "Malware", "description": "All the malware you could wish for, ready to reverse engineer.", "notices": [{"type": "danger", "text": "Infosec House is not held responsible for any damages when proceeding to the below resources. Live malware/ransomeware below proceed with caution. Remember, engaging in illegal activities is frowned upon, and compliance with local state laws is your sole responsibility."}], "sections": [{"title": "", "groups": [{"title": "Distribution Centers", "tools": [{"name": "Any.Run", "url": "https://app.any.run/submissions/", "description": "Interactive online malware analysis service for dynamic and static research of most types of threats using any environments.", "_anchor": "any-run", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/any-run/"}, {"name": "Contagio Malware Dump", "url": "https://contagiodump.blogspot.com/", "description": "Password Required. A collection of the latest malware samples, threats, observations, and analyses.", "_anchor": "contagio-malware-dump", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/contagio-malware-dump/"}, {"name": "Cape Sandbox", "url": "https://capesandbox.com/", "description": "A malware sandbox derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware.", "_anchor": "cape-sandbox", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/cape-sandbox/"}, {"name": "Hatching Triage", "url": "https://tria.ge/", "description": "A malware sandboxing solution. It leverages a unique architecture, developed with scaling in mind from the start!.", "_anchor": "hatching-triage", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/hatching-triage/"}, {"name": "Hybrid Analysis", "url": "https://www.hybrid-analysis.com/", "description": "A free malware analysis service for the community. Using this service you can submit files for in-depth static and dynamic analysis.", "also": ["Scanners"], "_anchor": "hybrid-analysis", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers", "scanners"], "_tab_titles": ["Distribution Centers", "Scanners"], "_page": "/tools/hybrid-analysis/"}, {"name": "InQuest", "url": "https://github.com/InQuest/malware-samples", "description": "A free malware analysis service for the community. Using this service you can submit files for in-depth static and dynamic analysis.", "repo": "InQuest/malware-samples", "_anchor": "inquest", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/inquest/"}, {"name": "Malshare", "url": "https://www.malshare.com/", "description": "A free Malware repository providing researchers access to samples, malicious feeds, and Yara results.", "_anchor": "malshare", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/malshare/"}, {"name": "Malware Bazaar", "url": "https://bazaar.abuse.ch/browse/", "description": "Project operated by abuse.ch. A project to collect and share malware samples.", "_anchor": "malware-bazaar", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/malware-bazaar/"}, {"name": "Malware Samples", "url": "https://github.com/MalwareSamples/Malware-Feed/", "description": "An ongoing and updated archive of files collected which are associated with specific public malicious threat reports.", "repo": "MalwareSamples/Malware-Feed", "_anchor": "malware-samples", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/malware-samples/"}, {"name": "Malware-DB (theZoo)", "url": "https://github.com/ytisf/theZoo", "description": "theZoo is a project created to make the possibility of malware analysis open and available to the public.", "repo": "ytisf/theZoo", "_anchor": "malware-db-thezoo", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/malware-db-thezoo/"}, {"name": "Objective-See", "url": "https://objective-see.com/malware.html", "description": "Mac malware samples collected by the Objective-See team.", "_anchor": "objective-see", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/objective-see-malware/"}, {"name": "PhishingKitTracker", "url": "https://github.com/marcoramilli/PhishingKitTracker", "description": "An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats.", "repo": "marcoramilli/PhishingKitTracker", "_anchor": "phishingkittracker", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/phishingkittracker/"}, {"name": "Polyswarm", "url": "https://polyswarm.network/", "description": "Threat Intelligence Marketplace.", "_anchor": "polyswarm", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/polyswarm/"}, {"name": "SoReL-20M", "url": "https://github.com/sophos-ai/SOREL-20M", "description": "Sophos-ReversingLabs 20 Million dataset. HUGE dataset.", "repo": "sophos-ai/SOREL-20M", "_anchor": "sorel-20m", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/sorel-20m/"}, {"name": "URLhaus", "url": "https://urlhaus.abuse.ch/browse/", "description": "Project operated by abuse.ch. A project to collect and share malware samples.", "_anchor": "urlhaus", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/urlhaus/"}, {"name": "VirusShare", "url": "https://virusshare.com/", "description": "Because Sharing is Caring.", "_anchor": "virusshare", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/virusshare/"}, {"name": "VirusSign", "url": "https://virussign.com/", "description": "A huge collection of high quality malware samples.", "_anchor": "virussign", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/virussign/"}, {"name": "Virus Samples", "url": "https://www.virussamples.com/", "description": "Over 150,000+ malicious files, viruses, malware, trojans, executables, scripts, and other forms of malware payloads across a variety of file types and architectures.", "_anchor": "virus-samples", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/virus-samples/"}, {"name": "VX-Underground", "url": "https://github.com/vxunderground/MalwareSourceCode", "description": "Over 150,000+ malicious files, viruses, malware, trojans, executables, scripts, and other forms of malware payloads across a variety of file types and architectures.", "repo": "vxunderground/MalwareSourceCode", "_anchor": "vx-underground", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/vx-underground/"}, {"name": "Yori", "url": "https://yomi.yoroi.company/upload", "description": "Free sandbox-based file analysis service.", "_anchor": "yori", "_section": "", "_group": "Distribution Centers", "_tabs": ["distribution-centers"], "_tab_titles": ["Distribution Centers"], "_page": "/tools/yori/"}]}, {"title": "Emulation", "tools": [{"name": "Al-Khaser", "url": "https://github.com/LordNoteworthy/al-khaser", "description": "Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.", "repo": "LordNoteworthy/al-khaser", "_anchor": "al-khaser", "_section": "", "_group": "Emulation", "_tabs": ["emulation"], "_tab_titles": ["Emulation"], "_page": "/tools/al-khaser/"}]}, {"title": "Ransomware Decryption", "tools": [{"name": "NoMoreRansom", "url": "https://www.nomoreransom.org/", "description": "Ransomware decryption tool.", "_anchor": "nomoreransom", "_section": "", "_group": "Ransomware Decryption", "_tabs": ["ransomware-decryption"], "_tab_titles": ["Ransomware Decryption"], "_page": "/tools/nomoreransom/"}]}, {"title": "Ransomware/Malware/Worms/etc.", "tools": [{"name": "Coldfire", "url": "https://github.com/redcode-labs/Coldfire", "description": "Golang malware development library.", "repo": "redcode-labs/Coldfire", "_anchor": "coldfire", "_section": "", "_group": "Ransomware/Malware/Worms/etc.", "_tabs": ["ransomware-malware-worms-etc"], "_tab_titles": ["Ransomware/Malware/Worms/etc."], "_page": "/tools/coldfire/"}, {"name": "GonnaCry", "url": "https://github.com/tarcisio-marinho/GonnaCry", "description": "A linux ransomware that encrypts all the user files with a strong encryption scheme.", "repo": "tarcisio-marinho/GonnaCry", "_anchor": "gonnacry", "_section": "", "_group": "Ransomware/Malware/Worms/etc.", "_tabs": ["ransomware-malware-worms-etc"], "_tab_titles": ["Ransomware/Malware/Worms/etc."], "_page": "/tools/gonnacry/"}, {"name": "Neurax", "url": "https://github.com/redcode-labs/Neurax", "description": "A framework for constructing self-spreading binaries.", "repo": "redcode-labs/Neurax", "_anchor": "neurax", "_section": "", "_group": "Ransomware/Malware/Worms/etc.", "_tabs": ["ransomware-malware-worms-etc"], "_tab_titles": ["Ransomware/Malware/Worms/etc."], "_page": "/tools/neurax/"}]}, {"title": "Scanners", "tools": [{"name": "FileScan", "url": "https://www.filescan.io/", "description": "Next-Gen Sandbox and free malware analysis service. Operating at 10x speed compared to traditional sandboxes with 90% less resource usage, its unique adaptive threat analysis technology also enables zero-day malware detection and more Indicator of Compromise (IOCs) extraction.", "_anchor": "filescan", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/filescan/"}, {"name": "ID Ransomware", "url": "https://id-ransomware.malwarehunterteam.com/index.php", "description": "Upload a ransom note and/or sample encrypted file to identify the ransomware that has encrypted your data.", "_anchor": "id-ransomware", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/id-ransomware/"}, {"name": "Jotti", "url": "https://virusscan.jotti.org/", "description": "Free service that lets you scan suspicious files with several anti-virus programs.", "_anchor": "jotti", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/jotti/"}, {"name": "Kaspersky Threat Portal", "url": "https://opentip.kaspersky.com/", "description": "Сheck any suspicious threat indicator, whether it is a file, file hash, IP address or web address.", "_anchor": "kaspersky-threat-portal", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/kaspersky-threat-portal/"}, {"name": "Malcore", "url": "https://malcore.io", "description": "An advanced sandbox solution that is designed with speed and scalability in mind. Most leading sandbox solutions can take multiple minutes to perform analysis on a single file, Malcore solves this problem by taking seconds where it takes minutes.", "_anchor": "malcore", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/malcore/"}, {"name": "Opswat", "url": "https://metadefender.opswat.com/", "description": "Simply submit suspicious files to MetaDefender Cloud for analysis.", "_anchor": "opswat", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/opswat/"}, {"name": "VirusTotal", "url": "https://www.virustotal.com/gui/", "description": "Analyze suspicious files and URLs to detect types of malware, automatically share them with the security community.", "_anchor": "virustotal", "_section": "", "_group": "Scanners", "_tabs": ["scanners"], "_tab_titles": ["Scanners"], "_page": "/tools/virustotal/"}]}]}], "tools": [{"name": "Al-Khaser", "url": "https://github.com/LordNoteworthy/al-khaser", "description": "Public malware techniques used in the wild: Virtual Machine, Emulation, Debuggers, Sandbox detection.", "category": "malware", "section": "", "group": "Emulation", "repo": "LordNoteworthy/al-khaser", "links": [], "tags": [], "path": "/tools/al-khaser/", "listing": "/malware/#al-khaser"}, {"name": "Any.Run", "url": "https://app.any.run/submissions/", "description": "Interactive online malware analysis service for dynamic and static research of most types of threats using any environments.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/any-run/", "listing": "/malware/#any-run"}, {"name": "Cape Sandbox", "url": "https://capesandbox.com/", "description": "A malware sandbox derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/cape-sandbox/", "listing": "/malware/#cape-sandbox"}, {"name": "Coldfire", "url": "https://github.com/redcode-labs/Coldfire", "description": "Golang malware development library.", "category": "malware", "section": "", "group": "Ransomware/Malware/Worms/etc.", "repo": "redcode-labs/Coldfire", "links": [], "tags": [], "path": "/tools/coldfire/", "listing": "/malware/#coldfire"}, {"name": "Contagio Malware Dump", "url": "https://contagiodump.blogspot.com/", "description": "Password Required. A collection of the latest malware samples, threats, observations, and analyses.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/contagio-malware-dump/", "listing": "/malware/#contagio-malware-dump"}, {"name": "FileScan", "url": "https://www.filescan.io/", "description": "Next-Gen Sandbox and free malware analysis service. Operating at 10x speed compared to traditional sandboxes with 90% less resource usage, its unique adaptive threat analysis technology also enables zero-day malware detection and more Indicator of Compromise (IOCs) extraction.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/filescan/", "listing": "/malware/#filescan"}, {"name": "GonnaCry", "url": "https://github.com/tarcisio-marinho/GonnaCry", "description": "A linux ransomware that encrypts all the user files with a strong encryption scheme.", "category": "malware", "section": "", "group": "Ransomware/Malware/Worms/etc.", "repo": "tarcisio-marinho/GonnaCry", "links": [], "tags": [], "path": "/tools/gonnacry/", "listing": "/malware/#gonnacry"}, {"name": "Hatching Triage", "url": "https://tria.ge/", "description": "A malware sandboxing solution. It leverages a unique architecture, developed with scaling in mind from the start!.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/hatching-triage/", "listing": "/malware/#hatching-triage"}, {"name": "Hybrid Analysis", "url": "https://www.hybrid-analysis.com/", "description": "A free malware analysis service for the community. Using this service you can submit files for in-depth static and dynamic analysis.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/hybrid-analysis/", "listing": "/malware/#hybrid-analysis"}, {"name": "ID Ransomware", "url": "https://id-ransomware.malwarehunterteam.com/index.php", "description": "Upload a ransom note and/or sample encrypted file to identify the ransomware that has encrypted your data.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/id-ransomware/", "listing": "/malware/#id-ransomware"}, {"name": "InQuest", "url": "https://github.com/InQuest/malware-samples", "description": "A free malware analysis service for the community. Using this service you can submit files for in-depth static and dynamic analysis.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "InQuest/malware-samples", "links": [], "tags": [], "path": "/tools/inquest/", "listing": "/malware/#inquest"}, {"name": "Jotti", "url": "https://virusscan.jotti.org/", "description": "Free service that lets you scan suspicious files with several anti-virus programs.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/jotti/", "listing": "/malware/#jotti"}, {"name": "Kaspersky Threat Portal", "url": "https://opentip.kaspersky.com/", "description": "Сheck any suspicious threat indicator, whether it is a file, file hash, IP address or web address.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/kaspersky-threat-portal/", "listing": "/malware/#kaspersky-threat-portal"}, {"name": "Malcore", "url": "https://malcore.io", "description": "An advanced sandbox solution that is designed with speed and scalability in mind. Most leading sandbox solutions can take multiple minutes to perform analysis on a single file, Malcore solves this problem by taking seconds where it takes minutes.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/malcore/", "listing": "/malware/#malcore"}, {"name": "Malshare", "url": "https://www.malshare.com/", "description": "A free Malware repository providing researchers access to samples, malicious feeds, and Yara results.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/malshare/", "listing": "/malware/#malshare"}, {"name": "Malware Bazaar", "url": "https://bazaar.abuse.ch/browse/", "description": "Project operated by abuse.ch. A project to collect and share malware samples.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/malware-bazaar/", "listing": "/malware/#malware-bazaar"}, {"name": "Malware Samples", "url": "https://github.com/MalwareSamples/Malware-Feed/", "description": "An ongoing and updated archive of files collected which are associated with specific public malicious threat reports.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "MalwareSamples/Malware-Feed", "links": [], "tags": [], "path": "/tools/malware-samples/", "listing": "/malware/#malware-samples"}, {"name": "Malware-DB (theZoo)", "url": "https://github.com/ytisf/theZoo", "description": "theZoo is a project created to make the possibility of malware analysis open and available to the public.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "ytisf/theZoo", "links": [], "tags": [], "path": "/tools/malware-db-thezoo/", "listing": "/malware/#malware-db-thezoo"}, {"name": "Neurax", "url": "https://github.com/redcode-labs/Neurax", "description": "A framework for constructing self-spreading binaries.", "category": "malware", "section": "", "group": "Ransomware/Malware/Worms/etc.", "repo": "redcode-labs/Neurax", "links": [], "tags": [], "path": "/tools/neurax/", "listing": "/malware/#neurax"}, {"name": "NoMoreRansom", "url": "https://www.nomoreransom.org/", "description": "Ransomware decryption tool.", "category": "malware", "section": "", "group": "Ransomware Decryption", "repo": null, "links": [], "tags": [], "path": "/tools/nomoreransom/", "listing": "/malware/#nomoreransom"}, {"name": "Objective-See", "url": "https://objective-see.com/malware.html", "description": "Mac malware samples collected by the Objective-See team.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/objective-see-malware/", "listing": "/malware/#objective-see"}, {"name": "Opswat", "url": "https://metadefender.opswat.com/", "description": "Simply submit suspicious files to MetaDefender Cloud for analysis.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/opswat/", "listing": "/malware/#opswat"}, {"name": "PhishingKitTracker", "url": "https://github.com/marcoramilli/PhishingKitTracker", "description": "An extensible and freshly updated collection of phishingkits for forensics and future analysis topped with simple stats.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "marcoramilli/PhishingKitTracker", "links": [], "tags": [], "path": "/tools/phishingkittracker/", "listing": "/malware/#phishingkittracker"}, {"name": "Polyswarm", "url": "https://polyswarm.network/", "description": "Threat Intelligence Marketplace.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/polyswarm/", "listing": "/malware/#polyswarm"}, {"name": "SoReL-20M", "url": "https://github.com/sophos-ai/SOREL-20M", "description": "Sophos-ReversingLabs 20 Million dataset. HUGE dataset.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "sophos-ai/SOREL-20M", "links": [], "tags": [], "path": "/tools/sorel-20m/", "listing": "/malware/#sorel-20m"}, {"name": "URLhaus", "url": "https://urlhaus.abuse.ch/browse/", "description": "Project operated by abuse.ch. A project to collect and share malware samples.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/urlhaus/", "listing": "/malware/#urlhaus"}, {"name": "Virus Samples", "url": "https://www.virussamples.com/", "description": "Over 150,000+ malicious files, viruses, malware, trojans, executables, scripts, and other forms of malware payloads across a variety of file types and architectures.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/virus-samples/", "listing": "/malware/#virus-samples"}, {"name": "VirusShare", "url": "https://virusshare.com/", "description": "Because Sharing is Caring.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/virusshare/", "listing": "/malware/#virusshare"}, {"name": "VirusSign", "url": "https://virussign.com/", "description": "A huge collection of high quality malware samples.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/virussign/", "listing": "/malware/#virussign"}, {"name": "VirusTotal", "url": "https://www.virustotal.com/gui/", "description": "Analyze suspicious files and URLs to detect types of malware, automatically share them with the security community.", "category": "malware", "section": "", "group": "Scanners", "repo": null, "links": [], "tags": [], "path": "/tools/virustotal/", "listing": "/malware/#virustotal"}, {"name": "VX-Underground", "url": "https://github.com/vxunderground/MalwareSourceCode", "description": "Over 150,000+ malicious files, viruses, malware, trojans, executables, scripts, and other forms of malware payloads across a variety of file types and architectures.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": "vxunderground/MalwareSourceCode", "links": [], "tags": [], "path": "/tools/vx-underground/", "listing": "/malware/#vx-underground"}, {"name": "Yori", "url": "https://yomi.yoroi.company/upload", "description": "Free sandbox-based file analysis service.", "category": "malware", "section": "", "group": "Distribution Centers", "repo": null, "links": [], "tags": [], "path": "/tools/yori/", "listing": "/malware/#yori"}]}