Published on 17th March 2020, 12:29:31 UTC
Almost two years ago, I've launched URLhaus with the goal of collecting malware distribution sites. With more than 300,000 malware distribution sites tracked, the project still is a great success. However, over the past weeks, I've been focusing my efforts on a new project. And here' it is: MalwareBazaar!
MalwareBazaar collects known malicious malware sample, enriches them with additional intelligence and provides them back to the community - for free! Here are just some of the features of MalwareBazaar:
As many IT-security researchers, I'm heavily using public available information (OSINT) for hunting down new cyber threats. OSINT is a great resource for this threat intelligence! However, I often get confronted with a simple but severe problem: malware samples referenced in blog posts, whitepaper or mentioned on social media like Twitter are usually not easily available. You need to register on gazillion different online anti-virus scanning engines, sandboxes or malware databases in order to finally obtain the malware sample you need for your analysis. And it is getting worse: Some of these platforms come with download restrictions (you can only download a specific number of malware samples per day), some other platforms are available for paying users only. This is a huge pain for me in my daily work, and I'm sure for many other IT-security researchers out there too.
I've therefore asked myself: why do I have to register on 35457 different platforms? And why should I pay for downloading malware samples?
This was the motivation for launching MalwareBazaar: A malware corpus where IT-security researchers can easily share malware samples with the community without hitting download restrictions all the time or having to pay expensive subscription fees.
VirusTotal is a great resource for threat intel and hunting malware. Unlike MalwareBazaar, VirusTotal is also a multi anti-virus scanner that allows you to asses whether a certain file is malicious or benign. However, VirusTotal has a handful limitation:
MalwareBazaar follows a different approach: