A curated, high-quality malware corpus. Zoo keepers: @push_pnx and @steffenenders_
Germany
Joined January 2017
- Tweets232
- Following2
- Followers5.6K
- Likes34
Pinned Tweet
To simplify access to and synchronization of Malpedia's automatically generated, code-based YARA rules, we have created the following repository on Github: github.com/malpedia/signator…
Malpedia retweeted
I have just published a new data set revision of MalpediaFLOSSed, now aggregating 5.6m unique strings gathered from 2.100 malware families. github.com/malpedia/malpedia…
Malpedia retweeted
You can now check your strings in #malcat against an online library of #Malpedia FLOSSed strings. Just copy this plugin, courtesy of @push_pnx :
github.com/malpedia/malpedia…
Malpedia retweeted
I wrote a blog post about MalpediaFLOSSed, a collection of ~4 million strings extracted from 1800+ malware families and upgrading its GUI plugin to work with IDA, Ghidra, and Binary Ninja at once!
Kudos to @hyun____22 for Hyara, which pioneered such cross-tool compatibility!
🛠️ We added a basic WebUI to our malware strings lookup service. Give it a try at strings.malpedia.io
ALT Screenshot of the WebUI for strings.malpedia.io
📣We updated "Malpedia FLOSSed".
TL;DR: More data, cleaner Rust/Go/Dotnet strings, various tags!
We also created a public web service to make this data more accessible: strings.malpedia.io, as well as an IDA plugin as a demo use case.
Read more -> github.com/malpedia/malpedia…
Malpedia retweeted
Based on this, I updated the @TrellixARC Ghidra script to locally use this JSON file. Additionally, I wrote a script to query the Malpedia web service via the exposed API, which one can also host locally. The Ghidra scripts can be found here: github.com/advanced-threat-r…
📣We updated "Malpedia FLOSSed".
TL;DR: More data, cleaner Rust/Go/Dotnet strings, various tags!
We also created a public web service to make this data more accessible: strings.malpedia.io, as well as an IDA plugin as a demo use case.
Read more -> github.com/malpedia/malpedia…
📣We updated "Malpedia FLOSSed".
TL;DR: More data, cleaner Rust/Go/Dotnet strings, various tags!
We also created a public web service to make this data more accessible: strings.malpedia.io, as well as an IDA plugin as a demo use case.
Read more -> github.com/malpedia/malpedia…
Malpedia retweeted
I feel like this dump doesn't get enough credit.
So I filtered all malware debug ascii/utf16 strings from it and included it in a YAR rule file.
That's just one use-case for this awesome dump.
There are lots of other interesting malware indicators in it that could be used in a different way.
@malpedia @push_pnx #100DaysofYARA #malpedia
🛠️ We just published "Malpedia flossed": @Mandiant FLARE team's floss tool applied to all unpacked + dumped samples in @malpedia. Results: 35.645.324 raw strings, distilled to 2.137.276 unique strings from 1751 processed malware families - 400 MB JSON.
-> github.com/malpedia/malpedia…
Malpedia retweeted
#BinaryNinja plugin that helps write #YARA rule strings based on a selection in the Disassembly view.
Inspired by formatting used in #Yara_Signator @malpedia (highlighted in screenshot).
gist.github.com/utkonos/0aa6…
@push_pnx @vector35 @psifertex
#100DaysofYARA
🛠️ We just published "Malpedia flossed": @Mandiant FLARE team's floss tool applied to all unpacked + dumped samples in @malpedia. Results: 35.645.324 raw strings, distilled to 2.137.276 unique strings from 1751 processed malware families - 400 MB JSON.
-> github.com/malpedia/malpedia…
Malpedia retweeted
Introducing YARA-Forge ⚡️
- Streamlined Public YARA Rule Collection
Excited to share my latest project with the community just in time for Christmas! After weeks of hard work, it's finally ready 🎄🎁
Blog Post
cyb3rops.medium.com/introduc…
Project Page
yarahq.github.io/
We just deployed several updates to Malpedia.
1) There is now an RSS feed available.
2) @MsftSecIntel threat actor names have been integrated as aliases.
3) Family pages have links to @virustotal collections.
4) Library entries indicate if the article language is not English.