Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.

Is there any database of malware, where I could actually download the code and analyze it?

If you know just name of some malware using http, answer with the name too please.

share|improve this question
How can a http channel be convert its basically plain text. I should point out getting OLD malware is sort of useless which is the only malware you will be able to find. – Ramhound Jun 20 '12 at 15:19
up vote 7 down vote accepted

Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like:

  • php shells
  • java shells
  • bots

You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with:

If you are new to Metasploit, there is an official tutorial that also includes how to use the HTTP shells.

As for bots, there is a famous IRC bot from "feelcomz", that has code in many places online. A Google search will get you the code. There are also good bot simulators.

Other Options
Many Snort rules include the reference to the malware they detect, which allows you to see the malware behavior and to hunt down specific types. Or, you can set up a honeypot and collect your own live malware to analyze, which is how researchers build their own malware databases.

That list should keep you busy for a while...

share|improve this answer
Hi, thanks for help. Are you sure that 'simulators' link is correct? – Tomáš Šíma Jun 26 '12 at 9:58
yes - the 2 code samples there simulate a RFI PHP shell upload. They aren't bots, but they can help you identify RFI and shells on the network. – schroeder Jun 26 '12 at 14:19

You can get samples of common malware from and Whip out Wireshark and run them within a VM not exposed to your personal network. Remember, this is dangerous stuff and you could help continue the spread of infection as it attacks public servers. Ideally you'd spoof the other end of communication so you don't have to expose it to any network, save your virtual one.

Also, the people at Offensive Computing will be offering samples at at some point in the future.

If you're feeling bold, you can also get it directly from the wild. Places like and will give you lists of domains suspected of hosting/delivering malware. Remember to use the utmost caution and do all retrieval and research from within an isolated VM. Visiting these sites in and of itself is dangerous.

share|improve this answer

W32.Duqu malware (cousin of the famous Stuxnet) uses HTTP and HTTPS as transport layer for it's Duqu-specific custom communication protocol. More about Duqu you will find in Symantec+CrySyS Report

At there was public database of malware samples, but it's currently down and I don't know whether Duqu sample is there.

share|improve this answer

Check contagiodump and contagioexchange

They have an interesting and updated malware selection. Most of malware uses HTTP to communicate with the C&C, you will find there a lot of samples.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.