Malware that uses http as a covert channel

Question

I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.

Is there any database of malware, where I could actually download the code and analyze it?

If you know just name of some malware using http, answer with the name too please.

Answer 1

Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like:

• php shells
• java shells
• bots

Metasploit
You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with:

• http://www.metasploit.com/modules/payload/windows/shell/reverse_http
• http://www.metasploit.com/modules/payload/java/
• http://www.metasploit.com/modules/payload/php/

If you are new to Metasploit, there is an official tutorial that also includes how to use the HTTP shells.

Bots
As for bots, there is a famous IRC bot from "feelcomz", that has code in many places online. A Google search will get you the code. There are also good bot simulators.

Other Options
Many Snort rules include the reference to the malware they detect, which allows you to see the malware behavior and to hunt down specific types. Or, you can set up a honeypot and collect your own live malware to analyze, which is how researchers build their own malware databases.

That list should keep you busy for a while...

Answer 2

W32.Duqu malware (cousin of the famous Stuxnet) uses HTTP and HTTPS as transport layer for it's Duqu-specific custom communication protocol. More about Duqu you will find in Symantec+CrySyS Report

At offensivecomputing.net there was public database of malware samples, but it's currently down and I don't know whether Duqu sample is there.

Answer 3

You can get samples of common malware from tuts4you.com and malware.lu. Whip out Wireshark and run them within a VM not exposed to your personal network. Remember, this is dangerous stuff and you could help continue the spread of infection as it attacks public servers. Ideally you'd spoof the other end of communication so you don't have to expose it to any network, save your virtual one.

Also, the people at Offensive Computing will be offering samples at openmalware.org at some point in the future.

If you're feeling bold, you can also get it directly from the wild. Places like malwaredomainlist.com and malwaredomains.com/ will give you lists of domains suspected of hosting/delivering malware. Remember to use the utmost caution and do all retrieval and research from within an isolated VM. Visiting these sites in and of itself is dangerous.

Answer 4

Check contagiodump and contagioexchange

They have an interesting and updated malware selection. Most of malware uses HTTP to communicate with the C&C, you will find there a lot of samples.