Finding a specific malware sample for malware analysis purposes

Question

I wish to analyze the changes made by a specific virus. For example, Win32.Sality.
Where can I get the sample of this, or other similar, malware for testing?

And do AV editors in general have some official feed for malware?
+1, always wondered this: where is malware when you need it?!

dgarcia · Answer 1 · 2012-08-19 19:04:10Z

up vote 8 down vote

Contagiodump blog and the spam folder are your best friends

answered Aug 19 '12 at 19:04

dgarcia
37625

1

Would be the first time ever that my spam folder contains malware. – Luc Aug 19 '12 at 19:25

@Luc Let me guess, gmail? ;) – Polynomial Aug 19 '12 at 19:59

@Polynomial Hotmail actually – Luc Aug 19 '12 at 22:25

vane · Answer 2 · 2012-08-30 20:42:26Z

up vote 7 down vote

Offensive Computing has about 4,456,929 samples.

answered Aug 30 '12 at 20:42

vane
1812

schroeder · Answer 3 · 2012-08-30 21:49:58Z

up vote 4 down vote

You can always run your own honeypot.

answered Aug 30 '12 at 21:49

schroeder
8,28711239

h00j · Answer 4 · 2012-08-30 21:55:02Z

up vote 5 down vote

http://www.malware.lu/ Has 2,236,674 samples

answered Aug 30 '12 at 21:55

h00j
371311

pnp · Answer 5 · 2013-05-12 15:33:35Z

up vote 3 down vote

virusshare.com is another great repository of malware samples, having a huge number of samples. A snapshot from the website's homepage:

enter image description here

Access is by invitation only, so you will need to drop a mail to the site admin.

Another good resource that I know of- www.deependresearch.org

edited May 12 at 15:33

answered May 4 at 5:44

pnp
828219

Val · Answer 6 · 2013-06-16 16:21:26Z

Here is the answer to my great question

I have checked and Tekdefence is the only simply browsed. Open Malware. responds with some list if I enter "windows" into the MD5 search windows. Others are useless forums or others require registration. Malshare also provides search without registration but, it requires MD5 hash. I have no idea how to get it.

An Blog which has some url's

Malshare

Tekdefence