I'm making an antivirus test just for my own, and I need thousands of malware samples (about 10k-30k, but the more the better). Please don't even mention Eicar test file because this will be a detection rate testing. I saw several AV testing sites, but I don't blindly trust them, so I just would like to get a clearer view of the quality of the products.
-
2Open your email, visit the spam label, and start clicking... as @tlng05 says, most real-time feeds are expensive.– JediJun 21, 2016 at 1:00
-
@Jedi I'm not planning to spend money, because I make the test only for myself, not for any profit and not for public, but I 'highlighted' that I need to download thouusands of viruses at ONCE. So it's not a good way to spend months on seeking for viruses on email, but thanks anyway.– YogibearJun 21, 2016 at 10:11
-
Questions of the type "where can I find X?" are off-topic as the answers could be neverending.– schroeder ♦Jan 3, 2021 at 22:53
Comments disabled on deleted / locked posts / reviews
|
3 Answers
A quick Google search turned up this post which links to a number of malware sample databases:
Contagio Malware Dump: Free; password required
KernelMode.info: Free; registration required
Malshare: Free
Malware.lu’s AVCaesar: Free; registration required
MalwareBlacklist: Free; registration required
Malware DB: Free
Malwr: Free; registration required
Open Malware: Free
SecuBox Labs: Free
theZoo aka Malware DB: Free
Virusign: Free
VirusShare: Free
@MalwareChannel: Free
However, the problem with most of these is that the samples tend to be quite dated, anywhere from a few weeks to years old. Thus while they're still useful for analysis purposes, they might not be as useful for testing the real-world effectiveness of antivirus programs. Detecting old malware is rather simple compared to keeping up to date with new malware, and most new samples that are widely distributed don't last more than a couple days before they are flagged by nearly all antivirus programs.
If you want to perform a more realistic test with new, just-discovered samples, you'll probably need a live feed rather than a database. PCMag uses a feed supplied by a company called MRG-Effitas in their AV software testing, for instance. Google also turned up the Cyveillance Malicious URL Data Feed. Unfortunately, it seems these feeds are provided as a commercial service and not generally offered to individuals, though it wouldn't hurt to try contacting these companies.
If all this sounds like too much trouble, you might want give the third-party test results another look. By referencing results from several labs you can usually get a reasonably good idea of the effectiveness of any AV program you are considering.
-
Informative answer though, the only problem is that I've seen most of these sites (not all, but most of these), and it seems you can download malware, but If you need to make a test to ensure it's not only luck what the numbers say, you need to download hundreds at once, and imagine to download hundreds of virus just one by one and unpacking each (plenty of time). But I'll take a closer look to these sites, thanks anyway.– YogibearJun 21, 2016 at 10:05
-
1Seems the sites that are free don't look suitable, trying out the register-requiring sites, but I have found a good one that isn't mentioned, it's VXHeaven, seems good, but the viruses were collected using KAV, so that antivirus can't be tested, but the other free ones could be, so I'll post an update if there is any progress. Waiting for the confirmation emails to be sent from the sites, so working on it. :D– YogibearJun 22, 2016 at 21:00
Found a website called VXHeaven where I can download a very huge number of viruses (260k). If the malware are working and not broken and not each of them are compressed, I will mark this as the answer for my question.
Btw. special thanks to tlng05 for those sites, they could help other people, and they helped me in my research to find VXHeaven with the websites he sent.
Regards
-
1Thanks, I appreciate that you take the time to share the results of your own researches :) . Jun 23, 2016 at 13:21
-
No problem, it seems that the files are not broken and the antiviruses detect them (I accidently left the realtime protection activated :D ).– YogibearJun 23, 2016 at 16:35
-
I accepted my own answer, because the site I found solved my problem, and it may help others in their researches.– YogibearJun 23, 2016 at 16:38
There are quite a few accessible malware repositories out there.
Many of them are categorized here depending on your preferences, and it's the most up-to-date resource for now:
https://github.com/Virus-Samples/Malware-Sample-Sources
In addition since you are looking for about 10,000+ samples you can obtain a free daily batch at: https://www.virussamples.com
It seems many repositories are going away over time so finding the ones that are updated/maintained can be a little tricky but with some digging you'll be able to quickly access quite a few and build up a nice collection to work from.
