I'm working on a http traffic analyzer and I need a collection of malware, which uses http as a way to get commands and respond, to analyze their network behaviour.

Is there any database of malware, where I could actually download the code and analyze it?

If you know just name of some malware using http, answer with the name too please.

  • 1
    How can a http channel be convert its basically plain text. I should point out getting OLD malware is sort of useless which is the only malware you will be able to find.
    – Ramhound
    Commented Jun 20, 2012 at 15:19

4 Answers 4


Some researchers will not let the public download malware, for obvious reasons, but you might be looking for things like:

  • php shells
  • java shells
  • bots

You also have Metasploit as a resource of open-source HTTP/S shells, stagers, and 'malware' to play with:

If you are new to Metasploit, there is an official tutorial that also includes how to use the HTTP shells.

As for bots, there is a famous IRC bot from "feelcomz", that has code in many places online. A Google search will get you the code. There are also good bot simulators.

Other Options
Many Snort rules include the reference to the malware they detect, which allows you to see the malware behavior and to hunt down specific types. Or, you can set up a honeypot and collect your own live malware to analyze, which is how researchers build their own malware databases.

That list should keep you busy for a while...

  • Hi, thanks for help. Are you sure that 'simulators' link is correct? Commented Jun 26, 2012 at 9:58
  • yes - the 2 code samples there simulate a RFI PHP shell upload. They aren't bots, but they can help you identify RFI and shells on the network.
    – schroeder
    Commented Jun 26, 2012 at 14:19

You can get samples of common malware from tuts4you.com and malware.lu. Whip out Wireshark and run them within a VM not exposed to your personal network. Remember, this is dangerous stuff and you could help continue the spread of infection as it attacks public servers. Ideally you'd spoof the other end of communication so you don't have to expose it to any network, save your virtual one.

Also, the people at Offensive Computing will be offering samples at openmalware.org at some point in the future.

If you're feeling bold, you can also get it directly from the wild. Places like malwaredomainlist.com and malwaredomains.com/ will give you lists of domains suspected of hosting/delivering malware. Remember to use the utmost caution and do all retrieval and research from within an isolated VM. Visiting these sites in and of itself is dangerous.


W32.Duqu malware (cousin of the famous Stuxnet) uses HTTP and HTTPS as transport layer for it's Duqu-specific custom communication protocol. More about Duqu you will find in Symantec+CrySyS Report

At offensivecomputing.net there was public database of malware samples, but it's currently down and I don't know whether Duqu sample is there.


Check contagiodump and contagioexchange

They have an interesting and updated malware selection. Most of malware uses HTTP to communicate with the C&C, you will find there a lot of samples.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .