I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware before, so if anyone has a guide or a link to a download where I can get a sample like this I'd appreciate it.

Where can I find sample malware with source that spreads via USB? Where can I find a tutorial on writing malware so I can understand more about how it works?

2 Answers 2





@echo off
copy autorun.inf C:\ > NUL
copy file.bat C:\ > NUL
copy autorun.inf D:\ > NUL
copy file.bat D:\ > NUL
explorer .

Put them together, and you got something that will spread through USB.

On a more serious note, don't expect that someone will just hand you a piece of malware here.

  • 1
    Might be possible to run an autorun script pointing at a copy of the eicar virus test signature. That should allow the OP to test autorun of a 'virus' from a USB and check if the defences on the system connected to identify eicar. None of that will help you write malware though! Could look into offensive security.
    – AndyMac
    May 2, 2013 at 17:46
  • Yea - I sortof expected to receive this kind of reception - I'm not looking for malware per se, just a resource - google was remarkedly unproductive.
    – gal
    May 2, 2013 at 18:54

I just wanted to touch on Adnan's post. Since on the subject of USB autorun, here is a real world example using the same scheme.

The recent conficker virus used Autorun to infect systems. While not completely automatic, it presents itself as a legit autorun option that most people are used to choosing without giving much thought. Conficker used a similar autorun.inf as above, with the added lines:

Action=Open folder to view files

As you can see, when the usb device is inserted, Windows Autorun presents the user with the option of "Open folder to view files" with the same icon as the legit option. This is an easy way to get the user to unknowingly execute the code.


Not the answer you're looking for? Browse other questions tagged .