1

I have just recently started to delve into the topics of malware. In my hunt for malware binaries, I came across certain responses that it is not easy to grab binaries based on malware names like Nugache, Storm, Waledac, Conficker, Rbot etc. from the various databases. These names are, after all, just used to refer a particular variant of a malware, and they are not saved with these references. (This response, in particular, came from honeynet.org)

So I understand that with these names, it would not be possible for me to get the preferred binaries easily.

What I was asked was to provide a list of Md5 hashes of the malware samples that I think would be a RBOT or Waledac etc., and then it would be possible to obtain the binaries.

My question here- what exactly does it means by MD5 hash of a malware sample?
What is it that I am expected to hash?

Improve this question
2
  • It might be useful if you mentioned where you were asked to provide these MD5 hashes? Maybe on the Contagio Malware Dump? But my guess is it's to help identify actual binaries you're after, because of the reasons you have listed. For example, on malware.lu the binaries and other extracted samples are MD5 hashed to create a unique identifying signature for each of these files, see for example Flamer aka Skywiper binaries listed on Google Code.
    – TildalWave
    Jul 15, 2013 at 8:27
  • @TildalWave updated the question.
    – pnp
    Jul 15, 2013 at 9:04

1 Answer 1

Reset to default
3

A hash of a file, means compute the cryptographic checksum of the file. In a linux/unix operating system, you'd type md5sum name_of_file at the prompt. Assuming you have GNU coreutils or their equivalent with the md5sum file, like:

# md5sum name_of_file
d41d8cd98f00b204e9800998ecf8427e  name_of_file

where d41d8cd98f00b204e9800998ecf8427e is the MD5 hash of the file name_of_file.

You are expected to have a variety of malware binaries that you can hash yourself, or at least have obtained the hashes of the malware binaries from some other source.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .