Test Viruses for Download

[Virucyde]

Me and my boss at work spent about two hours the other day trying to infect a virtual machine with no AV, minimal updates, and running Win7. After running through plenty of random torrents with cracks for games not released yet, doing everything from IE8, with all security settings set on their lowest, clicking every link that said Download! and installing plenty of free cursors, smileys, and silly games, we were left with a bogged down machine, but no viruses.

Specifically we were hoping to pick up some of the scarewares, or perhaps the TDSS variants, or the ZeroAccess rootkit, but instead we just got a lot of crapware that could've been removed from Add/Remove Programs.

Does anyone have a nice collection of virus droppers I can utilize to teach techs basic virus removal on a virtual machine? Because even when I try, I can't seem to pick one up

 

[elcamino74ss]

http://www.offensivecomputing.net/

 

[mechBgon]

I used to have about 10GB of samples lying around. If you want to get something nasty, try some software crackz and you may end up with TDL-4, I hear that's one of their main MOs. Or try the Zeus tracker sites like https://zeustracker.abuse.ch/monitor.php.

Also remember that a lot of malware is VM-aware and won't run on a VM, and some of it is also time-delayed... there was one family where I'd install the Trojan, then turn the system's clock forward a day to get it to activate. If you do infect the VM, remember it can attack other systems and shares on the network just like a real system. Infecting your shares, injecting malicious Iframes into your other systems' network packets, subverting your router... make sure you know what you're doing

Anyway, your best bet for malware practice is a physical machine with a CPU that doesn't feature hardware-enforced DEP (or has it disabled in the BIOS), and preferably loaded with highly out-of-date installations of Java, Adobe Reader, Flash Player, QuickTime and RealPlayer. I used Win2000, a 1GHz Duron, a 15000rpm SCSI drive and Acronis TrueImage, so I could re-image in ~2 minutes and be ready for another go.

 

[LiuKangBakinPie]

Malware domain list, malc0de, clean-mx.de/malware. Just to name a few. Be careful though.

source codes and decompiled samples
http://esploit.blogspot.com/2011/05/...ourcecode.html

You can find stuxnet and other source code there

Here is Zeus source code
http://www.opensc.ws/attachments/tro...-code-zeus.rar