This is going to sound fishy.
Recently getting into cybersecurity things and have been pretty interested in looking at malware and maybe making some myself to get the hang of it. Do you guys know any good repositories with malware to learn from? For example, if I wanted to make a credential stealing program, there’s a lot of different programs that may have credentials that are valuable. Or, maybe writing a keylogger? I took a look at a rust crate that can record keystrokes but has kind of a weird (or at least not as easy) type system because of different OS implementations, but how do different types of malware consolidate those differences?
I guess the broader question I’m getting at specifically is looking at how already made programs get around different technical obstacles like detailed above.
Thanks
https://github.com/ytisf/theZoo
Thats a repo of existing malware. Be careful with it. You can use that to start reverse engineering an existing malware. Use a VM that isnt connected to a network.
If you want to write something, go for it. Often malware is tailored to a single OS (Windows), so cross platform is less of a concern.
The hard part of writing malware is doing it in an undetectable way, which will usually require deeper OS knowledge, which you’ll have to acquire over time. YouTube has some good videos if you hunt around.
Sweet - I didn’t realize that malware is tailored for one OS usually, but that makes a lot more sense.
https://vx-underground.org/ has a really big database and an awesome papers section. When you will take a look at it you’ll ask a question, the answer is infected.
I can’t recommend Maldev Academy enough. It has been an amazing resource, to get into malware development. Keep in mind, however, that malware development is pretty difficult topic. You will have to eventually use WinAPI and syscalls, so learning about that even outside of malware development will help you a lot.
For example, try looking into how to execute a shellcode in memory - allocate memory as RWX, copy some data and then execute it. Try executing it in a different process, or in a different thread of another process. That’s the core of malware development you’ll probably eventually have to do anyway. Manually calling syscalls is also a skill that you’ll need, if you want to get into EDR avoidance.
Also, look into IoCs and what kind of different stuff can be used to detect the malware. Syscall hooks, signatures, AMSI, and syslog are all things that are being watched and analyze to detect malware, and knowing what exactly is your program logging and where is one of the most important and difficult skills you can get.
There probably are a lot resources for these two skills, and they are an important foundation for malware developemnt, so I’d suggest researching that. You’ll probably not get much from looking at other malware, because it tends to be really low-level, and obfuscated, exactly to avoid the IoCs I’ve mentioned above. Implementing the malware behavior after that is the easier part.
Another way to read a lot of adversarial code is digging into the Metasploit payloads.
https://github.com/rapid7/metasploit-framework/tree/master/data
https://github.com/MrTuxx/OffensiveGolang
Here’s a collection you can check out. I recommend Ben Kurtz’s Defcon talk he links to as well.
Not fishy at all! It’s like a lockpicking fan asking about locksport.
If you’re looking for examples, GitHub has a lot of CVE proof-of-concepts and there are lots of payload git repos across git hosts in general, but if you’re looking for a one-stop-shop “Steal all credentials,” or “Work on all OSes/architectures just by switching the compile target,” then you’ll have a harder time. (A do-one-thing-well approach is more maintainable after all.)
If you want to make something yourself that still tries to pull off the take-as-much-as-you-can, you should just search up how different apps store data and whether it’s easy to grab. Like, where browsers store their cookies, or the implications of X11’s security model (Linux-specific), or where Windows/Windows apps’ credentials and hashes are stored. Of course, there’s only much a payload can do without a vulnerability exploit to partner with (e.g. Is privilege escalated? Are we still in userland? is this just a run-of-the-mill Trojan?).
Apologies if my answer is too general.