lot6’s page

Welcome to my webpage!

Hi. I’m somebody with a Computer Science degree, PhD, and a background in Medical Imaging. Besides research I really love reading, studying and collecting malware. As people collect many things, one of my collections is malware. I really like the idea of having a sample of each of them which, from my point of view, represents the state-of-the-art in programming. I’m not talking about sharing malware or damaging computers but, collecting them as people (like me) collect stamps. By the way here you’ll not find any malware.

The intent of this page is to share:

• Information about old malwares, like their history among other things
• Information reated to my collection and the tools I’m developing to organize and sort the samples
• Maybe post some tutorial for those interested in this hobby

Malware Collection

I’m working on a tool to sort my malware collection. This tool (I call it Virus Sort - VS - for now. In the past many Virus Sort tools appeared) needs to handle a huge amount of files and, instead of installing an AntiVirus (AV), I could make use of VirusShare and VirusTotal APIs to get the report of each file in my database.

Here is an example of the printed log produced by the VS so far. The malware ‘detected’ is based on Kaspersky AV, but VS is getting the whole JSON object with all the AVs report:

...
[6286/20424] 00483D925B0AE86C44B51122EC15FCC9 --> Hoax.PDF.Phish.ph
[6287/20424] 004841032D5CE9697B45D212024EA6AB --> HEUR:Trojan.Win32.Generic
[6289/20424] 0048426F070AA95894EFB3CCB681455D --> Virus.Win32.Sality.bh
[6290/20424] 00484336C762770BB5E6AC74BBD906F4 --> Backdoor.Win32.Padodor.gen
[6293/20424] 00484CA9F27FDC524C5480C99AE0EA6A --> Trojan-PSW.Win32.MiniLD.g
...

Altought the VS is in its initial development stage, below I list the features implemented or planned. To this moment everything is implemented in Python. However, I want to learn C# so eventually I’ll reimplement features in that language.

VS Dev Log

Features:

• File Management:
  • Calculate hash (MD5, SHA1, SHA224, SHA256, SHA384, SHA512) of files
  • Rename files based on their hash code
  • Move files (the file name is its hash code) to the respective folder following the pattern: files with hash starting with 00 go to the folder 0\00\
  • Move to a different folder files defined as benign or not into the VirusShare or VirusTotal database
• Reports:
  • Connect with VirusShare API and get the file report in JSON format
  • Connect with VirusTotal API to get the report in JSON format
  • Automatically trigger the update on a file report. Need to check this possibility
  • Parse JSON objects to save into a SQLite database
    • Implementation of classes to accomodate the JSON content
• Other:
  • Save GUI configuration including private API keys

Sub-pages:

• Open Resources for Research