armuk / maltrieve

A tool to retrieve malware directly from the source for security researchers.

Maltrieve

Maltrieve originated as a fork of mwcrawler. It retrieves malware directly from the sources as listed at a number of sites, including:

• Malware Domain List
• VX Vault
• Malc0de
• Sacour.cn

Pending sources include:

• http://urlquery.net/
• http://www.malware.com.br/cgi/submit?action=list
• http://support.clean-mx.de/clean-mx/xmlviruses.php?
• http://www.nictasoft.com/ace/malware-urls/

These lists will be implemented if/when they return to activity.

• Malware Black List
• NovCon Minotaur

Other improvements include:

• Proxy support
• Multithreading for improved performance
• Logging of source URLs
• Multiple user agent support
• Better error handling

Dependencies

• BeautifulSoup version 4

License

Released under GPL version 3. See the LICENSE file for full details.

Known bugs

We list all the bugs we know about (plus some things we know we need to add) at the Github issues page.

How you can help

Aside from pull requests, non-developers can open issues on Github. Things we'd really appreciate:

• Bug reports, preferably with error logs
• Suggestions of additional sources for malware lists
• Descriptions of how you use it and ways we can improve it for you

If you'd prefer not to open an issue, you can contact me on Twitter or email.