MalwareDB

Inspired by VXCage and VirusTotal, MalwareDB is a malware knowledge management system which handles the bookkeeping regarding malware/goodware samples: hashes, origination, similarity, file types, and more. Its intention is to help malware/cybersecurity researchers, forensic investigators, and others who have a need to handle malware, or other files of potentially unknown origin. This is very much a work in progress and alpha-quality project at present.

Key Features:

• Store malware, goodware, or unknown file samples
• Categorize samples
  • Tags
  • Origin
• Permissions by group, access to file based on users' group membership
• Fetch samples
• Search based on file similarity (requires the Postgres plugins mentioned below)
• Works on any modern operating system

Requirements:

• Postgres database server
• Rust to compile
• Similarity hash extensions for Postgres:
  • LZJD
  • SSDeep
  • SDHash
  • TLSH
• Alternatively, use docker

Status

This project is in active development and not yet stable, nor are all the features implemented.

Future

• Planned features:
  • Web interface as a separate application
  • GUI applications
  • Support for Confidential Computing
  • Initially for Enarx: Website, Code
• Potential features:
  • File storage backends for HDFS, S3, others?