ytisf/thezoo

★ 12,998PythonAudience · researcherComplexity · 2/5LicenseSetup · easy

Mindmap

mindmap
  root((thezoo))
    What it does
      Malware sample archive
      Encrypted storage
      Research tool
    Contents
      Binary samples
      Source code
      Checksums
    CLI Tool
      SQLite database
      Interactive console
      Auto-complete search
    Safety
      Encrypted archives
      VM-only warning
      No network advised

mindmap root((thezoo)) What it does Malware sample archive Encrypted storage Research tool Contents Binary samples Source code Checksums CLI Tool SQLite database Interactive console Auto-complete search Safety Encrypted archives VM-only warning No network advised

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Browse and retrieve live malware samples inside an isolated virtual machine for hands-on analysis and reverse engineering

USE CASE 2

Study original or reconstructed source code of known malware families to understand how real attacks work

USE CASE 3

Submit newly discovered malware samples using the preparation script and contribute them back via pull request

Tech stack

PythonSQLite

Getting it running

Difficulty · easy Time to first run · 30min

All samples must be run only inside a sandboxed virtual machine with no network connection, some samples are live worms that spread automatically if executed outside a controlled environment.

GPL v3: use and modify freely but share changes under the same license. The GPL does not apply to the malware samples themselves, those have no open-source license.

In plain English

theZoo is a collection of real malware samples and source code gathered into one place for the purpose of security research and malware analysis. The project exists because actual malware files are difficult to obtain in a form that is safe to study, so the maintainers collected and organized them to make analysis more accessible to researchers and students. The malware files are stored encrypted in password-protected ZIP archives. Each entry in the collection includes the encrypted archive, a password file, and checksums for verification. The repository contains both binary samples and source code, with some source code being the original leaked version and some being partially reconstructed through reverse engineering. A Python command-line tool provides an interface for browsing and retrieving samples from a SQLite database. Running it starts an interactive console where you can search for specific malware by name or other attributes. The database search is described as free-form, and the tool includes auto-complete for malware names. The README includes a prominent safety warning: these are live, functional malware samples. The project strongly recommends running any samples only inside a virtual machine with no network connection and without guest additions installed. Some samples are worms that will automatically attempt to spread if executed outside a controlled environment. Submitting new samples involves running a preparation script that encrypts the file and creates the directory structure, then submitting a pull request along with a database entry. The project is licensed under GPL version 3, though the license explicitly does not apply to the malware samples themselves. The project was created by Yuval Nativ and is maintained by Shahak Shalev.

Copy-paste prompts

Prompt 1

Show me how to use theZoo's command-line tool to search for ransomware samples by name and retrieve one for analysis

Prompt 2

Write a Python script that queries theZoo's SQLite database and lists all samples grouped by malware family

Prompt 3

How do I safely set up a sandboxed virtual machine environment to run a malware sample from theZoo without risk of spreading?

Prompt 4

Walk me through adding a new malware sample to theZoo using the preparation script and submitting a pull request with the database entry

Open on GitHub → Explain another repo

← ytisf on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.