Skip to content
KitploitKITPLOIT
๋„๊ตฌ๋ธ”๋กœ๊ทธ
์ œ์ถœ
๋„๊ตฌ๋ธ”๋กœ๊ทธ
์ œ์ถœ

ํ•ดํ‚น, ์นจํˆฌ ํ…Œ์ŠคํŠธ ๋ฐ ์‚ฌ์ด๋ฒ„ ๋ณด์•ˆ ๋„๊ตฌ๋ฅผ ๋‹น์‹ ์˜ ๋ณด์•ˆ ๋ฌด๊ธฐ๊ณ ์—!

Kitploit์€ ํ•ดํ‚น, ์‚ฌ์ด๋ฒ„ ๋ณด์•ˆ ๋ฐ ์นจํˆฌ ํ…Œ์ŠคํŠธ ๋„๊ตฌ ๋””๋ ‰ํ† ๋ฆฌ์ž…๋‹ˆ๋‹ค. ์ตœ์‹  ํ”„๋กœ์ ํŠธ ์—…๋ฐ์ดํŠธ๋ฅผ ๋ฐœ๊ฒฌํ•˜์—ฌ ์ทจ์•ฝ์ ์„ ์ฐพ๊ณ , ์‹œ์Šคํ…œ์„ ๋ถ„์„ํ•˜๊ณ , ํ…Œ์ŠคํŠธ๋ฅผ ์ž๋™ํ™”ํ•˜๊ณ , ๋ณด์•ˆ์„ ๊ฐ•ํ™”ํ•˜์„ธ์š”.

ยทยทํ”ผ๋“œยท๋ฌธ์˜ยท๊ฐœ์ธ์ •๋ณดยทยฉ 2026 Kitploit

๋„๊ตฌ ๋””๋ ‰ํ† ๋ฆฌ

์นดํ…Œ๊ณ ๋ฆฌ

๋ชจ๋“  ์นดํ…Œ๊ณ ๋ฆฌ ๋ณด๊ธฐ
Loading categories
๋„๊ตฌ/GitHubGitHub/alvin-tosh/malware-exhibit
ForensicsMalware AnalysisCryptographyThreat IntelligenceLearning & EducationCurated Resources
GitHubalvin-tosh/malware-exhibit

Malware-Exhibit

๐Ÿš€๐Ÿš€ ์ด๊ฒƒ์€ ๐ŸŽ‡๐Ÿ”ฅ ์‹ค์ œ ์„ธ๊ณ„๐Ÿ”ฅ ๐ŸŽ‡ ์—ฐ๊ตฌ์ž๋“ค์ด ํŽธ์ง‘ํ•˜๊ณ  ๋ถ„์„ํ•œ๐Ÿ”ฅ ์•…์„ฑ์ฝ”๋“œ ์ปฌ๋ ‰์…˜์œผ๋กœ, ์•…์„ฑ์ฝ”๋“œ ์œ„ํ˜‘๐Ÿ˜ˆ, ๋ถ„์„ ๋ฐ ์™„ํ™”๐Ÿง์— ๋Œ€ํ•ด ๋” ์ดํ•ดํ•˜๊ธฐ ์œ„ํ•œ ๊ฒƒ์ž…๋‹ˆ๋‹ค.

์ €์žฅ์†Œ ๋ณด๊ธฐ
1.2k1962๋…„ ์ „Kitploit ๊ฒ€ํ†  ์™„๋ฃŒ

์ธ๊ธฐ

๋ชจ๋‘ ๋ณด๊ธฐ โ†’

์ปค๋ฎค๋‹ˆํ‹ฐ์—์„œ ๊ฐ€์žฅ ๋งŽ์ด ์‚ฌ์šฉ๋˜๋Š” ๋„๊ตฌ๋ฅผ ์ฐพ์•„๋ณด์„ธ์š”.

๋ชจ๋“  ๋„๊ตฌ ํƒ์ƒ‰

๋„๊ตฌ ์ปฌ๋ ‰์…˜์„ ๋‘˜๋Ÿฌ๋ณด์„ธ์š”

๋ชจ๋“  ๋„๊ตฌ ๋ณด๊ธฐ โ†’
๊ณต์œ 

Licence

โš ๏ธโš ๏ธ ๋ฉ€์›จ์–ด ์ „์‹œ โš ๏ธโš ๏ธ

CC++GoJavaJavaScriptPerlRubyPHP PowerShellPythonR.NetShell ScriptTypeScriptRustFirefoxEdgeFirebasePostgresPayPalAWSAzureOracleMicrosoft Android Linux Ubuntu macOS Windows Apache Apache Tomcat Apple Nginx Play Store F Droid App Store GitHub Xbox

Docker - ์‚ฌ์šฉ๋ฒ• ๋ฐ ์ค‘์š”์„ฑ

  • Docker ์ด๋ฏธ์ง€๋ฅผ ๊ฐ€์ ธ์˜ต๋‹ˆ๋‹ค (์ •๋ณด ์ฐธ์กฐ). ์ด ์ €์žฅ์†Œ๋ฅผ ๋ณธ์ธ ์ปดํ“จํ„ฐ์— ์ง์ ‘ ์‚ฌ์šฉํ•˜์ง€ ๋ง๊ณ , ์ €์žฅ์†Œ๋ฅผ ํด๋ก ํ•˜์—ฌ ๋กœ์ปฌ ์ปดํ“จํ„ฐ์—์„œ Dockerfile์„ ๋นŒ๋“œํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค.

  • ์ด๋ฏธ์ง€๋ฅผ ์‹คํ–‰ํ•˜๋ ค๋ฉด ์˜ˆ๋ฅผ ๋“ค์–ด: ---docker run --name <name_of_given_container> -it ghcr.io/ronaldsonbellande/malware-exhibit:main bash---

๋˜๋Š” Dockerfile์—์„œ ์ง์ ‘ ์ด๋ฏธ์ง€๋ฅผ ๋นŒ๋“œํ•œ ๊ฒฝ์šฐ ์˜ˆ๋ฅผ ๋“ค์–ด: --- docker run --name <name_of_given_container> -it <docker_image> bash ---

  • Docker ์ปจํ…Œ์ด๋„ˆ๋ฅผ ์ข…๋ฃŒํ•œ ํ›„ ๋‹ค์‹œ bash๋กœ ์ง„์ž…ํ•˜๋ ค๋ฉด ์˜ˆ๋ฅผ ๋“ค์–ด: --- docker start -ia <name_of_given_container> ---

  • ์‚ฌ์šฉ์— ๋Œ€ํ•œ ๊ฐ„๋žตํ•œ ์†Œ๊ฐœ์ž…๋‹ˆ๋‹ค. ๋ณด๋‹ค ๋ณต์žกํ•œ ์‚ฌ์šฉ๋ฒ•์€ https://github.com/Algorithm-Model-Research ์—์„œ ํ™•์ธํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.

์‹คํ—˜์šฉ ๊ธฐ๋ณธ Docker ์ด๋ฏธ์ง€ (์ €์žฅ์†Œ ์‚ฌ์ดํŠธ ์„ค๋ช…)

  • https://hub.docker.com/r/ronaldsonbellande/sph_tools/tags
  • https://github.com/Algorithm-Model-Research/SPH_Tools
  • https://github.com/RonaldsonBellande/SPH_Tools/pkgs/container/sph_tools

Docker Pull ๊ธฐ๋ณธ Docker ์ด๋ฏธ์ง€

  • docker pull ronaldsonbellande/sph_tools

์†Œ๊ฐœ๐Ÿ˜„

  • Docker ์‚ฌ์šฉ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์„ค๋ช…์€ ์กฐ์ง ํŽ˜์ด์ง€๋ฅผ ์ฐธ์กฐํ•˜์—ฌ ์ด๋ฏธ์ง€ ์‚ฌ์šฉ๋ฒ•์„ ๋” ์ž˜ ์ดํ•ดํ•˜์‹ญ์‹œ์˜ค. =======
  • Docker ์‚ฌ์šฉ์— ๋Œ€ํ•œ ์ž์„ธํ•œ ์„ค๋ช…์€ ์กฐ์ง ํŽ˜์ด์ง€๋ฅผ ์ฐธ์กฐํ•˜์—ฌ ์ด๋ฏธ์ง€ ์‚ฌ์šฉ๋ฒ•์„ ๋” ์ž˜ ์ดํ•ดํ•˜์‹ญ์‹œ์˜ค.
  • docker pull ghcr.io/ronaldsonbellande/malware-exhibit:main
  • docker pull ghcr.io/algorithm-model-research/malware-exhibit:main

์ฃผ์˜ํ•  ์  ๐Ÿ“๐Ÿ‘‡

  1. ๊ฐœ์ธ ๋จธ์‹ ์— ๋ฐฐํฌํ•˜์ง€ ๋งˆ์‹ญ์‹œ์˜ค. ์ด๋Ÿฌํ•œ ํŒŒ์ผ์€ ๋„คํŠธ์›Œํฌ ๋‚ด์˜ ๋‹ค๋ฅธ ์žฅ์น˜๋ฅผ ๊ฐ์—ผ์‹œํ‚ฌ ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค.
  2. ZIP ํŒŒ์ผ์— ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์žˆ๋Š” ๊ฒฝ์šฐ (VX-UNDERGROUND ๋•Œ๋ฌธ) ๋น„๋ฐ€๋ฒˆํ˜ธ๋Š” 'infected'์ž…๋‹ˆ๋‹ค. ๋”ฐ์˜ดํ‘œ๋Š” ๋นผ๊ณ ์š”... ๋ฌผ๋ก ์ด์ฃ ๐Ÿคญ
  3. ์ผ๋ถ€ ํŒŒ์ผ์€ .ex_ ํ™•์žฅ์ž๋กœ ๋˜์–ด ์žˆ์Šต๋‹ˆ๋‹ค. ์‹ค์ˆ˜๋กœ ๋”๋ธ”ํด๋ฆญํ•˜์—ฌ ๋ฐฐํฌ๋˜๋Š” ๊ฒƒ์„ ๋ฐฉ์ง€ํ•˜๊ธฐ ์œ„ํ•จ์ž…๋‹ˆ๋‹ค.
root@kitploit:~
The malware in this repo is either:
1. FEW: Built by me ๐Ÿคญ 
2. SOME: Analysed by me โšก
3. A FEW: Acquired and retrieved during threat hunting and threat intelligence โ˜„๏ธ
4. MOST: Shared/Sourced from other malware researchers ๐Ÿ˜Š VX-UNDERGROUND, KASPERSKY, LIFKA, JOHN HAMMOND, CTFs...and a few others๐Ÿ˜Š

๐Ÿ‘‰ ์ด ์ €์žฅ์†Œ์—๋Š” ์ฒœ ๊ฐœ ์ด์ƒ์˜ ๋ฉ€์›จ์–ด ์ƒ˜ํ”Œ์ด ์žˆ์œผ๋ฉฐ, ๋‹จ์ˆœํ•œ ๋ถˆ๊ฝƒ๋†€์ด๋ถ€ํ„ฐ ๋Œ€๋Ÿ‰ ์‚ด์ƒ ๋ฌด๊ธฐ๊นŒ์ง€ ๋‹ค์–‘ํ•ฉ๋‹ˆ๋‹ค. ๐Ÿ‘‰ ์ด๋Ÿฌํ•œ ์ƒ˜ํ”Œ์„ ๋ฆฌ๋ฒ„์Šค ์—”์ง€๋‹ˆ์–ด๋งํ•˜๋ ค๋ฉด Ghidra, Responder, IDApro๋ฅผ ์‚ฌ์šฉํ•  ์ˆ˜ ์žˆ์Šต๋‹ˆ๋‹ค. ๐Ÿ‘‰ ํ•„์š”ํ•œ ์ง€์› ํ™˜๊ฒฝ(์˜ˆ: JDK, Python3, Ruby ๋“ฑ)์ด ์„ค์น˜๋˜์–ด ์žˆ๋Š”์ง€ ํ™•์ธํ•˜์‹ญ์‹œ์˜ค. ๐Ÿ‘‰ ํŒจํ‚ค์ง€๋œ ๋ชจ๋“  ์†Œ์Šค ์ฝ”๋“œ์—๋Š” 'infected' ๋น„๋ฐ€๋ฒˆํ˜ธ๊ฐ€ ์„ค์ •๋˜์–ด ์žˆ์„ ์ˆ˜๋„ ์žˆ๊ณ  ์•„๋‹ ์ˆ˜๋„ ์žˆ์Šต๋‹ˆ๋‹ค (๋”ฐ์˜ดํ‘œ ์ œ์™ธ). ๊ฐœ๋ณ„ ํŒŒ์ผ์€ ๋Œ€๊ฐœ ํŒจํ‚ค์ง€๋˜์–ด ์žˆ์ง€ ์•Š์Šต๋‹ˆ๋‹ค. ๐Ÿ‘‰ ๋” ๋งŽ์€ ๋ฉ€์›จ์–ด๋ฅผ ๋ณด๋ ค๋ฉด VX-UNDERGROUND, MALWARETECH, ANY.RUN, VT, LIFKA ๋“ฑ์„ ํ™•์ธํ•˜์‹ญ์‹œ์˜ค.

์ฑ…์ž„ ๋ถ€์ธ:

ํ•ด๋‹น ๋ฒ•๋ฅ ์ด ํ—ˆ์šฉํ•˜๋Š” ์ตœ๋Œ€ ๋ฒ”์œ„ ๋‚ด์—์„œ, ๋ณธ ์ €์žฅ์†Œ์˜ ์ฝ˜ํ…์ธ ๋ฅผ ์ œ๊ณตํ•˜๊ฑฐ๋‚˜ ์ œ์ถœํ•œ ๋ณธ์ธ ๋ฐ/๋˜๋Š” ๊ด€๊ณ„์‚ฌ๋Š” ๋‹ค์Œ๊ณผ ๊ฐ™์€ ๊ฒฐ๊ณผ๋กœ ์ธํ•ด ๋ฐœ์ƒํ•˜๋Š” ๊ฐ„์ ‘์ , ์šฐ๋ฐœ์ , ํŠน๋ณ„, ๊ฒฐ๊ณผ์  ๋˜๋Š” ์ง•๋ฒŒ์  ์†ํ•ด, ๋˜๋Š” ์ง๊ฐ„์ ‘์ ์œผ๋กœ ๋ฐœ์ƒํ•œ ์ˆ˜์ต ์†์‹ค, ๋ฐ์ดํ„ฐ ์†์‹ค, ์‚ฌ์šฉ๊ถŒ ์†์‹ค, ํ‰ํŒ ์†์‹ค ๋˜๋Š” ๊ธฐํƒ€ ๋ฌดํ˜• ์†์‹ค์— ๋Œ€ํ•ด ์ฑ…์ž„์„ ์ง€์ง€ ์•Š์Šต๋‹ˆ๋‹ค:

๐Ÿ‘‰ (i) ๋ณธ ๋ฆฌ์†Œ์Šค์— ๋Œ€ํ•œ ์ ‘๊ทผ ๋ฐ/๋˜๋Š” ์ ‘๊ทผ ๋ถˆ๊ฐ€๋Šฅ; ๐Ÿ‘‰ (ii) ๋ณธ ๋ฆฌ์†Œ์Šค๊ฐ€ ์ฐธ์กฐํ•˜๋Š” ์ œ3์ž์˜ ๋ชจ๋“  ํ–‰์œ„ ๋˜๋Š” ์ฝ˜ํ…์ธ (๊ณต๊ฒฉ์ ์ด๊ฑฐ๋‚˜ ๋ถˆ๋ฒ•์ ์ธ ํ–‰์œ„ ๋˜๋Š” ๋‹ค๋ฅธ ์‚ฌ์šฉ์ž๋‚˜ ์ œ3์ž์˜ ํ–‰์œ„ ํฌํ•จ); ๐Ÿ‘‰ (iii) ๋ณธ ๋ฆฌ์†Œ์Šค ๋˜๋Š” ๊ทธ ๋ฆฌ์†Œ์Šค์—์„œ ์–ป์€ ๋ชจ๋“  ์ฝ˜ํ…์ธ .

์ฆ๊ธฐ์„ธ์š”๐Ÿ˜Š

๊ธฐ์—ฌ์ž

  • Palpatine @alvin-tosh
  • Ronaldson Bellande @RonaldsonBellande
๋„๊ตฌ ๋‹ค์šด๋กœ๋“œ