Malpedia Library

Malpedia is a curated malware knowledge base maintained by Fraunhofer FKIE that provides structured intelligence about malware families, threat actors, and related indicators of compromise. The library contains detailed profiles of thousands of malware families, including technical descriptions, YARA rules, samples, and attribution to known threat actor groups.

For OSINT investigators and threat intelligence analysts, Malpedia is the authoritative reference when researching a specific malware family encountered during an investigation. When malware analysis surfaces a family name or when threat intelligence reports reference specific malware, Malpedia provides the structured context needed to understand its capabilities, origin, associated threat actors, and known variants.

The platform's threat actor mapping is particularly valuable for attribution work. Malpedia links malware families to the threat groups known to use them, drawing from academic research, vendor intelligence, and law enforcement disclosures. When malware is identified in an incident, the associated threat actor profiles help analysts understand likely objectives, targets, and TTPs.

YARA rule repositories in Malpedia allow investigators to search for strings and patterns characteristic of specific malware families across other samples or systems. This is useful for hunting similar infections across a larger dataset or for writing detection signatures.

The samples section provides access to malware samples for authorized researchers, enabling direct behavioral analysis in controlled environments. This is appropriate for malware researchers with proper sandboxing infrastructure and legal authority to possess the samples.

For OSINT investigations that touch on nation-state activity or advanced persistent threats, Malpedia's structured threat actor profiles — including known aliases across different vendor naming conventions — are essential for maintaining analytical clarity when different sources use different names for the same group.

Registration is required for full access to Malpedia's sample database. The library section and many indicator resources are publicly accessible. Always operate within legal boundaries when downloading malware samples and document any samples accessed with full chain of custody records.