Educational on AP Security

How to find malware samples

Tue, 08 Sep 2026 00:00:00 +0000

In my previous post, I discussed how sandboxes analyze malware samples. But where do cybersecurity companies find malware samples to analyze? How do they stay up to date with the latest malware versions, and how do they do it with minimal delay? Can they even get ahead of the malware authors?

Let’s find out.

Finding samples

The primary source for most companies is VirusTotal. VT is owned by Google and is the largest platform of its kind, making it the obvious first choice. It aggregates files from various sources, such as:

How does a malware sandbox work?

Sun, 06 Sep 2026 00:00:00 +0000

Ever wondered what a malware sandbox is, how it works, what information it produces, or what that information is useful for?

In this series, I’ll discuss exactly that. In this post I’ll go through the overall process and generalize a lot; in the next posts, I’ll go progressively deeper into the technical details.

What’s a malware sandbox?

It’s a VM (virtual machine) that powers up, runs malware, exports behavioral information, then gets killed and reset to a pre-run snapshot (i.e. known good pre-infection state), ready for the next run.