We have downloaded 1624 Windows Portable Executable (PE32) ransomware samples from virustotal.com which were reported as malicious ransomware file by RansomwareTracker.abuse.ch in the period of February 2016 to March 2017. Collected samples belong to three families of ransomware namely 517 Locky samples, 535 Cerber samples and 572 samples of TeslaCrypt. The best type of goodware counterpart for malware applications are portable and standalone benign apps. Therefore, we have collected all 220 available portable Windows PE32 benign applications
from portableapps.com in April 2017 to serve as goodware counterpart of our dataset.
To obtain raw samples please contact firstname.lastname@example.org via your academic institution email address.
- – Know Abnormal, Find Evil: Frequent Pattern Mining for Ransomware Threat Hunting and Intelligence( Paper Link ).