This domain hosted MalwareConfig.com, an open configuration-extraction service operated by Kevin Breen between 2014 and 2019. At its peak the service indexed 25,473 malware configs across families like njRat, DarkComet, Xtreme RAT, adWind, Dridex, NanoCore, and Pony.
The original service is no longer running. This archive preserves what it was, links to the projects that filled the gap, and runs an occasional technical writeup on the same kinds of questions the service answered: how do these families store their config, and how do you extract it without running the sample?
The historical subdomains have their own pages: aptnotes, viper, dridex.
writeups
- APT reports in the post-APTNotes era: how the open-source threat-intel archive ecosystem works in 2026
- What I miss about the 2010s malware analysis web
- Modern stealer config formats: how Lumma, Atomic, and DanaBot store their C2 data
- What I use instead of malwareconfig.com (notes from the new operator)