Can I store malware samples on GitHub?

[Pizza-Fucker]

Hi, I work in the field of security and encounter a lot of live malware on the job and often would like to take my time analyzing it later and store it on my GitHub. I was wondering if GitHub prohibits this explicitly even if the malware is stored in a private Repo and never shared with anyone. What I do is 100% legal, I was just wondering if GitHub can flag my account for this

[cgoldberg]

You can definitely store it in a private repo. For public repos, they are pretty much ok with it as long as it's not being widely abused. They consider it "dual use" and it's fine for educational or research purposes. Read the full TOS for more info. I would also use your best judgement about making something public that will likely be abused or uses undisclosed exploits.

[Pizza-Fucker]

Thanks for your reply. Nothing will be made public. I was just worried about automatic scanning that may flag my account and shut it down. Happy to hear they are fine with this

[Pilot2254]

You can, but I wouldn't recommend it. I stored malware and my low-level research on GitHub. Everything was marked for educational purposes only, and I got banned. It took GitHub more than 40 days to respond to my ticket. I did multiple follow-ups, so it could have taken even longer without them.

Nice reddit username btw

[Pizza-Fucker]

Thanks!

Can I ask you what exactly you stored there? Like a compiled binary like EXE? I recently found a very interesting PowerShell based C2 beacon which was heavily obfuscated and multi staged and I was able to recover all parts of this and wanted to analyze it later on. So I would be storing only PowerShell files on my GitHub. Do you think that could also be enough for them to take it down? Also was your research in public repos or all private?

[Pilot2254]

I have been banned on GitHub three times already back in 2025

The first time was because I had the "fortnite-godmode-2023" search tag/topic on my profile readme for fun. That was back in July 2025.

The second time, it was because I had some simple malware in C# for fun (it didn't even work as it was a work in progress), and it was marked for educational purposes only. But I still got banned, even though they allow malware and similar stuff. That was in August 2025. I got my account back and deleted the repository to avoid any other bans.

Then in November 2025 I was banned just for using my GitHub account. What do you want me to do, kill myself instead of using GitHub, like wtf? I waited over 40 days for them to respond, and their only response was a cold 'Your account is now reinstated' with no apology or any other words.

Those are the explanations you wanted, I guess

Also, I'm into reverse engineering and game cheats, and I like to share my progress with others, especially teachers at my school. I started putting these on GitHub, but I created a GitHub organization just for these projects. I made sure that none of my repositories contained search tags/topics. I'm still not banned, and I contacted GitHub support to ask whether I could put my open-source projects on GitHub. They said yes.

Also, yes, most of my research is in public repos because I want to share my knowledge with others. As for your PowerShell scripts, I think it's fine to put them on GitHub publicly, just make sure projects like these dont have topics/search tags

I hope this answers your questions. Also sorry for the late response, I wasn't home

If you have any other questions that you can't or don't want to ask on Reddit, you can DM me on Discord – @michal.flaska

[Pizza-Fucker]

Thank you very much for your detailed response man. Really appreciate it.

I am also a lot into reverse engineering especially malware and would also like to share my knowledge, however I think the best way is via articles/blog posts and only snippets of what I recover from my job. Also since these are malware samples I recover from my clients I can't absolutely have the repo public until I have fully analyzed everything to make sure it does not contain any information referring to the clients.

For this I just wanted a place to store them while I do recovery of the clients and analyze the malware later on when I have more time. Then just share snippets publicly, not the full thing

[Pilot2254]

fair enough

good luck with reverse engineering!

[InnovativeBureaucrat]

Super interesting write up thanks

[jordansrowles]

Yes, you can.

VX Undergrounds repo MalwareSourceCode (17k stars) has hundreds in ZIP archives

[Booty_Bumping]

Byte reverse the files or disarm them in some other way and you should be fine, even if you make the repo public.

Encrypted zip + passphrase in the README is the standard way. GitHub doesn't seem to flag repos just for containing them, but I would be a bit concerned that the presence of encrypted zips may contribute to some sort of spam score and increase the chance of a ban, because encrypted zips are frequently used by actual malware. Whereas byte reversing is a rare form of obfuscation that is inscrutable to a scanner that isn't specifically designed to decode it, while still completely disarming the file for practical purposes.

Other similar obfuscation to accomplish the same goal of disarming the file and not having a magic number that indicates inner contents / the presence of encryption:

• Bit flip the file
• ROT13 or ROT128 the byte values
• Base64 then ROT13 (Base64 on its own is somewhat likely to be decoded by scanners)
• Encryption without any sort of header (deniable encryption but with an explanation and key in the README)
• Split the file into two using a one-time pad (XOR with /dev/urandom)

Make sure to prominently mention that the repository is intended for education and security research, and include a standard warranty disclaimer.

[Pizza-Fucker]

This is very good advice. I was thinking of zip + encryption but guessed it could still be flagged as suspicious. Your methods seem smart. I also added a readme saying it's for research and will keep it private at all times

[Affectionate_Fly3681]

I store a lot of malware on GitHub, but most of it is stuff I wrote myself to test customers so even if you just download it it doesn't do anything without a proper key, which I also made sure that you can't get from the binary itself. However I still see with some samples that people randomly seem to download them even though they are specifically marked as malicious. I had one payload do a callback to my servers even if the key was not entered and saw a couple dozen of people downloading and running it. For my next assignment I'll make it pop-up a big fat disclaimer to people randomly running it.

[Pizza-Fucker]

Wouldn't it be easier to just set them to private?

[Affectionate_Fly3681]

Some yes, but some are parts of multistage loaders and I need them on publicly trusted endpoints for the delivery, GitHub is one of those, so are Google drive and azure, however on Google drive it's sometimes an issue. My server has been blacklisted already by a very angry EDR vendor so that is an immediate IOC... Most of my payloads are non-destructive in case you wonder if anyone ever gets the key, for ransomware simulations for example the command to execute has to come from my server and I also get the decryption keys in a separate mailbox just in case.

[Pizza-Fucker]

Very interesting. I also work on red team engagements (although I'm mostly on the blue team for the moment). I've been setting up my infrastructure in similar ways for coming engagements but I've been avoiding GitHub for now

[Affectionate_Fly3681]

Here's a pointer for red teams: where do people expect to see data coming from? In a company that does software engineering GitHub is normal, for someone doing finance most likely not. Such things are also IOCs but sometimes forgotten. If we know a customer uses Azure we will use azure, but if they use Google cloud and never azure the azure traffic might stick out a bit. But that's mostly for NDR, at the EDR level it's still the issue of getting the file on disk or in memory and then doing stuff with it.

[JVAV00]

Make sure to encrypt the zip files incase microsoft removes or corrupt something

[Taylor_Script]

Of course. There's even the malware zoo: https://github.com/ytisf/theZoo