MalwareBazaar

Details

ID	`MalwareBazaar`
Provider	Open Source
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the Infosec community, AV vendors, and threat intelligence providers.
This integration was integrated and tested with version 1 of MalwareBazaar

Configure MalwareBazaar in Cortex

Parameter	Description	Required
Server URL	This is the API endpoint for the MalwareBazaar API.	True
API Key	API key is required.	True
Source Reliability	Reliability of the source providing the intelligence data.	True
Use system proxy settings		False
Trust any certificate (not secure)		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

file

Check if a particular malware sample is known to MalwareBazaar.

Base Command

file

Input

Argument Name	Description	Required
file	A list of SHA256, MD5, or SHA1 hashes of the malware samples you want to query.	Required

Context Output

Path	Type	Description
MalwareBazaar.File.sha256_hash	String	SHA256 hash of the malware sample.
MalwareBazaar.File.sha3_384_hash	String	SHA3-384 hash of the malware sample.
MalwareBazaar.File.sha1_hash	String	SHA1 hash of the malware sample.
MalwareBazaar.File.md5_hash	String	MD5 hash of the malware sample.
MalwareBazaar.File.first_seen	Date	Timestamp of when the file was first seen by MalwareBazaar in UTC format.
MalwareBazaar.File.last_seen	Date	Timestamp of when the file was last seen by MalwareBazaar in UTC format.
MalwareBazaar.File.file_name	String	Malware sample’s file name.
MalwareBazaar.File.file_size	Number	Malware sample’s file size in bytes.
MalwareBazaar.File.file_type_mime	String	Malware samples’s MIME file type.
MalwareBazaar.File.file_type	String	Malware sample’s file type.
MalwareBazaar.File.reporter	String	Twitter handle of the report (or anonymous for anonymous submissions).
MalwareBazaar.File.origin_country	String	Two letter country code of the country where the sample was uploaded from.
MalwareBazaar.File.anonymous	Number	Whether the submission of the sample was anonymous - 1 (true) or 0 (false).
MalwareBazaar.File.signature	String	Malware family (if available).
MalwareBazaar.File.imphash	String	Import hash (imphash) (only available for Portable Executables).
MalwareBazaar.File.tlsh	String	Trend Micro Locality Sensitive Hash (tlsh).
MalwareBazaar.File.telfhash	String	Trend Micro ELF Hash (telfhash).
MalwareBazaar.File.ssdeep	String	The SSDeep hash of the file.
MalwareBazaar.File.dhash_icon	Unknown	In case the file is a Portable Executable, the dhash of the sample’s icon.
MalwareBazaar.File.comment	String	Comment in the malware sample.
MalwareBazaar.File.tags	String	List of tags in the malware sample.
MalwareBazaar.File.code_sign.subject_cn	String	Subject common name (CN).
MalwareBazaar.File.code_sign.issuer_cn	String	Issuer common name (CN).
MalwareBazaar.File.code_sign.algorithm	String	Algorithm used.
MalwareBazaar.File.code_sign.valid_from	Date	Datetime from which the code sign was valid.
MalwareBazaar.File.code_sign.valid_to	Date	Datetime until which the code sign was valid (expiry date).
MalwareBazaar.File.code_sign.serial_number	String	Serial number of the code sign.
MalwareBazaar.File.code_sign.cscb_listed	String	Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB).
MalwareBazaar.File.code_sign.cscb_reason	String	Code Signing Certificate Blocklist (CSCB) listing reason.
MalwareBazaar.File.delivery_method	String	How the file was distributed.
MalwareBazaar.File.file_information	Unknown	Contextual information about the file sample.
MalwareBazaar.File.yara_rules.rule_name	String	Name of the YARA rule that triggered the malware.
MalwareBazaar.File.yara_rules.author	String	Author of the YARA rule.
MalwareBazaar.File.yara_rules.description	String	Description of the YARA rule.
MalwareBazaar.File.yara_rules.reference	Unknown	Reference of the YARA rule.
MalwareBazaar.File.vendor_intel.ANY.RUN	Unknown	Dynamic malware analysis from ANY.RUN.
MalwareBazaar.File.vendor_intel.CAPE	Unknown	Dynamic malware analysis from CAPE sandbox.
MalwareBazaar.File.vendor_intel.CERT-PL_MWDB	Unknown	Threat intel from CERT.PL Malware database.
MalwareBazaar.File.vendor_intel.vxCube	Unknown	Dynamic malware analysis from Dr.Web vxCube.
MalwareBazaar.File.vendor_intel.DocGuard	Unknown	Office document reputation from DocGuad.
MalwareBazaar.File.vendor_intel.FileScan-IO	Unknown	Malware analysis service from FileScan.IO.
MalwareBazaar.File.vendor_intel.InQuest Labs	Unknown	File reputation service from InQuest Labs.
MalwareBazaar.File.vendor_intel.Intezer	Unknown	Code analysis from Intezer.
MalwareBazaar.File.vendor_intel.ReversingLabs	Unknown	File reputation and intelligence from ReversingLabs TitaniumCloud.
MalwareBazaar.File.vendor_intel.Spamhaus_HBL	Unknown	File reputation from Spamhaus Hash Blocklist (HBL).
MalwareBazaar.File.vendor_intel.Triage	Unknown	Dynamic malware analysis from Hatching Triage.
MalwareBazaar.File.vendor_intel.UnpacMe	Unknown	Malware unpacking service from UnpacMe.
MalwareBazaar.File.vendor_intel.VMRay	Unknown	Dynamic malware analysis from VMRay.
MalwareBazaar.File.vendor_intel.YOROI_YOMI	Unknown	Dynamic malware analysis from YOROI YOMI.
MalwareBazaar.File.comments.id	String	Unique ID that identifies this comment.
MalwareBazaar.File.comments.date_added	Date	Timestamp (UTC) of when this comment was made.
MalwareBazaar.File.comments.twitter_handle	String	Twitter handle who wrote this comment.
MalwareBazaar.File.comments.display_name	String	Twitter display name.
MalwareBazaar.File.comments.comment	String	The comment itself.
DBotScore.Indicator	String	The indicator that was tested.
DBotScore.Score	Number	The actual score.
DBotScore.Type	String	The indicator type.
DBotScore.Vendor	String	The vendor used to calculate the score.
DBotScore.Reliability	String	The reliability of the vendor.
File.MD5	String	MD5 hash of the file submitted for analysis.
File.SHA1	String	SHA1 hash of the file submitted for analysis.
File.SHA256	String	SHA256 hash of the file submitted for analysis.
File.Size	String	Size of the file submitted for analysis.
File.Malicious.Vendor	String	For malicious files, the vendor that made the decision.
File.Malicious.Description	String	For malicious files, the reason that the vendor made the decision.
File.Relationships.EntityA	String	The source of the relationship.
File.Relationships.EntityB	String	The destination of the relationship.
File.Relationships.Relationship	String	The name of the relationship.
File.Relationships.EntityAType	String	The type of the source of the relationship.
File.Relationships.EntityBType	String	The type of the destination of the relationship.

Command Example

!file file=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d

Context Example

{
    "DBotScore": {
        "Indicator": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
        "Reliability": "A - Completely reliable",
        "Score": 3,
        "Type": "file",
        "Vendor": "MalwareBazaar"
    },
    "File": {
        "MD5": "1232f6432c5af8d10b04caed90d410ec7ad",
        "Malicious": {
            "Description": null,
            "Vendor": "MalwareBazaar"
        },
        "Relationships": [
            {
                "EntityA": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
                "EntityAType": "File",
                "EntityB": "AgentTesla",
                "EntityBType": "Malware",
                "Relationship": "indicator-of"
            }
        ],
        "SHA1": "1234b1fc10818dd534922feef4d521eb3574337e3c0",
        "SHA256": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
        "Size": 472064,
        "Type": "exe"
    },
    "MalwareBazaar": {
        "File": {
            "anonymous": 0,
            "code_sign": null,
            "comment": null,
            "comments": [
                {
                    "comment": "test",
                    "date_added": "2021-09-26 07:07:00",
                    "display_name": "mr tall",
                    "id": "25397",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-09-26 08:16:59",
                    "display_name": "mr tall",
                    "id": "25405",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "Swiss chocolate is the best chocolate",
                    "date_added": "2021-09-26 14:57:36",
                    "display_name": "mr tall",
                    "id": "25412",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-09-29 15:10:09",
                    "display_name": "mr tall",
                    "id": "25689",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test new",
                    "date_added": "2021-10-03 10:53:34",
                    "display_name": "mr tall",
                    "id": "25968",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-03 11:03:32",
                    "display_name": "mr tall",
                    "id": "25978",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-04 09:07:37",
                    "display_name": "mr tall",
                    "id": "26069",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test new",
                    "date_added": "2021-10-04 11:15:43",
                    "display_name": "mr tall",
                    "id": "26098",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test new",
                    "date_added": "2021-10-04 11:15:58",
                    "display_name": "mr tall",
                    "id": "26099",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-04 11:26:47",
                    "display_name": "mr tall",
                    "id": "26100",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-04 12:11:40",
                    "display_name": "mr tall",
                    "id": "26106",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-04 12:41:08",
                    "display_name": "mr tall",
                    "id": "26109",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-05 08:20:09",
                    "display_name": "mr tall",
                    "id": "26169",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test_module",
                    "date_added": "2021-10-05 13:56:59",
                    "display_name": "mr tall",
                    "id": "26190",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test_module",
                    "date_added": "2021-10-05 14:06:40",
                    "display_name": "mr tall",
                    "id": "26194",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-05 15:14:51",
                    "display_name": "mr tall",
                    "id": "26200",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-05 15:16:17",
                    "display_name": "mr tall",
                    "id": "26201",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-06 14:42:17",
                    "display_name": "mr tall",
                    "id": "26263",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 07:13:43",
                    "display_name": "mr tall",
                    "id": "26325",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 07:16:53",
                    "display_name": "mr tall",
                    "id": "26326",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 07:17:36",
                    "display_name": "mr tall",
                    "id": "26327",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 07:43:28",
                    "display_name": "mr tall",
                    "id": "26328",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 07:46:45",
                    "display_name": "mr tall",
                    "id": "26329",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 11:39:00",
                    "display_name": "mr tall",
                    "id": "26353",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 11:39:55",
                    "display_name": "mr tall",
                    "id": "26354",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 11:41:41",
                    "display_name": "mr tall",
                    "id": "26355",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 11:50:55",
                    "display_name": "mr tall",
                    "id": "26356",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 12:19:14",
                    "display_name": "mr tall",
                    "id": "26357",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 13:11:26",
                    "display_name": "mr tall",
                    "id": "26361",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-07 15:44:49",
                    "display_name": "mr tall",
                    "id": "26367",
                    "twitter_handle": "tiulog"
                },
                {
                    "comment": "test",
                    "date_added": "2021-10-10 09:17:58",
                    "display_name": "mr tall",
                    "id": "26633",
                    "twitter_handle": "tiulog"
                }
            ],
            "delivery_method": null,
            "dhash_icon": null,
            "file_information": null,
            "file_name": "COPY-SCANB840284-IMG-2020-13-02-DOCUMENT-PDF.exe",
            "file_size": 472064,
            "file_type": "exe",
            "file_type_mime": "application/x-dosexec",
            "first_seen": "2020-02-13 11:55:46",
            "imphash": "123f34d5f2d4577ed6d9ceec516c1f5a744",
            "intelligence": {
                "clamav": [
                    "SecuriteInfo.com.Trojan.PackedNET.211.15710.28159.UNOFFICIAL"
                ],
                "downloads": "2596",
                "mail": null,
                "uploads": "2"
            },
            "last_seen": "2021-06-02 16:06:57",
            "md5_hash": "2f6432c5af8d10b04caed90d410ec7ad",
            "ole_information": [],
            "origin_country": "CH",
            "reporter": "abuse_ch",
            "sha1_hash": "1234b1fc10818dd534922feef4d521eb3574337e3c0",
            "sha256_hash": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
            "sha3_384_hash": "11239ae5c4841f72a91eb66db9191d879a33cf87e69f07809105d25de6aa90fbce69c9e795a4a0b984bd33537502361bb9b",
            "signature": "AgentTesla",
            "ssdeep": "12288:GCU4gtAxIflaBAFGWf1yN6OcsiUIpqpcsHs4d8/U:MwIflaBaIH2Us69d88",
            "tags": [
                "AgentTesla",
                "exe"
            ],
            "telfhash": null,
            "tlsh": "65A4BF181BB98C13F54BA6BAC4D942C9E2FCD57B8907F759D41129D60F0ABA7AC023C7",
            "vendor_intel": {
                "ReversingLabs": {
                    "first_seen": "2020-02-14 04:28:36",
                    "scanner_count": "31",
                    "scanner_match": "26",
                    "scanner_percent": "83.87",
                    "status": "MALICIOUS",
                    "threat_name": "ByteCode-MSIL.Trojan.Kryptik"
                },
                "Spamhaus_HBL": [
                    {
                        "detection": "malicious",
                        "link": "https://www.test.com"
                    }
                ],
                "Triage": {
                    "link": "https://tria.ge/reports/201109-7p6mxbz6r2/",
                    "malware_config": [],
                    "malware_family": "agenttesla",
                    "score": "10",
                    "signatures": [
                        {
                            "score": "10",
                            "signature": "AgentTesla"
                        },
                        {
                            "score": "9",
                            "signature": "AgentTesla Payload"
                        },
                        {
                            "score": "7",
                            "signature": "Reads data files stored by FTP clients"
                        },
                        {
                            "score": "7",
                            "signature": "Reads user/profile data of local email clients"
                        },
                        {
                            "score": "7",
                            "signature": "Reads user/profile data of web browsers"
                        },
                        {
                            "score": "6",
                            "signature": "Adds Run key to start application"
                        },
                        {
                            "score": "6",
                            "signature": "Looks up external IP address via web service"
                        },
                        {
                            "score": "5",
                            "signature": "Suspicious use of SetThreadContext"
                        },
                        {
                            "score": null,
                            "signature": "Suspicious behavior: EnumeratesProcesses"
                        },
                        {
                            "score": null,
                            "signature": "Suspicious behavior: MapViewOfSection"
                        },
                        {
                            "score": null,
                            "signature": "Suspicious use of AdjustPrivilegeToken"
                        },
                        {
                            "score": null,
                            "signature": "Suspicious use of SetWindowsHookEx"
                        },
                        {
                            "score": null,
                            "signature": "Suspicious use of WriteProcessMemory"
                        }
                    ],
                    "tags": [
                        "family:agenttesla",
                        "keylogger",
                        "persistence",
                        "spyware",
                        "stealer",
                        "trojan"
                    ]
                },
                "YOROI_YOMI": {
                    "detection": "Unknown",
                    "score": "1.00"
                }
            },
            "yara_rules": [
                {
                    "author": "JPCERT/CC Incident Response Group",
                    "description": "detect Agenttesla in memory",
                    "reference": "internal research",
                    "rule_name": "Agenttesla_type2"
                },
                {
                    "author": "Brian C. Bell -- @biebsmalwareguy",
                    "description": null,
                    "reference": "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar",
                    "rule_name": "CAP_HookExKeylogger"
                },
                {
                    "author": "Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>",
                    "description": null,
                    "reference": null,
                    "rule_name": "win_agent_tesla_g2"
                }
            ]
        }
    }
}

Human Readable Output

MalwareBazaar File reputation for: 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d

Md5 Hash Sha256 Hash Sha1 Hash File Name File Type File Size Tags First Seen Last Seen Signature Ssdeep Reporter Imphash Yara Rules Names

2f6432c5af8d10b04caed90d410ec7ad 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d 4b1fc10818dd534922feef4d521eb3574337e3c0 COPY-SCANB840284-IMG-2020-13-02-DOCUMENT-PDF.exe exe 472064 AgentTesla,
exe 2020-02-13 11:55:46 2021-06-02 16:06:57 AgentTesla 12288:GCU4gtAxIflaBAFGWf1yN6OcsiUIpqpcsHs4d8/U:MwIflaBaIH2Us69d88 abuse_ch f34d5f2d4577ed6d9ceec516c1f5a744 Agenttesla_type2,
CAP_HookExKeylogger,
win_agent_tesla_g2

Md5 Hash	Sha256 Hash	Sha1 Hash	File Name	File Type	File Size	Tags	First Seen	Last Seen	Signature	Ssdeep	Reporter	Imphash	Yara Rules Names
2f6432c5af8d10b04caed90d410ec7ad	094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d	4b1fc10818dd534922feef4d521eb3574337e3c0	COPY-SCANB840284-IMG-2020-13-02-DOCUMENT-PDF.exe	exe	472064	AgentTesla, exe	2020-02-13 11:55:46	2021-06-02 16:06:57	AgentTesla	12288:GCU4gtAxIflaBAFGWf1yN6OcsiUIpqpcsHs4d8/U:MwIflaBaIH2Us69d88	abuse_ch	f34d5f2d4577ed6d9ceec516c1f5a744	Agenttesla_type2, CAP_HookExKeylogger, win_agent_tesla_g2

malwarebazaar-download-sample

Download a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password “infected” (without “”).

Base Command

malwarebazaar-download-sample

Input

Argument Name	Description	Required
sha256_hash	SHA256 hash of the malware sample to download.	Required

Context Output

Path	Type	Description
File.Size	String	The size of the file.
File.SHA1	String	The SHA1 hash of the file.
File.SHA256	String	The SHA256 hash of the file.
File.SHA512	String	The SHA512 hash of the file.
File.Name	String	The name of the file.
File.SSDeep	String	The SSDeep hash of the file.
File.EntryID	String	Entry ID of the file.
File.Info	String	Information about the file.
File.Type	String	The file type.
File.MD5	String	The MD5 hash of the file.
File.Extension	String	The extension of the file.

Command Example

!malwarebazaar-download-sample sha256_hash=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78

Context Example

{
    "File": {
        "EntryID": "7712@e99f97d1-7225-4c75-896c-3c960febbe8c",
        "Extension": "zip",
        "Info": "application/zip",
        "MD5": "12323c96a2ba1a4d7cd8d179641aac32f0d",
        "Name": "094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78.zip",
        "SHA1": "123b11025b4d625079d201ac9ba0552291a60be9c1e",
        "SHA256": "123d727a2f40a5151d7a0e3bf9ebf77a8bf17a965505eb6db68080a38330c3fb743",
        "SHA512": "12349f45537621ac26e7c5d7fea643fba27153070a52b8ebc56cab7e8522f5d8087697be6df969e9cfac74cefddceb6271aae1796f819fa3f405f909e3a488e4d18",
        "SSDeep": "1233:HzH1IOH0Wp6FYn:Hr1I2xaY",
        "Size": 45,
        "Type": "JSON data"
    }
}

Human Readable Output

malwarebazaar-comment-add

Add a comment for a malware sample.

Base Command

malwarebazaar-comment-add

Input

Argument Name	Description	Required
sha256_hash	SHA256 hash of the malware sample to add a comment.	Required
comment	The comment to add to the sample.	Required

Context Output

Path	Type	Description
MalwareBazaar.MalwarebazaarCommentAdd.sha256_hash	String	SHA256 hash of given file.
MalwareBazaar.MalwarebazaarCommentAdd.comment	String	The comment that was added to the malware sample.

Command Example

!malwarebazaar-comment-add comment="test" sha256_hash=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d

Context Example

{
    "MalwareBazaar": {
        "MalwarebazaarCommentAdd": {
            "comment": "test",
            "sha256_hash": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d"
        }
    }
}

Human Readable Output

Comment added to 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d malware sample successfully

malwarebazaar-samples-list

Retrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument.

Base Command

malwarebazaar-samples-list

Input

Argument Name	Description	Required
sample_type	Type of the sample. Possible values are: tag, signature, file_type, clamav, imphash, yara_rule, issuer_cn.	Required
sample_value	Value of the sample selected.	Required
limit	Maximum number of results to return. Default is 1000. Note that when using the issuer_cn argument, all relevant results will display (maximum 100).	Optional
page	Page number to view. Each page contains page_size values. Must be used along with the page_size argument.	Optional
page_size	Number of results per page to display.	Optional

Context Output

Path	Type	Description
MalwareBazaar.MalwarebazaarSamplesList.sha256_hash	String	SHA256 hash of the malware sample.
MalwareBazaar.MalwarebazaarSamplesList.sha3_384_hash	String	SHA3-384 hash of the malware sample.
MalwareBazaar.MalwarebazaarSamplesList.sha1_hash	String	SHA1 hash of the malware sample.
MalwareBazaar.MalwarebazaarSamplesList.md5_hash	String	MD5 hash of the malware sample.
MalwareBazaar.MalwarebazaarSamplesList.first_seen	Date	Timestamp of when the file was first seen by MalwareBazaar (UTC).
MalwareBazaar.MalwarebazaarSamplesList.last_seen	Date	Timestamp of when the file was last seen by MalwareBazaar (UTC).
MalwareBazaar.MalwarebazaarSamplesList.file_name	String	Malware sample’s file name.
MalwareBazaar.MalwarebazaarSamplesList.file_size	Number	File size in bytes.
MalwareBazaar.MalwarebazaarSamplesList.file_type_mime	String	MIME file type.
MalwareBazaar.MalwarebazaarSamplesList.file_type	String	File type.
MalwareBazaar.MalwarebazaarSamplesList.reporter	String	Twitter handle of the report (or anonymous for anonymous submissions).
MalwareBazaar.MalwarebazaarSamplesList.anonymous	Number	Whether the submission of the sample was anonymous - 1 (true) or 0 (false).
MalwareBazaar.MalwarebazaarSamplesList.signature	String	Malware family (if available).
MalwareBazaar.MalwarebazaarSamplesList.imphash	String	Import hash (imphash) of the sample (only available for Portable Executables).
MalwareBazaar.MalwarebazaarSamplesList.tlsh	String	Trend Micro Locality Sensitive Hash (tlsh) of the sample.
MalwareBazaar.MalwarebazaarSamplesList.telfhash	String	Trend Micro ELF Hash (telfhash) of the sample.
MalwareBazaar.MalwarebazaarSamplesList.ssdeep	String	The SSDeep hash of the sample.
MalwareBazaar.MalwarebazaarSamplesList.dhash_icon	Unknown	In case the file is a Portable Executable, the dhash of the samples icon.
MalwareBazaar.MalwarebazaarSamplesList.tags	String	List of tags.
MalwareBazaar.MalwarebazaarSamplesList.code_sign.subject_cn	String	Subject common name (CN).
MalwareBazaar.MalwarebazaarSamplesList.code_sign.issuer_cn	String	Issuer common name (CN).
MalwareBazaar.MalwarebazaarSamplesList.code_sign.algorithm	String	Algorithm used.
MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_from	Date	Datetime from which the code sign was valid.
MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_to	Date	Datetime until which the code sign was valid (expiry date).
MalwareBazaar.MalwarebazaarSamplesList.code_sign.serial_number	String	Serial number of the code sign.
MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_listed	String	Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB).
MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_reason	String	Code Signing Certificate Blocklist (CSCB) listing reason.
MalwareBazaar.MalwarebazaarSamplesList.intelligence.clamav	String	List of ClamAV detections (official and unofficial rules).
MalwareBazaar.MalwarebazaarSamplesList.intelligence.downloads	Number	Number of downloads from MalwareBazaar.
MalwareBazaar.MalwarebazaarSamplesList.intelligence.uploads	Number	Number of uploads to MalwareBazaar.
MalwareBazaar.MalwarebazaarSamplesList.intelligence.mail	String	Indicates if this malware sample has been seen in global spam traffic.

Command Example

!malwarebazaar-samples-list sample_type=tag sample_value=TrickBot limit=2

Context Example

{
    "MalwareBazaar": {
        "MalwarebazaarSamplesList": [
            {
                "anonymous": 0,
                "code_sign": [],
                "dhash_icon": "0000000000000000",
                "file_name": "ee566f0e04b497770c5baa4de14c416f.exe",
                "file_size": 656384,
                "file_type": "exe",
                "file_type_mime": "application/x-dosexec",
                "first_seen": "2021-11-07 08:38:51",
                "imphash": "2a49715e49b2891839bf716e121ca434",
                "intelligence": {
                    "clamav": [
                        "SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL"
                    ],
                    "downloads": "92",
                    "mail": null,
                    "uploads": "1"
                },
                "last_seen": null,
                "md5_hash": "ee566f0e04b497770c5baa4de14c416f",
                "reporter": "abuse_ch",
                "sha1_hash": "98f77caf24f14dca0fa163596a730269037f2065",
                "sha256_hash": "06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9",
                "sha3_384_hash": "84f65cac42470c9f3920019b8fb60f3975be1c0528c180a180839b60198b36de966f6cae2aabf532b3c5c777dd75a027",
                "signature": "TrickBot",
                "ssdeep": "12288:InZndx1krxFPqBSPcLQuDACflBMhhDKG/M:AZdxuQSP/u8Qm5J",
                "tags": [
                    "exe",
                    "TrickBot"
                ],
                "telfhash": null,
                "tlsh": "T115D4E0103390C032D5A324718A69DBB58E7EB861676275CF3BD91E7E5F24AD1EA3430E"
            },
            {
                "anonymous": 0,
                "code_sign": [],
                "dhash_icon": "0000000000000000",
                "file_name": "7425c5e4bd0f910f80a1ab456b68e192.exe",
                "file_size": 656896,
                "file_type": "exe",
                "file_type_mime": "application/x-dosexec",
                "first_seen": "2021-11-07 08:35:14",
                "imphash": "2a49715e49b2891839bf716e121ca434",
                "intelligence": {
                    "clamav": [
                        "SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL"
                    ],
                    "downloads": "90",
                    "mail": null,
                    "uploads": "1"
                },
                "last_seen": null,
                "md5_hash": "7425c5e4bd0f910f80a1ab456b68e192",
                "reporter": "abuse_ch",
                "sha1_hash": "dbd26c846e03f94aa1451b6b73e1fa138ea5a953",
                "sha256_hash": "3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437",
                "sha3_384_hash": "b5ae6ff44057229fbc1af7e68527ebc5cb4f018c9cbfe20a06c8594c401ab708a4d9a7fc69fa10929365695c11f01ca7",
                "signature": "TrickBot",
                "ssdeep": "12288:5nZndx1krxFPqBSPw7bQ9k03GxGprGwbKM:9ZdxuQSPw72k034GJGf",
                "tags": [
                    "exe",
                    "TrickBot"
                ],
                "telfhash": null,
                "tlsh": "T12FD4E0213290C032D1A324718E66DBB98E7EB861775265CF3BD90E7D4F24BD1EA3531A"
            }
        ]
    }
}

Human Readable Output

Sample List

Md5 Hash Sha256 Hash Sha1 Hash File Name File Type File Size Tags First Seen

ee566f0e04b497770c5baa4de14c416f 06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9 98f77caf24f14dca0fa163596a730269037f2065 ee566f0e04b497770c5baa4de14c416f.exe exe 656384 exe,
TrickBot 2021-11-07 08:38:51

7425c5e4bd0f910f80a1ab456b68e192 3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437 dbd26c846e03f94aa1451b6b73e1fa138ea5a953 7425c5e4bd0f910f80a1ab456b68e192.exe exe 656896 exe,
TrickBot 2021-11-07 08:35:14

Md5 Hash	Sha256 Hash	Sha1 Hash	File Name	File Type	File Size	Tags	First Seen
ee566f0e04b497770c5baa4de14c416f	06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9	98f77caf24f14dca0fa163596a730269037f2065	ee566f0e04b497770c5baa4de14c416f.exe	exe	656384	exe, TrickBot	2021-11-07 08:38:51
7425c5e4bd0f910f80a1ab456b68e192	3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437	dbd26c846e03f94aa1451b6b73e1fa138ea5a953	7425c5e4bd0f910f80a1ab456b68e192.exe	exe	656896	exe, TrickBot	2021-11-07 08:35:14

Create an API Key

Sign up for an abuse.ch account by using an existing account that you may already have on X, LinkedIn, Google or Github. Just log in with the authentication provider of your choice here: https://auth.abuse.ch/
Once you’ve logged in to abuse.ch, add at least one more way to log in. This helps ensure you can always access our platforms, even if one of your login methods stops working.
Click the Save profile button. In the Optional section, you can now create an Auth-Key. This is your personal authentication key that you can use to query any abuse.ch APIs.

If you already have a profile, you only need to follow step 3. There’s nothing further to do for your authentication set up.

Configuration parameters

url — Server URL (required)
credentials —
integrationReliability — Source Reliability (required)
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)

Commands (4)

file
Check if a particular malware sample is known to MalwareBazaar.
malwarebazaar-comment-add
Add a comment for a malware sample.
malwarebazaar-download-sample
Download a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password "infected" (without "").
malwarebazaar-samples-list
Retrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument.

Source

MalwareBazaar.py MalwareBazaar_test.py MalwareBazaar.yml MalwareBazaar_description.md command_examples.txt

Download History Raw

import copy

import demistomock as demisto  # noqa: F401
import urllib3
from CommonServerPython import *  # noqa: F401

QUERIES = {
    "tag": "get_taginfo",
    "signature": "get_siginfo",
    "file_type": "get_file_type",
    "clamav": "get_clamavinfo",
    "imphash": "get_imphash",
    "yara_rule": "get_yarainfo",
    "issuer_cn": "get_issuerinfo",
}

EXCEPTIONS_MESSAGES = {
    "illegal_sha256_hash": "Illegal SHA256 hash provided.",
    "file_not_found": "The file was not found or is unknown to MalwareBazaar.",
    "hash_not_found": "The file (hash) you wanted to query is unknown to MalwareBazaar.",
    "illegal_hash": "The hash you provided is not a valid SHA256 hash.",
    "user_blacklisted": "Your API key is blacklisted.",
    "no_results": "Your query yield no results.",
    "not_found": "Tha value you wanted to query is unknown to MalwareBazaar.",
    "illegal": "The text you provided is not valid.",
}

VENDOR_NAME = "MalwareBazaar"

LIST_HEADERS = ["md5_hash", "sha256_hash", "sha1_hash", "file_name", "file_type", "file_size", "tags", "first_seen", "last_seen"]

FILE_HEADERS = [
    "md5_hash",
    "sha256_hash",
    "sha1_hash",
    "file_name",
    "file_type",
    "file_size",
    "tags",
    "first_seen",
    "last_seen",
    "signature",
    "ssdeep",
    "reporter",
    "imphash",
    "yara_rules_names",
]


class Client(BaseClient):
    def __init__(self, server_url, verify, proxy, headers, api_key):
        self.api_key = api_key
        super().__init__(base_url=server_url, verify=verify, proxy=proxy, headers=headers)

    def file_request(self, hash):
        response = self._http_request("POST", files={"query": (None, "get_info"), "hash": (None, hash)})
        return response

    def malwarebazaar_download_sample_request(self, sha256_hash):
        response = self._http_request(
            "POST", files={"query": (None, "get_file"), "sha256_hash": (None, sha256_hash)}, resp_type="response"
        )
        return response

    def malwarebazaar_comment_add_request(self, sha256_hash, comment):
        if self.api_key is None:
            raise Exception("API Key is required for this command")
        response = self._http_request(
            "POST",
            files={"query": (None, "add_comment"), "sha256_hash": (None, sha256_hash), "comment": (None, comment)},
        )
        return response

    def malwarebazaar_samples_list_request(self, sample_input, value, limit, query):
        files = {
            "query": (None, query),
            sample_input: (None, value),
        }
        if sample_input != "issuer_cn":
            files.update({"limit": (None, limit)})
        response = self._http_request("POST", files=files)
        return response


def file_process(hash, reliability, raw_response, response_data) -> CommandResults:
    """
    creates CommandResults for every file in the list inserted to file_command
    Args:
        hash:
        raw_response:
        response_data:

    Returns:
    CommandResults for the relevant file
    """
    dbot_score = Common.DBotScore(
        indicator=hash,
        indicator_type=DBotScoreType.FILE,
        integration_name=VENDOR_NAME,
        score=Common.DBotScore.BAD,
        reliability=reliability,
        malicious_description=response_data.get("comment"),
    )

    signature = response_data.get("signature")
    relationship = EntityRelationship(
        name="indicator-of",
        entity_a=hash,
        entity_a_type="File",
        entity_b=signature,
        entity_b_type=FeedIndicatorType.indicator_type_by_server_version("STIX Malware"),
        source_reliability=reliability,
        brand=VENDOR_NAME,
    )

    table_name = f"{VENDOR_NAME} File reputation for: {hash}"

    humam_readable_data = copy.deepcopy(response_data)
    humam_readable_data.update({"yara_rules_names": []})
    rules = humam_readable_data.get("yara_rules", [])
    rules = rules if rules else []
    for rule in rules:
        humam_readable_data.get("yara_rules_names").append(rule.get("rule_name"))

    md = tableToMarkdown(
        table_name, t=humam_readable_data, headerTransform=string_to_table_header, removeNull=True, headers=FILE_HEADERS
    )

    file_object = Common.File(
        md5=response_data.get("md5_hash"),
        sha256=response_data.get("sha256_hash"),
        sha1=response_data.get("sha1_hash"),
        size=response_data.get("file_size"),
        file_type=response_data.get("file_type"),
        dbot_score=dbot_score,
        relationships=[relationship],
    )

    return CommandResults(
        outputs_prefix="MalwareBazaar.File",
        outputs_key_field="md5_hash",
        outputs=response_data,
        raw_response=raw_response,
        indicator=file_object,
        relationships=[relationship],
        readable_output=md,
    )


def check_query_status(response, is_list_command=False, sample_type=None):
    """
    checks whether the request to the API returned with the proper result
    Args:
        sample_type: string, type of sample (tag, signature, etc.)
        is_list_command: bool
        response: response from API

    """
    not_found_error = "_not_found"
    illegal_error = "illegal_"
    query_status = response.get("query_status")
    if query_status != "ok" and query_status != "success":
        if is_list_command:
            if query_status == sample_type + not_found_error:
                raise Exception(EXCEPTIONS_MESSAGES.get("not_found"))
            if query_status == sample_type + illegal_error:
                raise Exception(EXCEPTIONS_MESSAGES.get("illegal"))
        if query_status in EXCEPTIONS_MESSAGES:
            raise Exception(EXCEPTIONS_MESSAGES.get(query_status))
        else:
            raise Exception(query_status)


def file_command(client: Client, args: Dict[str, Any]) -> List[CommandResults]:
    """

    Args:
        client:
        args: file - list of files hash

    Returns:
        file reputation for the given hashes
    """

    reliability = demisto.params().get("integrationReliability", DBotScoreReliability.A)
    if DBotScoreReliability.is_valid_type(reliability):
        reliability = DBotScoreReliability.get_dbot_score_reliability_from_str(reliability)
    else:
        raise Exception("Please provide a valid value for the Source Reliability parameter.")

    file_list = argToList(args.get("file"))
    command_results: List[CommandResults] = []
    for hash in file_list:
        raw_response = client.file_request(hash)
        if raw_response.get("query_status") == "hash_not_found":
            command_results.append(create_indicator_result_with_dbotscore_unknown(hash, DBotScoreType.FILE, reliability))
        else:
            check_query_status(raw_response)
            response_data = raw_response.get("data")[0]
            if file_name := response_data.get("file_name"):
                response_data["file_name"] = "" if file_name == "file" else file_name
            command_results.append(file_process(hash, reliability, raw_response, response_data))
    return command_results


def malwarebazaar_download_sample_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    """

    Args:
        client:
        args: sha256_hash of file

    Returns:
        zip file contains the malware sample from MalwareBazaar
    """
    sha256_hash = args.get("sha256_hash")
    response = client.malwarebazaar_download_sample_request(sha256_hash)
    filename = f"{sha256_hash}.zip"
    return fileResult(filename, response.content)


def malwarebazaar_comment_add_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    """

    Args:
        client:
        args: sha256_hash of file, comment to add in context of this file

    Returns:
        query status of the request to MalwareBazaar (success or error)
    """
    sha256_hash = args.get("sha256_hash")
    comment = args.get("comment")
    response = client.malwarebazaar_comment_add_request(sha256_hash, comment)
    check_query_status(response)

    readable_output = f"Comment added to {sha256_hash} malware sample successfully"
    outputs = {
        "sha256_hash": sha256_hash,
        "comment": comment,
    }
    return CommandResults(
        outputs_prefix="MalwareBazaar.MalwarebazaarCommentAdd",
        outputs_key_field="sha256_hash",
        outputs=outputs,
        readable_output=readable_output,
        raw_response=response,
    )


def malwarebazaar_samples_list_command(client: Client, args: Dict[str, Any]) -> CommandResults:
    """

    Args:
        client:
        args: sample_type - {clamav, file_type, imphash, signature, tag, yara_rule}
              sample_value
              limit (optional) - number of results (default 50)

    Returns:
        query results from API
    """
    sample_input = args.get("sample_type") or ""
    value = args.get("sample_value")

    limit = arg_to_number(args.get("limit")) if "limit" in args else None
    page = arg_to_number(args.get("page")) if "page" in args else None
    page_size = arg_to_number(args.get("page_size")) if "page_size" in args else None

    # # if limit was provided, request limit results from api, else, use pagination (if nothing is used 50 results will
    # # be requested as default)
    if limit is None:
        if page is not None and page_size is not None:
            if page <= 0:
                raise Exception("Chosen page number must be greater than 0")
            limit = page_size * page
        else:
            limit = 50

    # # 1000 is the maximal value we can get from tha API
    limit = min(limit, 1000)

    query = QUERIES.get(sample_input)
    response = client.malwarebazaar_samples_list_request(sample_input, value, limit, query)
    check_query_status(response, True, args.get("sample_type"))

    response_data = response.get("data")

    # take required results from response if pagination by page and page_size
    if page is not None and page_size is not None:
        response_data = response_data[-1 * page_size :]

    readable_output = tableToMarkdown(
        "Sample List", t=response_data, headerTransform=string_to_table_header, removeNull=True, headers=LIST_HEADERS
    )
    return CommandResults(
        outputs_prefix="MalwareBazaar.MalwarebazaarSamplesList",
        outputs_key_field="sha256_hash",
        readable_output=readable_output,
        outputs=response_data,
        raw_response=response,
    )


def test_module(client: Client) -> None:
    if client.api_key:
        response = client.malwarebazaar_comment_add_request(
            "094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d", "test comment"
        )
    else:
        response = client.malwarebazaar_samples_list_request("tag", "TrickBot", "2", QUERIES.get("tag"))
    check_query_status(response)
    return_results("ok")


def main() -> None:
    params: Dict[str, Any] = demisto.params()
    args: Dict[str, Any] = demisto.args()
    url = params.get("url")
    api_key = params.get("credentials", {}).get("password")
    verify_certificate: bool = not params.get("insecure", False)
    proxy = params.get("proxy", False)

    command = demisto.command()
    demisto.debug(f"Command being called is {command}")

    try:
        if not api_key:
            raise ValueError("Missing required parameter Auth Key. Please set this parameter in the instance configuration.")

        urllib3.disable_warnings()
        client: Client = Client(
            urljoin(url, "/api/v1/"), verify_certificate, proxy, headers={"Auth-Key": api_key}, api_key=api_key
        )

        commands = {
            "file": file_command,
            "malwarebazaar-download-sample": malwarebazaar_download_sample_command,
            "malwarebazaar-comment-add": malwarebazaar_comment_add_command,
            "malwarebazaar-samples-list": malwarebazaar_samples_list_command,
        }

        if command == "test-module":
            test_module(client)
        elif command in commands:
            return_results(commands[command](client, args))
        else:
            raise NotImplementedError(f"{command} command is not implemented.")

    except Exception as e:
        return_error(str(e))


if __name__ in ["__main__", "builtin", "builtins"]:
    main()