MalwareBazaar
MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the Infosec community, AV vendors, and threat intelligence providers.
Data Enrichment & Threat Intelligence · MalwareBazaar
Details
| ID | MalwareBazaar |
|---|---|
| Provider | Open Source |
| Category | Data Enrichment & Threat Intelligence |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.12.13.10116658 |
| Supported Modules | Agentix XSIAM |
README
MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the Infosec community, AV vendors, and threat intelligence providers.
This integration was integrated and tested with version 1 of MalwareBazaar
Configure MalwareBazaar in Cortex
| Parameter | Description | Required |
|---|---|---|
| Server URL | This is the API endpoint for the MalwareBazaar API. | True |
| API Key | API key is required. | True |
| Source Reliability | Reliability of the source providing the intelligence data. | True |
| Use system proxy settings | False | |
| Trust any certificate (not secure) | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
file
Check if a particular malware sample is known to MalwareBazaar.
Base Command
file
Input
| Argument Name | Description | Required |
|---|---|---|
| file | A list of SHA256, MD5, or SHA1 hashes of the malware samples you want to query. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MalwareBazaar.File.sha256_hash | String | SHA256 hash of the malware sample. |
| MalwareBazaar.File.sha3_384_hash | String | SHA3-384 hash of the malware sample. |
| MalwareBazaar.File.sha1_hash | String | SHA1 hash of the malware sample. |
| MalwareBazaar.File.md5_hash | String | MD5 hash of the malware sample. |
| MalwareBazaar.File.first_seen | Date | Timestamp of when the file was first seen by MalwareBazaar in UTC format. |
| MalwareBazaar.File.last_seen | Date | Timestamp of when the file was last seen by MalwareBazaar in UTC format. |
| MalwareBazaar.File.file_name | String | Malware sample’s file name. |
| MalwareBazaar.File.file_size | Number | Malware sample’s file size in bytes. |
| MalwareBazaar.File.file_type_mime | String | Malware samples’s MIME file type. |
| MalwareBazaar.File.file_type | String | Malware sample’s file type. |
| MalwareBazaar.File.reporter | String | Twitter handle of the report (or anonymous for anonymous submissions). |
| MalwareBazaar.File.origin_country | String | Two letter country code of the country where the sample was uploaded from. |
| MalwareBazaar.File.anonymous | Number | Whether the submission of the sample was anonymous - 1 (true) or 0 (false). |
| MalwareBazaar.File.signature | String | Malware family (if available). |
| MalwareBazaar.File.imphash | String | Import hash (imphash) (only available for Portable Executables). |
| MalwareBazaar.File.tlsh | String | Trend Micro Locality Sensitive Hash (tlsh). |
| MalwareBazaar.File.telfhash | String | Trend Micro ELF Hash (telfhash). |
| MalwareBazaar.File.ssdeep | String | The SSDeep hash of the file. |
| MalwareBazaar.File.dhash_icon | Unknown | In case the file is a Portable Executable, the dhash of the sample’s icon. |
| MalwareBazaar.File.comment | String | Comment in the malware sample. |
| MalwareBazaar.File.tags | String | List of tags in the malware sample. |
| MalwareBazaar.File.code_sign.subject_cn | String | Subject common name (CN). |
| MalwareBazaar.File.code_sign.issuer_cn | String | Issuer common name (CN). |
| MalwareBazaar.File.code_sign.algorithm | String | Algorithm used. |
| MalwareBazaar.File.code_sign.valid_from | Date | Datetime from which the code sign was valid. |
| MalwareBazaar.File.code_sign.valid_to | Date | Datetime until which the code sign was valid (expiry date). |
| MalwareBazaar.File.code_sign.serial_number | String | Serial number of the code sign. |
| MalwareBazaar.File.code_sign.cscb_listed | String | Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). |
| MalwareBazaar.File.code_sign.cscb_reason | String | Code Signing Certificate Blocklist (CSCB) listing reason. |
| MalwareBazaar.File.delivery_method | String | How the file was distributed. |
| MalwareBazaar.File.file_information | Unknown | Contextual information about the file sample. |
| MalwareBazaar.File.yara_rules.rule_name | String | Name of the YARA rule that triggered the malware. |
| MalwareBazaar.File.yara_rules.author | String | Author of the YARA rule. |
| MalwareBazaar.File.yara_rules.description | String | Description of the YARA rule. |
| MalwareBazaar.File.yara_rules.reference | Unknown | Reference of the YARA rule. |
| MalwareBazaar.File.vendor_intel.ANY.RUN | Unknown | Dynamic malware analysis from ANY.RUN. |
| MalwareBazaar.File.vendor_intel.CAPE | Unknown | Dynamic malware analysis from CAPE sandbox. |
| MalwareBazaar.File.vendor_intel.CERT-PL_MWDB | Unknown | Threat intel from CERT.PL Malware database. |
| MalwareBazaar.File.vendor_intel.vxCube | Unknown | Dynamic malware analysis from Dr.Web vxCube. |
| MalwareBazaar.File.vendor_intel.DocGuard | Unknown | Office document reputation from DocGuad. |
| MalwareBazaar.File.vendor_intel.FileScan-IO | Unknown | Malware analysis service from FileScan.IO. |
| MalwareBazaar.File.vendor_intel.InQuest Labs | Unknown | File reputation service from InQuest Labs. |
| MalwareBazaar.File.vendor_intel.Intezer | Unknown | Code analysis from Intezer. |
| MalwareBazaar.File.vendor_intel.ReversingLabs | Unknown | File reputation and intelligence from ReversingLabs TitaniumCloud. |
| MalwareBazaar.File.vendor_intel.Spamhaus_HBL | Unknown | File reputation from Spamhaus Hash Blocklist (HBL). |
| MalwareBazaar.File.vendor_intel.Triage | Unknown | Dynamic malware analysis from Hatching Triage. |
| MalwareBazaar.File.vendor_intel.UnpacMe | Unknown | Malware unpacking service from UnpacMe. |
| MalwareBazaar.File.vendor_intel.VMRay | Unknown | Dynamic malware analysis from VMRay. |
| MalwareBazaar.File.vendor_intel.YOROI_YOMI | Unknown | Dynamic malware analysis from YOROI YOMI. |
| MalwareBazaar.File.comments.id | String | Unique ID that identifies this comment. |
| MalwareBazaar.File.comments.date_added | Date | Timestamp (UTC) of when this comment was made. |
| MalwareBazaar.File.comments.twitter_handle | String | Twitter handle who wrote this comment. |
| MalwareBazaar.File.comments.display_name | String | Twitter display name. |
| MalwareBazaar.File.comments.comment | String | The comment itself. |
| DBotScore.Indicator | String | The indicator that was tested. |
| DBotScore.Score | Number | The actual score. |
| DBotScore.Type | String | The indicator type. |
| DBotScore.Vendor | String | The vendor used to calculate the score. |
| DBotScore.Reliability | String | The reliability of the vendor. |
| File.MD5 | String | MD5 hash of the file submitted for analysis. |
| File.SHA1 | String | SHA1 hash of the file submitted for analysis. |
| File.SHA256 | String | SHA256 hash of the file submitted for analysis. |
| File.Size | String | Size of the file submitted for analysis. |
| File.Malicious.Vendor | String | For malicious files, the vendor that made the decision. |
| File.Malicious.Description | String | For malicious files, the reason that the vendor made the decision. |
| File.Relationships.EntityA | String | The source of the relationship. |
| File.Relationships.EntityB | String | The destination of the relationship. |
| File.Relationships.Relationship | String | The name of the relationship. |
| File.Relationships.EntityAType | String | The type of the source of the relationship. |
| File.Relationships.EntityBType | String | The type of the destination of the relationship. |
Command Example
!file file=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d
Context Example
{
"DBotScore": {
"Indicator": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
"Reliability": "A - Completely reliable",
"Score": 3,
"Type": "file",
"Vendor": "MalwareBazaar"
},
"File": {
"MD5": "1232f6432c5af8d10b04caed90d410ec7ad",
"Malicious": {
"Description": null,
"Vendor": "MalwareBazaar"
},
"Relationships": [
{
"EntityA": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
"EntityAType": "File",
"EntityB": "AgentTesla",
"EntityBType": "Malware",
"Relationship": "indicator-of"
}
],
"SHA1": "1234b1fc10818dd534922feef4d521eb3574337e3c0",
"SHA256": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
"Size": 472064,
"Type": "exe"
},
"MalwareBazaar": {
"File": {
"anonymous": 0,
"code_sign": null,
"comment": null,
"comments": [
{
"comment": "test",
"date_added": "2021-09-26 07:07:00",
"display_name": "mr tall",
"id": "25397",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-09-26 08:16:59",
"display_name": "mr tall",
"id": "25405",
"twitter_handle": "tiulog"
},
{
"comment": "Swiss chocolate is the best chocolate",
"date_added": "2021-09-26 14:57:36",
"display_name": "mr tall",
"id": "25412",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-09-29 15:10:09",
"display_name": "mr tall",
"id": "25689",
"twitter_handle": "tiulog"
},
{
"comment": "test new",
"date_added": "2021-10-03 10:53:34",
"display_name": "mr tall",
"id": "25968",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-03 11:03:32",
"display_name": "mr tall",
"id": "25978",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-04 09:07:37",
"display_name": "mr tall",
"id": "26069",
"twitter_handle": "tiulog"
},
{
"comment": "test new",
"date_added": "2021-10-04 11:15:43",
"display_name": "mr tall",
"id": "26098",
"twitter_handle": "tiulog"
},
{
"comment": "test new",
"date_added": "2021-10-04 11:15:58",
"display_name": "mr tall",
"id": "26099",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-04 11:26:47",
"display_name": "mr tall",
"id": "26100",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-04 12:11:40",
"display_name": "mr tall",
"id": "26106",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-04 12:41:08",
"display_name": "mr tall",
"id": "26109",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-05 08:20:09",
"display_name": "mr tall",
"id": "26169",
"twitter_handle": "tiulog"
},
{
"comment": "test_module",
"date_added": "2021-10-05 13:56:59",
"display_name": "mr tall",
"id": "26190",
"twitter_handle": "tiulog"
},
{
"comment": "test_module",
"date_added": "2021-10-05 14:06:40",
"display_name": "mr tall",
"id": "26194",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-05 15:14:51",
"display_name": "mr tall",
"id": "26200",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-05 15:16:17",
"display_name": "mr tall",
"id": "26201",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-06 14:42:17",
"display_name": "mr tall",
"id": "26263",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 07:13:43",
"display_name": "mr tall",
"id": "26325",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 07:16:53",
"display_name": "mr tall",
"id": "26326",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 07:17:36",
"display_name": "mr tall",
"id": "26327",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 07:43:28",
"display_name": "mr tall",
"id": "26328",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 07:46:45",
"display_name": "mr tall",
"id": "26329",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 11:39:00",
"display_name": "mr tall",
"id": "26353",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 11:39:55",
"display_name": "mr tall",
"id": "26354",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 11:41:41",
"display_name": "mr tall",
"id": "26355",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 11:50:55",
"display_name": "mr tall",
"id": "26356",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 12:19:14",
"display_name": "mr tall",
"id": "26357",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 13:11:26",
"display_name": "mr tall",
"id": "26361",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-07 15:44:49",
"display_name": "mr tall",
"id": "26367",
"twitter_handle": "tiulog"
},
{
"comment": "test",
"date_added": "2021-10-10 09:17:58",
"display_name": "mr tall",
"id": "26633",
"twitter_handle": "tiulog"
}
],
"delivery_method": null,
"dhash_icon": null,
"file_information": null,
"file_name": "COPY-SCANB840284-IMG-2020-13-02-DOCUMENT-PDF.exe",
"file_size": 472064,
"file_type": "exe",
"file_type_mime": "application/x-dosexec",
"first_seen": "2020-02-13 11:55:46",
"imphash": "123f34d5f2d4577ed6d9ceec516c1f5a744",
"intelligence": {
"clamav": [
"SecuriteInfo.com.Trojan.PackedNET.211.15710.28159.UNOFFICIAL"
],
"downloads": "2596",
"mail": null,
"uploads": "2"
},
"last_seen": "2021-06-02 16:06:57",
"md5_hash": "2f6432c5af8d10b04caed90d410ec7ad",
"ole_information": [],
"origin_country": "CH",
"reporter": "abuse_ch",
"sha1_hash": "1234b1fc10818dd534922feef4d521eb3574337e3c0",
"sha256_hash": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d",
"sha3_384_hash": "11239ae5c4841f72a91eb66db9191d879a33cf87e69f07809105d25de6aa90fbce69c9e795a4a0b984bd33537502361bb9b",
"signature": "AgentTesla",
"ssdeep": "12288:GCU4gtAxIflaBAFGWf1yN6OcsiUIpqpcsHs4d8/U:MwIflaBaIH2Us69d88",
"tags": [
"AgentTesla",
"exe"
],
"telfhash": null,
"tlsh": "65A4BF181BB98C13F54BA6BAC4D942C9E2FCD57B8907F759D41129D60F0ABA7AC023C7",
"vendor_intel": {
"ReversingLabs": {
"first_seen": "2020-02-14 04:28:36",
"scanner_count": "31",
"scanner_match": "26",
"scanner_percent": "83.87",
"status": "MALICIOUS",
"threat_name": "ByteCode-MSIL.Trojan.Kryptik"
},
"Spamhaus_HBL": [
{
"detection": "malicious",
"link": "https://www.test.com"
}
],
"Triage": {
"link": "https://tria.ge/reports/201109-7p6mxbz6r2/",
"malware_config": [],
"malware_family": "agenttesla",
"score": "10",
"signatures": [
{
"score": "10",
"signature": "AgentTesla"
},
{
"score": "9",
"signature": "AgentTesla Payload"
},
{
"score": "7",
"signature": "Reads data files stored by FTP clients"
},
{
"score": "7",
"signature": "Reads user/profile data of local email clients"
},
{
"score": "7",
"signature": "Reads user/profile data of web browsers"
},
{
"score": "6",
"signature": "Adds Run key to start application"
},
{
"score": "6",
"signature": "Looks up external IP address via web service"
},
{
"score": "5",
"signature": "Suspicious use of SetThreadContext"
},
{
"score": null,
"signature": "Suspicious behavior: EnumeratesProcesses"
},
{
"score": null,
"signature": "Suspicious behavior: MapViewOfSection"
},
{
"score": null,
"signature": "Suspicious use of AdjustPrivilegeToken"
},
{
"score": null,
"signature": "Suspicious use of SetWindowsHookEx"
},
{
"score": null,
"signature": "Suspicious use of WriteProcessMemory"
}
],
"tags": [
"family:agenttesla",
"keylogger",
"persistence",
"spyware",
"stealer",
"trojan"
]
},
"YOROI_YOMI": {
"detection": "Unknown",
"score": "1.00"
}
},
"yara_rules": [
{
"author": "JPCERT/CC Incident Response Group",
"description": "detect Agenttesla in memory",
"reference": "internal research",
"rule_name": "Agenttesla_type2"
},
{
"author": "Brian C. Bell -- @biebsmalwareguy",
"description": null,
"reference": "https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar",
"rule_name": "CAP_HookExKeylogger"
},
{
"author": "Daniel Plohmann <daniel.plohmann@fkie.fraunhofer.de>",
"description": null,
"reference": null,
"rule_name": "win_agent_tesla_g2"
}
]
}
}
}
Human Readable Output
MalwareBazaar File reputation for: 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d
Md5 Hash Sha256 Hash Sha1 Hash File Name File Type File Size Tags First Seen Last Seen Signature Ssdeep Reporter Imphash Yara Rules Names 2f6432c5af8d10b04caed90d410ec7ad 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d 4b1fc10818dd534922feef4d521eb3574337e3c0 COPY-SCANB840284-IMG-2020-13-02-DOCUMENT-PDF.exe exe 472064 AgentTesla,
exe2020-02-13 11:55:46 2021-06-02 16:06:57 AgentTesla 12288:GCU4gtAxIflaBAFGWf1yN6OcsiUIpqpcsHs4d8/U:MwIflaBaIH2Us69d88 abuse_ch f34d5f2d4577ed6d9ceec516c1f5a744 Agenttesla_type2,
CAP_HookExKeylogger,
win_agent_tesla_g2
malwarebazaar-download-sample
Download a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password “infected” (without “”).
Base Command
malwarebazaar-download-sample
Input
| Argument Name | Description | Required |
|---|---|---|
| sha256_hash | SHA256 hash of the malware sample to download. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| File.Size | String | The size of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.SHA512 | String | The SHA512 hash of the file. |
| File.Name | String | The name of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | Entry ID of the file. |
| File.Info | String | Information about the file. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The extension of the file. |
Command Example
!malwarebazaar-download-sample sha256_hash=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78
Context Example
{
"File": {
"EntryID": "7712@e99f97d1-7225-4c75-896c-3c960febbe8c",
"Extension": "zip",
"Info": "application/zip",
"MD5": "12323c96a2ba1a4d7cd8d179641aac32f0d",
"Name": "094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78.zip",
"SHA1": "123b11025b4d625079d201ac9ba0552291a60be9c1e",
"SHA256": "123d727a2f40a5151d7a0e3bf9ebf77a8bf17a965505eb6db68080a38330c3fb743",
"SHA512": "12349f45537621ac26e7c5d7fea643fba27153070a52b8ebc56cab7e8522f5d8087697be6df969e9cfac74cefddceb6271aae1796f819fa3f405f909e3a488e4d18",
"SSDeep": "1233:HzH1IOH0Wp6FYn:Hr1I2xaY",
"Size": 45,
"Type": "JSON data"
}
}
Human Readable Output
malwarebazaar-comment-add
Add a comment for a malware sample.
Base Command
malwarebazaar-comment-add
Input
| Argument Name | Description | Required |
|---|---|---|
| sha256_hash | SHA256 hash of the malware sample to add a comment. | Required |
| comment | The comment to add to the sample. | Required |
Context Output
| Path | Type | Description |
|---|---|---|
| MalwareBazaar.MalwarebazaarCommentAdd.sha256_hash | String | SHA256 hash of given file. |
| MalwareBazaar.MalwarebazaarCommentAdd.comment | String | The comment that was added to the malware sample. |
Command Example
!malwarebazaar-comment-add comment="test" sha256_hash=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d
Context Example
{
"MalwareBazaar": {
"MalwarebazaarCommentAdd": {
"comment": "test",
"sha256_hash": "123094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d"
}
}
}
Human Readable Output
Comment added to 094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d malware sample successfully
malwarebazaar-samples-list
Retrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument.
Base Command
malwarebazaar-samples-list
Input
| Argument Name | Description | Required |
|---|---|---|
| sample_type | Type of the sample. Possible values are: tag, signature, file_type, clamav, imphash, yara_rule, issuer_cn. | Required |
| sample_value | Value of the sample selected. | Required |
| limit | Maximum number of results to return. Default is 1000. Note that when using the issuer_cn argument, all relevant results will display (maximum 100). | Optional |
| page | Page number to view. Each page contains page_size values. Must be used along with the page_size argument. | Optional |
| page_size | Number of results per page to display. | Optional |
Context Output
| Path | Type | Description |
|---|---|---|
| MalwareBazaar.MalwarebazaarSamplesList.sha256_hash | String | SHA256 hash of the malware sample. |
| MalwareBazaar.MalwarebazaarSamplesList.sha3_384_hash | String | SHA3-384 hash of the malware sample. |
| MalwareBazaar.MalwarebazaarSamplesList.sha1_hash | String | SHA1 hash of the malware sample. |
| MalwareBazaar.MalwarebazaarSamplesList.md5_hash | String | MD5 hash of the malware sample. |
| MalwareBazaar.MalwarebazaarSamplesList.first_seen | Date | Timestamp of when the file was first seen by MalwareBazaar (UTC). |
| MalwareBazaar.MalwarebazaarSamplesList.last_seen | Date | Timestamp of when the file was last seen by MalwareBazaar (UTC). |
| MalwareBazaar.MalwarebazaarSamplesList.file_name | String | Malware sample’s file name. |
| MalwareBazaar.MalwarebazaarSamplesList.file_size | Number | File size in bytes. |
| MalwareBazaar.MalwarebazaarSamplesList.file_type_mime | String | MIME file type. |
| MalwareBazaar.MalwarebazaarSamplesList.file_type | String | File type. |
| MalwareBazaar.MalwarebazaarSamplesList.reporter | String | Twitter handle of the report (or anonymous for anonymous submissions). |
| MalwareBazaar.MalwarebazaarSamplesList.anonymous | Number | Whether the submission of the sample was anonymous - 1 (true) or 0 (false). |
| MalwareBazaar.MalwarebazaarSamplesList.signature | String | Malware family (if available). |
| MalwareBazaar.MalwarebazaarSamplesList.imphash | String | Import hash (imphash) of the sample (only available for Portable Executables). |
| MalwareBazaar.MalwarebazaarSamplesList.tlsh | String | Trend Micro Locality Sensitive Hash (tlsh) of the sample. |
| MalwareBazaar.MalwarebazaarSamplesList.telfhash | String | Trend Micro ELF Hash (telfhash) of the sample. |
| MalwareBazaar.MalwarebazaarSamplesList.ssdeep | String | The SSDeep hash of the sample. |
| MalwareBazaar.MalwarebazaarSamplesList.dhash_icon | Unknown | In case the file is a Portable Executable, the dhash of the samples icon. |
| MalwareBazaar.MalwarebazaarSamplesList.tags | String | List of tags. |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.subject_cn | String | Subject common name (CN). |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.issuer_cn | String | Issuer common name (CN). |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.algorithm | String | Algorithm used. |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_from | Date | Datetime from which the code sign was valid. |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_to | Date | Datetime until which the code sign was valid (expiry date). |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.serial_number | String | Serial number of the code sign. |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_listed | String | Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). |
| MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_reason | String | Code Signing Certificate Blocklist (CSCB) listing reason. |
| MalwareBazaar.MalwarebazaarSamplesList.intelligence.clamav | String | List of ClamAV detections (official and unofficial rules). |
| MalwareBazaar.MalwarebazaarSamplesList.intelligence.downloads | Number | Number of downloads from MalwareBazaar. |
| MalwareBazaar.MalwarebazaarSamplesList.intelligence.uploads | Number | Number of uploads to MalwareBazaar. |
| MalwareBazaar.MalwarebazaarSamplesList.intelligence.mail | String | Indicates if this malware sample has been seen in global spam traffic. |
Command Example
!malwarebazaar-samples-list sample_type=tag sample_value=TrickBot limit=2
Context Example
{
"MalwareBazaar": {
"MalwarebazaarSamplesList": [
{
"anonymous": 0,
"code_sign": [],
"dhash_icon": "0000000000000000",
"file_name": "ee566f0e04b497770c5baa4de14c416f.exe",
"file_size": 656384,
"file_type": "exe",
"file_type_mime": "application/x-dosexec",
"first_seen": "2021-11-07 08:38:51",
"imphash": "2a49715e49b2891839bf716e121ca434",
"intelligence": {
"clamav": [
"SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL"
],
"downloads": "92",
"mail": null,
"uploads": "1"
},
"last_seen": null,
"md5_hash": "ee566f0e04b497770c5baa4de14c416f",
"reporter": "abuse_ch",
"sha1_hash": "98f77caf24f14dca0fa163596a730269037f2065",
"sha256_hash": "06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9",
"sha3_384_hash": "84f65cac42470c9f3920019b8fb60f3975be1c0528c180a180839b60198b36de966f6cae2aabf532b3c5c777dd75a027",
"signature": "TrickBot",
"ssdeep": "12288:InZndx1krxFPqBSPcLQuDACflBMhhDKG/M:AZdxuQSP/u8Qm5J",
"tags": [
"exe",
"TrickBot"
],
"telfhash": null,
"tlsh": "T115D4E0103390C032D5A324718A69DBB58E7EB861676275CF3BD91E7E5F24AD1EA3430E"
},
{
"anonymous": 0,
"code_sign": [],
"dhash_icon": "0000000000000000",
"file_name": "7425c5e4bd0f910f80a1ab456b68e192.exe",
"file_size": 656896,
"file_type": "exe",
"file_type_mime": "application/x-dosexec",
"first_seen": "2021-11-07 08:35:14",
"imphash": "2a49715e49b2891839bf716e121ca434",
"intelligence": {
"clamav": [
"SecuriteInfo.com.Variant.Fragtor.38286.19831.22095.UNOFFICIAL"
],
"downloads": "90",
"mail": null,
"uploads": "1"
},
"last_seen": null,
"md5_hash": "7425c5e4bd0f910f80a1ab456b68e192",
"reporter": "abuse_ch",
"sha1_hash": "dbd26c846e03f94aa1451b6b73e1fa138ea5a953",
"sha256_hash": "3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437",
"sha3_384_hash": "b5ae6ff44057229fbc1af7e68527ebc5cb4f018c9cbfe20a06c8594c401ab708a4d9a7fc69fa10929365695c11f01ca7",
"signature": "TrickBot",
"ssdeep": "12288:5nZndx1krxFPqBSPw7bQ9k03GxGprGwbKM:9ZdxuQSPw72k034GJGf",
"tags": [
"exe",
"TrickBot"
],
"telfhash": null,
"tlsh": "T12FD4E0213290C032D1A324718E66DBB98E7EB861775265CF3BD90E7D4F24BD1EA3531A"
}
]
}
}
Human Readable Output
Sample List
Md5 Hash Sha256 Hash Sha1 Hash File Name File Type File Size Tags First Seen ee566f0e04b497770c5baa4de14c416f 06dac5f720847ff3c99c75a950a8b07dbf090127f770171f8d005a0c76c20de9 98f77caf24f14dca0fa163596a730269037f2065 ee566f0e04b497770c5baa4de14c416f.exe exe 656384 exe,
TrickBot2021-11-07 08:38:51 7425c5e4bd0f910f80a1ab456b68e192 3d775f1f2da385ed73d988930d9c9675fc2e466098bb5f19c8501a723e14f437 dbd26c846e03f94aa1451b6b73e1fa138ea5a953 7425c5e4bd0f910f80a1ab456b68e192.exe exe 656896 exe,
TrickBot2021-11-07 08:35:14
Create an API Key
- Sign up for an abuse.ch account by using an existing account that you may already have on X, LinkedIn, Google or Github. Just log in with the authentication provider of your choice here: https://auth.abuse.ch/
- Once you’ve logged in to abuse.ch, add at least one more way to log in. This helps ensure you can always access our platforms, even if one of your login methods stops working.
- Click the Save profile button. In the Optional section, you can now create an Auth-Key. This is your personal authentication key that you can use to query any abuse.ch APIs.
If you already have a profile, you only need to follow step 3. There’s nothing further to do for your authentication set up.
Configuration parameters
url— Server URL (required)credentials—integrationReliability— Source Reliability (required)proxy— Use system proxy settingsinsecure— Trust any certificate (not secure)
Commands (4)
-
fileCheck if a particular malware sample is known to MalwareBazaar.
-
malwarebazaar-comment-addAdd a comment for a malware sample.
-
malwarebazaar-download-sampleDownload a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password "infected" (without "").
-
malwarebazaar-samples-listRetrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument.
category: Data Enrichment & Threat Intelligence provider: Open Source sectionorder: - Connect - Collect commonfields: id: MalwareBazaar version: -1 configuration: - additionalinfo: This is the API endpoint for the MalwareBazaar API. defaultvalue: https://mb-api.abuse.ch display: Server URL name: url required: true type: 0 section: Connect - displaypassword: API Key hiddenusername: true name: credentials type: 9 required: false section: Connect additionalinfo: Starting June 30th 2025 this parameter is mandatory. - additionalinfo: Reliability of the source providing the intelligence data. defaultvalue: A - Completely reliable display: Source Reliability name: integrationReliability options: - A+ - 3rd party enrichment - A - Completely reliable - B - Usually reliable - C - Fairly reliable - D - Not usually reliable - E - Unreliable - F - Reliability cannot be judged required: true type: 15 section: Collect #randomly for the pre commit - check for the right section - display: Use system proxy settings name: proxy type: 8 required: false section: Collect #randomly for the pre commit - check for the right section - display: Trust any certificate (not secure) name: insecure type: 8 required: false section: Collect #randomly for the pre commit - check for the right section description: MalwareBazaar is a project from abuse.ch with the goal of sharing malware samples with the Infosec community, AV vendors, and threat intelligence providers. display: MalwareBazaar name: MalwareBazaar script: commands: - arguments: - default: true description: A list of SHA256, MD5, or SHA1 hashes of the malware samples you want to query. isArray: true name: file required: true description: Check if a particular malware sample is known to MalwareBazaar. name: file outputs: - contextPath: MalwareBazaar.File.sha256_hash description: SHA256 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.sha3_384_hash description: SHA3-384 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.sha1_hash description: SHA1 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.md5_hash description: MD5 hash of the malware sample. type: String - contextPath: MalwareBazaar.File.first_seen description: Timestamp of when the file was first seen by MalwareBazaar in UTC format. type: Date - contextPath: MalwareBazaar.File.last_seen description: Timestamp of when the file was last seen by MalwareBazaar in UTC format. type: Date - contextPath: MalwareBazaar.File.file_name description: Malware sample's file name. type: String - contextPath: MalwareBazaar.File.file_size description: Malware sample's file size in bytes. type: Number - contextPath: MalwareBazaar.File.file_type_mime description: Malware samples's MIME file type. type: String - contextPath: MalwareBazaar.File.file_type description: Malware sample's file type. type: String - contextPath: MalwareBazaar.File.reporter description: Twitter handle of the report (or anonymous for anonymous submissions). type: String - contextPath: MalwareBazaar.File.origin_country description: Two letter country code of the country where the sample was uploaded from. type: String - contextPath: MalwareBazaar.File.anonymous description: Whether the submission of the sample was anonymous - 1 (true) or 0 (false). type: Number - contextPath: MalwareBazaar.File.signature description: Malware family (if available). type: String - contextPath: MalwareBazaar.File.imphash description: Import hash (imphash) (only available for Portable Executables). type: String - contextPath: MalwareBazaar.File.tlsh description: Trend Micro Locality Sensitive Hash (tlsh). type: String - contextPath: MalwareBazaar.File.telfhash description: Trend Micro ELF Hash (telfhash). type: String - contextPath: MalwareBazaar.File.ssdeep description: The SSDeep hash of the file. type: String - contextPath: MalwareBazaar.File.dhash_icon description: In case the file is a Portable Executable, the dhash of the sample's icon. type: Unknown - contextPath: MalwareBazaar.File.comment description: Comment in the malware sample. type: String - contextPath: MalwareBazaar.File.tags description: List of tags in the malware sample. type: String - contextPath: MalwareBazaar.File.code_sign.subject_cn description: Subject common name (CN). type: String - contextPath: MalwareBazaar.File.code_sign.issuer_cn description: Issuer common name (CN). type: String - contextPath: MalwareBazaar.File.code_sign.algorithm description: Algorithm used. type: String - contextPath: MalwareBazaar.File.code_sign.valid_from description: Datetime from which the code sign was valid. type: Date - contextPath: MalwareBazaar.File.code_sign.valid_to description: Datetime until which the code sign was valid (expiry date). type: Date - contextPath: MalwareBazaar.File.code_sign.serial_number description: Serial number of the code sign. type: String - contextPath: MalwareBazaar.File.code_sign.cscb_listed description: Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). type: String - contextPath: MalwareBazaar.File.code_sign.cscb_reason description: Code Signing Certificate Blocklist (CSCB) listing reason. type: String - contextPath: MalwareBazaar.File.delivery_method description: How the file was distributed. type: String - contextPath: MalwareBazaar.File.file_information description: Contextual information about the file sample. type: Unknown - contextPath: MalwareBazaar.File.yara_rules.rule_name description: Name of the YARA rule that triggered the malware. type: String - contextPath: MalwareBazaar.File.yara_rules.author description: Author of the YARA rule. type: String - contextPath: MalwareBazaar.File.yara_rules.description description: Description of the YARA rule. type: String - contextPath: MalwareBazaar.File.yara_rules.reference description: Reference of the YARA rule. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.ANY.RUN description: Dynamic malware analysis from ANY.RUN. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.CAPE description: Dynamic malware analysis from CAPE sandbox. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.CERT-PL_MWDB description: Threat intel from CERT.PL Malware database. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.vxCube description: Dynamic malware analysis from Dr.Web vxCube. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.DocGuard description: Office document reputation from DocGuad. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.FileScan-IO description: Malware analysis service from FileScan.IO. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.InQuest Labs description: File reputation service from InQuest Labs. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Intezer description: Code analysis from Intezer. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.ReversingLabs description: File reputation and intelligence from ReversingLabs TitaniumCloud. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Spamhaus_HBL description: File reputation from Spamhaus Hash Blocklist (HBL). type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.Triage description: Dynamic malware analysis from Hatching Triage. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.UnpacMe description: Malware unpacking service from UnpacMe. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.VMRay description: Dynamic malware analysis from VMRay. type: Unknown - contextPath: MalwareBazaar.File.vendor_intel.YOROI_YOMI description: Dynamic malware analysis from YOROI YOMI. type: Unknown - contextPath: MalwareBazaar.File.comments.id description: Unique ID that identifies this comment. type: String - contextPath: MalwareBazaar.File.comments.date_added description: Timestamp (UTC) of when this comment was made. type: Date - contextPath: MalwareBazaar.File.comments.twitter_handle description: Twitter handle who wrote this comment. type: String - contextPath: MalwareBazaar.File.comments.display_name description: Twitter display name. type: String - contextPath: MalwareBazaar.File.comments.comment description: The comment itself. type: String - contextPath: DBotScore.Indicator description: The indicator that was tested. type: String - contextPath: DBotScore.Score description: The actual score. type: Number - contextPath: DBotScore.Type description: The indicator type. type: String - contextPath: DBotScore.Vendor description: The vendor used to calculate the score. type: String - contextPath: DBotScore.Reliability description: The reliability of the vendor. type: String - contextPath: File.MD5 description: MD5 hash of the file submitted for analysis. type: String - contextPath: File.SHA1 description: SHA1 hash of the file submitted for analysis. type: String - contextPath: File.SHA256 description: SHA256 hash of the file submitted for analysis. type: String - contextPath: File.Size description: Size of the file submitted for analysis. type: String - contextPath: File.Malicious.Vendor description: For malicious files, the vendor that made the decision. type: String - contextPath: File.Malicious.Description description: For malicious files, the reason that the vendor made the decision. type: String - contextPath: File.Relationships.EntityA description: The source of the relationship. type: string - contextPath: File.Relationships.EntityB description: The destination of the relationship. type: string - contextPath: File.Relationships.Relationship description: The name of the relationship. type: string - contextPath: File.Relationships.EntityAType description: The type of the source of the relationship. type: string - contextPath: File.Relationships.EntityBType description: The type of the destination of the relationship. type: string - arguments: - description: SHA256 hash of the malware sample to download. name: sha256_hash required: true description: Download a malware sample from MalwareBazaar. Any malware sample downloaded from MalwareBazaar is zipped and password protected using the password "infected" (without ""). execution: true name: malwarebazaar-download-sample outputs: - contextPath: File.Size description: The size of the file. type: String - contextPath: File.SHA1 description: The SHA1 hash of the file. type: String - contextPath: File.SHA256 description: The SHA256 hash of the file. type: String - contextPath: File.SHA512 description: The SHA512 hash of the file. type: String - contextPath: File.Name description: The name of the file. type: String - contextPath: File.SSDeep description: The SSDeep hash of the file. type: String - contextPath: File.EntryID description: Entry ID of the file. type: String - contextPath: File.Info description: Information about the file. type: String - contextPath: File.Type description: The file type. type: String - contextPath: File.MD5 description: The MD5 hash of the file. type: String - contextPath: File.Extension description: The extension of the file. type: String - arguments: - description: SHA256 hash of the malware sample to add a comment. name: sha256_hash required: true - description: The comment to add to the sample. name: comment required: true description: Add a comment for a malware sample. name: malwarebazaar-comment-add outputs: - contextPath: MalwareBazaar.MalwarebazaarCommentAdd.sha256_hash description: SHA256 hash of given file. type: String - contextPath: MalwareBazaar.MalwarebazaarCommentAdd.comment description: The comment that was added to the malware sample. type: String - arguments: - auto: PREDEFINED description: Type of the sample. name: sample_type predefined: - tag - signature - file_type - clamav - imphash - yara_rule - issuer_cn required: true - description: Value of the sample selected. name: sample_value required: true - description: Maximum number of results to return. Default is 1000. Note that when using the issuer_cn argument, all relevant results will display (maximum 100). name: limit - description: Page number to view. Each page contains page_size values. Must be used along with the page_size argument. name: page - description: Number of results per page to display. name: page_size description: Retrieves a list of recent malware samples (maximum 1000) associated with a specific sample type. Note that you can either use the limit argument or the page and page_size argument. name: malwarebazaar-samples-list outputs: - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha256_hash description: SHA256 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha3_384_hash description: SHA3-384 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.sha1_hash description: SHA1 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.md5_hash description: MD5 hash of the malware sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.first_seen description: Timestamp of when the file was first seen by MalwareBazaar (UTC). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.last_seen description: Timestamp of when the file was last seen by MalwareBazaar (UTC). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_name description: Malware sample's file name. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_size description: File size in bytes. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_type_mime description: MIME file type. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.file_type description: File type. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.reporter description: Twitter handle of the report (or anonymous for anonymous submissions). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.anonymous description: Whether the submission of the sample was anonymous - 1 (true) or 0 (false). type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.signature description: Malware family (if available). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.imphash description: Import hash (imphash) of the sample (only available for Portable Executables). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.tlsh description: Trend Micro Locality Sensitive Hash (tlsh) of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.telfhash description: Trend Micro ELF Hash (telfhash) of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.ssdeep description: The SSDeep hash of the sample. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.dhash_icon description: 'In case the file is a Portable Executable, the dhash of the samples icon.' type: Unknown - contextPath: MalwareBazaar.MalwarebazaarSamplesList.tags description: List of tags. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.subject_cn description: Subject common name (CN). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.issuer_cn description: Issuer common name (CN). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.algorithm description: Algorithm used. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_from description: Datetime from which the code sign was valid. type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.valid_to description: Datetime until which the code sign was valid (expiry date). type: Date - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.serial_number description: Serial number of the code sign. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_listed description: Whether the sample is listed in the Code Signing Certificate Blocklist (CSCB). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.code_sign.cscb_reason description: Code Signing Certificate Blocklist (CSCB) listing reason. type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.clamav description: List of ClamAV detections (official and unofficial rules). type: String - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.downloads description: Number of downloads from MalwareBazaar. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.uploads description: Number of uploads to MalwareBazaar. type: Number - contextPath: MalwareBazaar.MalwarebazaarSamplesList.intelligence.mail description: Indicates if this malware sample has been seen in global spam traffic. type: String dockerimage: demisto/python3:3.12.13.10116658 runonce: false script: '-' subtype: python3 type: python tests: - MalwareBazaar_Test fromversion: 6.0.0