MalwareBazaar Feed

Use the MalwareBazaar Feed integration to get the list of malware samples added to MalwareBazaar within the last 60 minutes.

Data Enrichment & Threat Intelligence · MalwareBazaar Feed · Feed

Details

ID	`MalwareBazaar Feed`
Provider	AbuseCh
Category	Data Enrichment & Threat Intelligence
From Version	6.0.0
Docker Image	`demisto/py3-tools:1.0.0.10120494`
Supported Modules	Agentix XSIAM

README

The MalwareBazaar Feed integration leverages abuse.ch to get the list of malware samples added to MalwareBazaar within the last 60 minutes.

Configure MalwareBazaar Feed in Cortex

Parameter	Description	Required
Server URL		True
Fetch indicators		False
Auth Key	Auth Key for authentication with abuser.ch	True
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
Feed Fetch Interval		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Tags	Supports CSV values.	False
Create relationships		False
Trust any certificate (not secure)		False
Use system proxy settings		False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

malwarebazzar-get-indicators

Gets the feed indicators.

Base Command

malwarebazzar-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of results to return. The default value is 50. Default is 50.	Optional

Context Output

There is no context output for this command.

Command Example

!malwarebazzar-get-indicators limit=3

Human Readable Output

Indicators

value type rawJSON

2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3 File sha256_hash: 2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3
sha3_384_hash: be865100f4cb963d9dbe6cd10b453cdfc7f5ee7f22975e7c7c8120a9631b797880f58ae842d02761f074429aeb160057
sha1_hash: 4068065df0d806c05b1bd6138bdb32f483c816a2
md5_hash: a76e2cdba762de201e0668178b03bec4
first_seen: 2021-10-04 11:26:00
last_seen: null
file_name: a76e2cdba762de201e0668178b03bec4.exe
file_size: 119016
file_type_mime: application/x-dosexec
file_type: exe
reporter: abuse_ch
origin_country: FR
anonymous: 0
signature: RedLineStealer
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
tlsh: T1BBC33B3553DC8A28EBFE1F75B071120047F0D1CB6512EB5B9EC26CEA5E73B825A512E2
telfhash: null
ssdeep: 1536:5e1zHb1iaNk5mXKSr7y9zjbuRNdsnhuyq/dMV1dbknEjG6qTaoigNK:0S0X7y978snYyOdM9kEW9K
dhash_icon: null
tags: exe,
RedLineStealer
code_sign:
intelligence: {“clamav”: null, “downloads”: “1”, “uploads”: “1”, “mail”: null}

e9dc15fdcf77dd8dde52392b63a79e43e39d85431434198f5103ced790f9034a File sha256_hash: e9dc15fdcf77dd8dde52392b63a79e43e39d85431434198f5103ced790f9034a
sha3_384_hash: 362f8c4a885bacc2158dd1b1f3f96848b982ac94df8e67b930b0dc766369d08bdbb0c97b713a9a561d3f72be4c65f27c
sha1_hash: f59a1e433565255d52720f49ce0f4e52c29b78bf
md5_hash: f0e38ba220616f3b94a5f71712d52817
first_seen: 2021-10-04 11:13:59
last_seen: 2021-10-04 11:14:29
file_name: swift art.pdf.exe
file_size: 422912
file_type_mime: application/x-dosexec
file_type: exe
reporter: cocaman
origin_country: FR
anonymous: 0
signature: AgentTesla
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
tlsh: T1CB94026823A7D314DE3483F43C18A69127FA742B151DD37C5E89E4ED3E52B748AE0A87
telfhash: null
ssdeep: 6144:6Axt05ERQ+3HwO0adBqsB9+U1eqjRISdJOyYge708qlv5/Mf76oAeEHm9E0:iESoZ4C9AWIzJgeCvlY5AeEKh
dhash_icon: null
tags: AgentTesla,
exe,
SWIFT
code_sign:
intelligence: {“clamav”: null, “downloads”: “30”, “uploads”: “2”, “mail”: null}

3e1a48cb4283d83c729670dbdc69d6a8d5290a50bebc621baf7e0a72cd56ffb6 File sha256_hash: 3e1a48cb4283d83c729670dbdc69d6a8d5290a50bebc621baf7e0a72cd56ffb6
sha3_384_hash: 1104c8634247f86d15f3e61faa68d7232f797936e3cf838b21052d4a9ebf52a6a523462e9e1ce3bdb9a13f5e51a5da86
sha1_hash: a5035ff9bd7264431a254a0b973864febfb19c7f
md5_hash: ca13a97b94b0e17f5d863a2290f10931
first_seen: 2021-10-04 11:13:49
last_seen: 2021-10-04 11:14:20
file_name: swift art.pdf.zip
file_size: 372101
file_type_mime: application/zip
file_type: zip
reporter: cocaman
origin_country: US
anonymous: 0
signature: AgentTesla
imphash: null
tlsh: T15A842305488BE237E7433679D60D0A4173D9399B0F15F6FAEC1B9B67AE811108EF49CA
telfhash: null
ssdeep: 6144:aI84xUdNqsB9+U1eq7RUSdROy8g27o8qpv5hM3N6sAIEPmh7hF8:Z84xyUA9gwUNng2avz2ZAImA/8
dhash_icon: null
tags: AgentTesla,
SWIFT,
zip
code_sign:
intelligence: {“clamav”: null, “downloads”: “25”, “uploads”: “2”, “mail”: null}

value	type	rawJSON
2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3	File	sha256_hash: 2fd9985380a92fa918df25189e1023c27052355dc1c7f8a2d11339be7ddfc7d3 sha3_384_hash: be865100f4cb963d9dbe6cd10b453cdfc7f5ee7f22975e7c7c8120a9631b797880f58ae842d02761f074429aeb160057 sha1_hash: 4068065df0d806c05b1bd6138bdb32f483c816a2 md5_hash: a76e2cdba762de201e0668178b03bec4 first_seen: 2021-10-04 11:26:00 last_seen: null file_name: a76e2cdba762de201e0668178b03bec4.exe file_size: 119016 file_type_mime: application/x-dosexec file_type: exe reporter: abuse_ch origin_country: FR anonymous: 0 signature: RedLineStealer imphash: f34d5f2d4577ed6d9ceec516c1f5a744 tlsh: T1BBC33B3553DC8A28EBFE1F75B071120047F0D1CB6512EB5B9EC26CEA5E73B825A512E2 telfhash: null ssdeep: 1536:5e1zHb1iaNk5mXKSr7y9zjbuRNdsnhuyq/dMV1dbknEjG6qTaoigNK:0S0X7y978snYyOdM9kEW9K dhash_icon: null tags: exe, RedLineStealer code_sign: intelligence: {“clamav”: null, “downloads”: “1”, “uploads”: “1”, “mail”: null}
e9dc15fdcf77dd8dde52392b63a79e43e39d85431434198f5103ced790f9034a	File	sha256_hash: e9dc15fdcf77dd8dde52392b63a79e43e39d85431434198f5103ced790f9034a sha3_384_hash: 362f8c4a885bacc2158dd1b1f3f96848b982ac94df8e67b930b0dc766369d08bdbb0c97b713a9a561d3f72be4c65f27c sha1_hash: f59a1e433565255d52720f49ce0f4e52c29b78bf md5_hash: f0e38ba220616f3b94a5f71712d52817 first_seen: 2021-10-04 11:13:59 last_seen: 2021-10-04 11:14:29 file_name: swift art.pdf.exe file_size: 422912 file_type_mime: application/x-dosexec file_type: exe reporter: cocaman origin_country: FR anonymous: 0 signature: AgentTesla imphash: f34d5f2d4577ed6d9ceec516c1f5a744 tlsh: T1CB94026823A7D314DE3483F43C18A69127FA742B151DD37C5E89E4ED3E52B748AE0A87 telfhash: null ssdeep: 6144:6Axt05ERQ+3HwO0adBqsB9+U1eqjRISdJOyYge708qlv5/Mf76oAeEHm9E0:iESoZ4C9AWIzJgeCvlY5AeEKh dhash_icon: null tags: AgentTesla, exe, SWIFT code_sign: intelligence: {“clamav”: null, “downloads”: “30”, “uploads”: “2”, “mail”: null}
3e1a48cb4283d83c729670dbdc69d6a8d5290a50bebc621baf7e0a72cd56ffb6	File	sha256_hash: 3e1a48cb4283d83c729670dbdc69d6a8d5290a50bebc621baf7e0a72cd56ffb6 sha3_384_hash: 1104c8634247f86d15f3e61faa68d7232f797936e3cf838b21052d4a9ebf52a6a523462e9e1ce3bdb9a13f5e51a5da86 sha1_hash: a5035ff9bd7264431a254a0b973864febfb19c7f md5_hash: ca13a97b94b0e17f5d863a2290f10931 first_seen: 2021-10-04 11:13:49 last_seen: 2021-10-04 11:14:20 file_name: swift art.pdf.zip file_size: 372101 file_type_mime: application/zip file_type: zip reporter: cocaman origin_country: US anonymous: 0 signature: AgentTesla imphash: null tlsh: T15A842305488BE237E7433679D60D0A4173D9399B0F15F6FAEC1B9B67AE811108EF49CA telfhash: null ssdeep: 6144:aI84xUdNqsB9+U1eq7RUSdROy8g27o8qpv5hM3N6sAIEPmh7hF8:Z84xyUA9gwUNng2avz2ZAImA/8 dhash_icon: null tags: AgentTesla, SWIFT, zip code_sign: intelligence: {“clamav”: null, “downloads”: “25”, “uploads”: “2”, “mail”: null}

Create an Auth Key

for abuse.ch

Sign up for an abuse.ch account by using an existing account that you may already have on X, LinkedIn, Google or Github. Just log in with the authentication provider of your choice here: https://auth.abuse.ch/
Once you’ve logged in to abuse.ch, add at least one more way to log in. This helps ensure you can always access our platforms, even if one of your login methods stops working.
Click the Save profile button. In the Optional section, you can now create an Auth-Key. This is your personal authentication key that you can use to query any abuse.ch APIs.

If you already have a profile, you only need to follow step 3. There’s nothing further to do for your authentication set up.

Configuration parameters

url — Server URL (required)
credentials —
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationPolicy —
feedExpirationInterval —
feedFetchInterval — Feed Fetch Interval
feedBypassExclusionList — Bypass exclusion list
feedTags — Tags
create_relationships — Create relationships
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings

Commands (1)

malwarebazzar-get-indicators
Gets the feed indicators.

Source

MalwareBazaarFeed.py MalwareBazaarFeed_test.py MalwareBazaarFeed.yml MalwareBazaarFeed_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: AbuseCh
sectionorder:
- Connect
- Collect
commonfields:
  id: MalwareBazaar Feed
  version: -1
configuration:
- display: Server URL
  defaultvalue: https://mb-api.abuse.ch
  name: url
  required: true
  type: 0
  section: Connect
- displaypassword: API Key
  hiddenusername: true
  name: credentials
  type: 9
  section: Connect
  required: false
  additionalinfo: Starting June 30th 2025 this parameter is mandatory.
- display: Fetch indicators
  name: feed
  defaultvalue: "true"
  type: 8
  required: false
  section: Connect
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  defaultvalue: Bad
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  display: Traffic Light Protocol Color
  name: tlp_color
  defaultvalue: WHITE
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  type: 15
  required: false
  section: Collect
- defaultvalue: indicatorType
  name: feedExpirationPolicy
  display: ''
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  type: 17
  required: false
  section: Collect
- defaultvalue: '20160'
  name: feedExpirationInterval
  display: ''
  type: 1
  required: false
  section: Collect
- display: Feed Fetch Interval
  name: feedFetchInterval
  defaultvalue: "30"
  type: 19
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  required: false
  section: Collect
- defaultvalue: 'true'
  display: Create relationships
  name: create_relationships
  type: 8
  required: false
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
description: Use the MalwareBazaar Feed integration to get the list of malware samples added to MalwareBazaar within the last 60 minutes.
display: MalwareBazaar Feed
name: MalwareBazaar Feed
script:
  commands:
  - arguments:
    - defaultValue: '50'
      description: The maximum number of results to return. The default value is 50.
      name: limit
    description: Gets the feed indicators.
    name: malwarebazzar-get-indicators
  runonce: false
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/py3-tools:1.0.0.10120494
  feed: true
fromversion: 6.0.0
tests:
- Fetch Indicators Test