MalwareBazaar API

API-Key

In order to submit (upload) a malware sample to MalwareBazaar, an API key is needed. You can obtain one by logging in to MalwareBazaar with your Twitter account. Afterwards you can access your API key in your Account settings.

Submission Policy

Before you start to submit malware samples to MalwareBazaar, please read the following submission policy:

• Confirmed malware only: Please do only submit confirmed / vetted malware samples to MalwareBazaar. Do not submit any suspicious or benign files to MalwareBazaar.
• Adware is not malware: Unlike Malware, most common Adware (aka Potential Unwanted Programs - PUPs) do need some sort of user interaction. In many cases, they also come with a licences agreement that the user has to accept and that is more or less transparent with regards to what the Adware does. Please refrain from submitting Adware to MalwareBazaar.
• Fresh malware samples: There are gazillions malware samples out there. Please refrain from uploading malware samples older than 10 days to MalwareBazaar.
• No file infectors: Please do not upload any file infectors.

Note: Should you repeatedly violate the submission policy documented above, your account may get banned from contributing to MalwareBazaar.

Upload malware samples

You can upload (submit) malware samples to MalwareBazaar by using the API documented below, sending a multipart form POST request with file (the actual file you want to submit) and json_data (see documentation below) to https://mb-api.abuse.ch/api/v1/.

To authenticate your request, you must send the HTTP header API-KEY with your personal API-Key with every request. You can view your API-Key here.
Example HTTP header:

Possible response values are:

Here's a sample python3 script that submits malware sample to MalwareBazaar

#!/usr/bin/env python3
import requests
import sys
import json

if len(sys.argv) > 1:
    file = sys.argv[1]
else:
    print("Usage: python3 malware_Bazaar_submit.py <file>")
    quit()

headers = {'API-KEY': 'XYZ123'}
data = {
    'anonymous': 1,
    'delivery_method': 'email_attachment',
    'tags': [
        'exe',
        'test'
    ],
    'references': {
            'any_run': [
                'https://app.any.run/tasks/1',
                'https://app.any.run/tasks/2'
            ],
            'joe_sandbox': [
                'https://www.joesecurity.org/reports/1',
                'https://www.joesecurity.org/reports/2'
            ],
            'malpedia': [
                'https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi'
            ],
            'twitter': [
                'https://twitter.com/abuse_ch/status/1224269018506330112'
            ],
            'links': [
                'https://urlhaus.abuse.ch/url/306613/',
            ]
    },
    'context': {
            'dropped_by_md5': [
                '68b329da9893e34099c7d8ad5cb9c940'
            ],
            'dropped_by_sha256': [
                '01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b',
                '4355a46b19d348dc2f57c046f8ef63d4538ebb936000f3c9ee954a27460dd865'
            ],
            'dropped_by_malware': [
                'Gozi'
            ],
            'comment': 'this malware sample is very nasty!'
    }
}
files = {
    'json_data': (None, json.dumps(data), 'application/json'),
    'file': (open(file,'rb'))
    }
response = requests.post('https://mb-api.abuse.ch/api/v1/', files=files, verify=False, headers=headers)
        

Retrieve (download) a malware sample

You can download (fetch) malware samples from MalwareBazaar by using the API documented below, sending an HTTP POST request to https://mb-api.abuse.ch/api/v1/. Please note that any malware sample you download from MalwareBazaar will be zipped and password protected using the password "infected" (without "").

Please note that there is a daily limit for file downloads on the API that is documented here.

Possible response values are:

Here's a sample wget request on how to fetch a file:

wget --post-data "query=get_file&sha256_hash=094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d" https://mb-api.abuse.ch/api/v1/
        

Query a malware sample (hash)

You can check if a particular malware sample is known to MalwareBazaar by query the API for the corresponding hash (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a hash:

wget --post-data "query=get_info&hash=7de2c1bf58bce09eecc70476747d88a26163c3d6bb1d85235c24a558d1f16754" https://mb-api.abuse.ch/api/v1/
        

Query tag

You can get a list of malware samples (max 1'000) associated with a specific tag by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a tag:

wget --post-data "query=get_taginfo&tag=TrickBot&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query signature

You can get a list of recent malware samples (max 1'000) associated with a specific signature by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a signature:

wget --post-data "query=get_siginfo&signature=TrickBot&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query filetype

You can get a list of recent malware samples (max 1'000) having a specifc filetype by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a file_type:

wget --post-data "query=get_file_type&file_type=elf&limit=10" https://mb-api.abuse.ch/api/v1/
        

Query ClamAV signature

You can get a list of recent malware samples (max 1'000) associated with a specific ClamAV signature by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a clamav signature:

wget --post-data "query=get_clamavinfo&clamav=Doc.Downloader.Emotet-7580152-0&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query imphash

You can get a list of malware samples (max 1'000) associated with a specific imphash by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a imphash:

wget --post-data "query=get_imphash&imphash=45d579faec0eaf279c0841b2233727cf&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query TLSH

You can get a list of malware samples (max 1'000) associated with a specific TLSH hash by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a TLSH hash:

wget --post-data "query=get_tlsh&tlsh=4FB44AC6A19643BBEE8766FF358AC55DBC13D91C1B4DB4FBC789AA020A31B05ED12350&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query telfhash

You can get a list of malware samples (max 1'000) associated with a specific telfhash hash by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a TLSH hash:

wget --post-data "query=get_telfhash&telfhash=ea2106f51e7e58d9b7e4a400c29b5f623d5df13b299037a00463e93033abe466069c7a&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query gimphash

You can get a list of malware samples (max 1'000) associated with a specific gimphash by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a TLSH hash:

wget --post-data "query=get_gimphash&gimphash=50f5783c2188897815d9b34a77aa4df70ac96a71542ddc79b94fef8ce7ba2120&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query icon dhash

You can get a list of malware samples (PE executables only, max 1'000) that are having a specific icon using the icon's dhash. In order to do so, you must query t he API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a TLSH hash:

wget -O - --post-data "query=get_dhash_icon&dhash_icon=48b9b2b0e8c18c90&limit=5" https://mb-api.abuse.ch/api/v1/
        

You can caluclate the dhash of an icon from a PE32 executable by using the following script:

• https://gist.github.com/fr0gger/1263395ebdaf53e67f42c201635f256c

Query YARA rule

You can get a list of malware samples (max 1'000) associated with a specific YARA rule by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a yara_rule:

wget --post-data "query=get_yarainfo&yara_rule=win_remcos_g0&limit=50" https://mb-api.abuse.ch/api/v1/
        

Query Code Signing Certificates (by Issuer CN)

You can get a list of malware samples (max 100) that are using code sign certificate issued by a certain Certificate Authority (Issuer CN) by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a issuer_cn:

wget --post-data "query=get_issuerinfo&issuer_cn=Sectigo RSA Code Signing CA" https://mb-api.abuse.ch/api/v1/
        

Query Code Signing Certificates (by Subject CN)

You can get a list of malware samples (max 100) that are signed with a code sign certificate that matches a certain Subject Common Name (CN) by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a issuer_cn:

wget --post-data "query=get_subjectinfo&subject_cn=Ekitai Data Inc." https://mb-api.abuse.ch/api/v1/
        

Query Code Signing Certificates (by Serial Number)

You can get a list of malware samples (max 100) that are signed with a code sign certificate identified by a specific Serial Number by query the API as follow (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to query the API for a issuer_cn:

wget --post-data "query=get_certificate&serial_number=51CD5393514F7ACE2B407C3DBFB09D8D" https://mb-api.abuse.ch/api/v1/
        

Update an entry

You can update an existing entry by sending a HTTP POST request to https://mb-api.abuse.ch/api/v1/ as documented below (using HTTP POST form data). Please note that you can only update entries that you have created by your own.

Possible response values are:

Here's a sample python3 script that submits malware sample to MalwareBazaar:

  #!/usr/bin/env python3
  import requests
  import json

  headers = { 'API-KEY': 'XYZ' }

  data = {
      'query': 'update',
      'sha256_hash': 'd9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77b',
      'key': 'links',
      'value': 'https://www.abuse.ch'
  }

  response = requests.post('https://mb-api.abuse.ch/api/v1/', data=data, timeout=15, headers=headers)
  print(response.content.decode("utf-8", "ignore"))
        

Add a comment

You can comment a malware sample by sending a HTTP POST request to https://mb-api.abuse.ch/api/v1/ as documented below (using HTTP POST form data).

Possible response values are:

Here's a sample python3 script for commenting a malware sample:

  #!/usr/bin/env python3
  import requests
  import json

  headers = { 'API-KEY': 'XYZ' }

  data = {
      'query': 'add_comment',
      'sha256_hash': 'd9b05da007d51cf86d4a6448d17183ab69a195436fe17b497185149676d0e77b',
      'comment': 'Swiss chocolate is the best chocolate'
  }

  response = requests.post('https://mb-api.abuse.ch/api/v1/', data=data, timeout=15, headers=headers)
  print(response.content.decode("utf-8", "ignore"))
        

Query latest malware samples (recent additions)

I you can retrieve a list of malware samples added to MalwareBazaar within the last 60 minutes as documented below (using HTTP POST form data):

Alternatively, you can query the API for the most recent 100 additions as documented below:

Possible response values are:

Here's a sample wget request on how to fetch a list of recent malware samples for the past 60 minutes:

wget --post-data "query=get_recent&selector=time" https://mb-api.abuse.ch/api/v1/
        

A response from the API looks like this:

    {
    	"query_status": "ok",
    	"data": [
        {
    			"sha256_hash": "e167b20f1acf48f7ce0ae33a218e2c1b300b41c012ededf03e7a3522a4ebe95e",
    			"sha1_hash": "eb0e81598d8526d88cac4695a3e9360cc8fbb331",
    			"md5_hash": "7338b335ad5471cb67658f27836374f0",
    			"first_seen": "2020-03-01 05:57:01",
    			"last_seen": null,
    			"file_name": "file",
    			"file_size": 145408,
    			"file_type_mime": "application\/x-dosexec",
    			"file_type": "exe",
    			"reporter": "viql",
    			"anonymous": 0,
    			"signature": "RevengeRAT",
    			"imphash": "f34d5f2d4577ed6d9ceec516c1f5a744",
          "tlsh": "11B2194E3FA98856C4BC177486B5965003B091870423EE2FCDC550CBAFB3AD92D88AF9",
    			"ssdeep": "1536:sGZWpdxayQAcj7gwluW14Z2II0ocL8ppVy8U+M76JMaDZVB0pI6lxYGinsPF9WPz:7dPIocwpPMGP9SBlxp+st9gTp5",
          "magika": "pebin",
    			"tags": [
    				"revengerat"
    			],
    			"intelligence": {
    				"clamav": "Win.Trojan.Generic-6332612-0",
    				"downloads": "0",
    				"uploads": "1",
    				"mail": null
    			}
    		},
    		{
    			"sha256_hash": "7c032beb567b18670073727a6b1fba146e2daf128c5abd51279c7ad0b7d3c482",
    			"sha1_hash": "9189b6d2493ef46e9bc100c8703e2562982a98fc",
    			"md5_hash": "c7a583745df676615eb1b7cab158d397",
    			"first_seen": "2020-02-18 10:43:15",
    			"last_seen": null,
    			"file_name": "Jamil Marzouka Co.pdf.jar",
    			"file_size": 62118,
    			"file_type_mime": "application\/zip",
    			"file_type": "jar",
    			"reporter": "abuse_ch",
    			"anonymous": 0,
    			"signature": "Adwind",
    			"imphash": null,
          "tlsh": "11B2194E3FA98856C4BC177486B5965003B091870423EE2FCDC550CBAFB3AD92D88AF9",
    			"ssdeep": "1536:3M+ZXQ4\/0d0JUxYpugXo9dboZ89cn+xzl0rHfFcMjrYaOK+UyBstRgFq:3M+Np0dKUGLo9doZMXxp43uszgFq",
          "magika": "jar",
    			"tags": [
    				"Adwind",
    				"jar",
    				"qua"
    			],
    			"intelligence": {
    				"clamav": null,
    				"downloads": "0",
    				"uploads": "1",
    				"mail": {
    					"IT": "low",
    					"Generic": "low"
    				}
    			}
    		}
    	]
    }
      

Query Code Signing Certificate Blocklist (CSCB)

You can dump the content of the MalwareBazaar Code Signing Certificate Blocklist (CSCB) as documented below (using HTTP POST form data):

Possible response values are:

Here's a sample wget request on how to fetch a list the CSCB:

      wget --post-data "query=get_cscb" https://mb-api.abuse.ch/api/v1/
        

A response from the API looks like this:

{
  "time_stamp": "2020-11-02 08:33:54",
  "serial_number": "6CFA5050C819C4ACBB8FA75979688DFF",
  "thumbprint": "E7241394097402BF9E32C87CADA4BA5E0D1E9923F028683713C2F339F6F59FA9",
  "thumbprint_algorithm": "SHA256",
  "subject_cn": "Elite Web Development Ltd.",
  "issuer_cn": "Sectigo RSA Code Signing CA",
  "valid_from": "Jul  2 00:00:00 2020 GMT",
  "valid_to": "Jul  2 23:59:59 2021 GMT",
  "cscb_listed": true,
  "cscb_reason": "CobaltStrike"
},
{
  "time_stamp": "2020-11-02 08:33:37",
  "serial_number": "B8164F7143E1A313003AB0C834562F1F",
  "thumbprint": "263C636C5DE68F0CD2ADF31B7AEBC18A5E00FC47A5E2124E2A5613B9A0247C1E",
  "thumbprint_algorithm": "SHA256",
  "subject_cn": "Ekitai Data Inc.",
  "issuer_cn": "Sectigo RSA Code Signing CA",
  "valid_from": "Aug 25 00:00:00 2020 GMT",
  "valid_to": "Aug 25 23:59:59 2021 GMT",
  "cscb_listed": true,
  "cscb_reason": "TA505"
},
{
  "time_stamp": "2020-11-02 08:33:33",
  "serial_number": "E3C7CC0950152E9CEEAD4304D01F6C89",
  "thumbprint": "82975E3E21E8FD37BB723DE6FDB6E18DF9D0E55F0067CC77DD571A52025C6724",
  "thumbprint_algorithm": "SHA256",
  "subject_cn": "DNS KOMPLEKT",
  "issuer_cn": "Sectigo RSA Code Signing CA",
  "valid_from": "Jun  8 00:00:00 2020 GMT",
  "valid_to": "Jun  8 23:59:59 2021 GMT",
  "cscb_listed": true,
  "cscb_reason": "Gozi"
}
        

Download hourly malware batches

MalwareBazaar generates hourly batches of fresh malware samples. The hourly batches are generated every hour. Please consider that it takes a few minutes to generate the batch. The hourly batches are available here:

• MalwareBazaar hourly malware batches (ZIP password: infected)

Download daily malware batches

MalwareBazaar generates daily batches of fresh malware samples. The daily batches are generated once a day at midnight (00:00 UTC). Please consider that it takes a few minutes to generate the batch. The daily batches are available here:

• MalwareBazaar daily malware batches (ZIP password: infected)

Example python3 scripts

@cocaman has created a github repository with a handful example scripts on how to leverage the MalwareBazaar API:

• https://github.com/cocaman/malware-bazaar

Additional sample scripts how to query the MalwareBazaar API can be found here:

• MalBazaar_Query.py - python3 script to query MalwareBazaar for a give file or hash
• MalBazaar_Query.ps1 - PowerShell script to query MalwareBazaar for a give file or hash

Terms of Services (ToS)

By using the website of MalwareBazaar, or any of the services / datasets referenced above, you agree that:

• All datasets offered by MalwareBazaar can be used for both, commercial and non-commercial purpose without any limitations (CC0)
• Any data offered by MalwareBazaar is served as it is on best effort
• MalwareBazaar can not be held liable for any false positive or damage caused by the use of the website or the datasets offered above
• Any submission to MalwareBazaar will be treated and shared under TLP:WHITE and under Creative Commons No Rights Reserved (CC0)
• It is forbidden to use MalwareBazaar to distribute malware and/or infect any devices for malicious purpose