malware-intel
Triage (tria.ge)
An automated malware sandbox run by Recorded Future, with a large public corpus of analyzed samples. Public reports are searchable by file hash, and API access uses a token from a free Researcher account. A good next step after a hash lookup elsewhere, when you want to see what a sample actually does when executed.
Why it’s useful & how it works
Triage, operated by Recorded Future, is a full automated sandbox that runs suspicious files in isolated virtual machines across Windows, Linux, macOS and Android environments and captures what the sample actually does. Its large public corpus of past analyses is searchable by SHA-256 hash on the website at no cost. This is most useful as a second step after a hash lookup elsewhere: once you have a hash of interest, Triage can show you execution traces, network connections and dropped artefacts from a previous run. API access for automated queries requires a free Researcher account and token.
What’s inside
Triage maintains a large public corpus of sandbox reports accumulated from community submissions and its own automated collection. Exact totals are not published, but the corpus spans years of continuous analysis across multiple operating system environments and malware families.
API access
https://tria.ge/api/v0/search?query=sha256: <h> (Bearer token)
An API key is required (usually free); see the endpoints above for where to get one.
What we measured
Our own probes, not the archive’s own claims. Re-run periodically; every reading below is dated.
Reachability
- Direct request
- Responded HTTP 200 323 ms
- Through a datacenter proxy
- Responded HTTP 200 675 ms
Reachability measured 2026-08-22.
Access
Programmatic API access (a key may be required, see the API tag).