malware-intel
MalwareBazaar (abuse.ch)
A free malware-sample repository from abuse.ch, holding millions of samples searchable by hash, tag or malware signature. Queries go through its API, which now requires a free abuse.ch Auth-Key (one key covers their related services). Use it when you have a suspicious file's hash and want to know whether it is a catalogued sample, or need the sample itself for analysis.
Warum es nützlich ist & wie es funktioniert
MalwareBazaar is the go-to free repository when you want to know whether a hash belongs to a catalogued malware sample and, if so, to download the actual file for your own analysis. It is run by abuse.ch in partnership with Spamhaus and is community-contributed, so samples arrive with tags, YARA matches and antivirus labels already attached. Lookups and downloads go through its API; since 2024 you need a free Auth-Key from auth.abuse.ch to authenticate, but registration is open to anyone.
Was drinsteckt
MalwareBazaar holds over one million confirmed malware samples submitted by community researchers and threat intelligence providers. The platform answers roughly 100 million API requests per month, reflecting heavy use by automated threat-intelligence pipelines.
API-Zugang
POST https://mb-api.abuse.ch/api/v1/ (query=get_info, hash=); header Auth-Key
Ein API-Schlüssel ist erforderlich (meist kostenlos); siehe die Endpunkte oben, wo du einen bekommst.
Zugang
Programmatic API access (a key may be required, see the API tag).