malware-intel
Triage (tria.ge)
An automated malware sandbox run by Recorded Future, with a large public corpus of analyzed samples. Public reports are searchable by file hash, and API access uses a token from a free Researcher account. A good next step after a hash lookup elsewhere, when you want to see what a sample actually does when executed.
Warum es nützlich ist & wie es funktioniert
Triage, operated by Recorded Future, is a full automated sandbox that runs suspicious files in isolated virtual machines across Windows, Linux, macOS and Android environments and captures what the sample actually does. Its large public corpus of past analyses is searchable by SHA-256 hash on the website at no cost. This is most useful as a second step after a hash lookup elsewhere: once you have a hash of interest, Triage can show you execution traces, network connections and dropped artefacts from a previous run. API access for automated queries requires a free Researcher account and token.
Was drinsteckt
Triage maintains a large public corpus of sandbox reports accumulated from community submissions and its own automated collection. Exact totals are not published, but the corpus spans years of continuous analysis across multiple operating system environments and malware families.
API-Zugang
https://tria.ge/api/v0/search?query=sha256: <h> (Bearer token)
Ein API-Schlüssel ist erforderlich (meist kostenlos); siehe die Endpunkte oben, wo du einen bekommst.
Zugang
Programmatic API access (a key may be required, see the API tag).