malware-intel
MalwareBazaar (abuse.ch)
A free malware-sample repository from abuse.ch, holding millions of samples searchable by hash, tag or malware signature. Queries go through its API, which now requires a free abuse.ch Auth-Key (one key covers their related services). Use it when you have a suspicious file's hash and want to know whether it is a catalogued sample, or need the sample itself for analysis.
Por qué es útil y cómo funciona
MalwareBazaar is the go-to free repository when you want to know whether a hash belongs to a catalogued malware sample and, if so, to download the actual file for your own analysis. It is run by abuse.ch in partnership with Spamhaus and is community-contributed, so samples arrive with tags, YARA matches and antivirus labels already attached. Lookups and downloads go through its API; since 2024 you need a free Auth-Key from auth.abuse.ch to authenticate, but registration is open to anyone.
Qué contiene
MalwareBazaar holds over one million confirmed malware samples submitted by community researchers and threat intelligence providers. The platform answers roughly 100 million API requests per month, reflecting heavy use by automated threat-intelligence pipelines.
Acceso por API
POST https://mb-api.abuse.ch/api/v1/ (query=get_info, hash=); header Auth-Key
Se requiere una clave de API (normalmente gratuita); consulta los endpoints anteriores para saber dónde obtenerla.
Acceso
Programmatic API access (a key may be required, see the API tag).