malware-intel
MalwareBazaar (abuse.ch)
A free malware-sample repository from abuse.ch, holding millions of samples searchable by hash, tag or malware signature. Queries go through its API, which now requires a free abuse.ch Auth-Key (one key covers their related services). Use it when you have a suspicious file's hash and want to know whether it is a catalogued sample, or need the sample itself for analysis.
Por que é útil e como funciona
MalwareBazaar is the go-to free repository when you want to know whether a hash belongs to a catalogued malware sample and, if so, to download the actual file for your own analysis. It is run by abuse.ch in partnership with Spamhaus and is community-contributed, so samples arrive with tags, YARA matches and antivirus labels already attached. Lookups and downloads go through its API; since 2024 you need a free Auth-Key from auth.abuse.ch to authenticate, but registration is open to anyone.
O que há dentro
MalwareBazaar holds over one million confirmed malware samples submitted by community researchers and threat intelligence providers. The platform answers roughly 100 million API requests per month, reflecting heavy use by automated threat-intelligence pipelines.
Acesso via API
POST https://mb-api.abuse.ch/api/v1/ (query=get_info, hash=); header Auth-Key
É necessária uma chave de API (geralmente gratuita); veja os endpoints acima para saber onde obtê-la.
Acesso
Programmatic API access (a key may be required, see the API tag).