Malware Bazaar Go Wrapper

This library wraps the Malware Bazaar api

Authentication (REQUIRED)

abuse.ch made authentication mandatory for the MalwareBazaar API. Every request must carry an Auth-Key header, so this library now requires a key for all operations (the old optional API-KEY header no longer works).

Get a free Auth-Key by creating a profile at https://auth.abuse.ch/.

Usage

client, err := malwarebazaar.New(os.Getenv("MALWAREBAZAAR_API_KEY"))
if err != nil {
    log.Fatal(err) // returned when the key is empty
}

// Query a sample by hash (SHA256, MD5, or SHA1)
entries, err := client.QueryHash(ctx, "094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d")

// Query samples by signature / family name
entries, err = client.QuerySignature(ctx, "TrickBot", 10)

// Get the latest samples (TimeSelect = last 60 minutes, CountSelect = last 100)
entries, err = client.QueryLatest(ctx, malwarebazaar.TimeSelect)

// Download a sample (returned as an AES encrypted zip, password "infected")
encryptedZip, err := client.Download(ctx, "094fd325049b8a9cf6d3e5ef2a6d4cc6a567d7d49c35f8bb8dd9e3c6acf3d78d")

// Decrypt to the raw malware content
rawFile, err := malwarebazaar.GetRawFile(encryptedZip)

Supported Functionality

Query

• Query a malware hash
• Query a tag
• Query signature information
• Query ClamAV signature information
• Query Yara rule information

Download and Upload

• Download a sample
  • Decrypt helper function
• Query latest malware samples
• Submit/Upload a sample
• Download daily malware batches
• Update an entry
• Add a comment

Tests

The live API tests only run when MALWAREBAZAAR_API_KEY is set; otherwise they are skipped:

MALWAREBAZAAR_API_KEY=your-auth-key go test ./...