Caution

Caution, this program downloads real malware samples. Always use this in a secure and isolated environment.

🐍 MalwareBazaar Lib

A minimal Python wrapper for the MalwareBazaar API 🧪, designed to simplify interaction with the malware sample repository provided by abuse.ch.

✨ Features

• 🔍 Search for malware samples by:
  • 🏷️ Tag
  • File Type
  • Hash (SHA256)
• 📥 Download malware samples

📦 Installation

The lib need 7z Command Line tool:

sudo apt install 7zip

Install the lib via pip:

pip install 

🛠️ Usage

Create a new bazaar Instance:

from mawarebazaar import Bazaar

bazaar = Bazaar(api_key='your-api-key')

Use functions like query_tag:

bazaar.query_tag('mirai', 100)

✅ API Coverage

Feature	Supported
Submission Policy	❌
Submit (upload) a malware sample	❌
Retrieve (download) a malware sample	✅
Query a malware sample (hash)	✅ (Only SHA256)
Query tag	✅
Query signature	❌
Query filetype	✅
Query ClamAV signature	❌
Query imphash	❌
Query TLSH	❌
Query telfhash	❌
Query gimphash	❌
Query icon dhash	❌
Query YARA rule	❌
Query Code Signing Certificates (by Issuer CN)	❌
Query Code Signing Certificates (by Subject CN)	❌
Query Code Signing Certificates (by Serial Number)	❌
Update an entry	❌
Add a comment	❌
Query latest malware samples (recent additions)	❌
Query Code Signing Certificate Blocklist (CSCB)	❌

🤝 Contributing

Contributions are very welcome! 🎉 Whether it's fixing a bug 🐞, improving the docs 📝, or adding a new feature 🚀 — feel free to submit a pull request.