Database with malware hashes

n1d0

New Member
Thread author
Apr 3, 2024
2
Hi everyone, I'm working on a cybersecurity project, and part of it involves comparing files to malware samples to determine if the scanned file is malware.

Therefore I need a database that contains malware hashes to perform this step.

If anyone knows of a site that contains something similar to what I require, I would appreciate it.
 
  • Like
Reactions: Jack

Trident

Level 34
Verified
Top Poster
Well-known
Feb 7, 2023
2,349
Just malware hashes, you must use an API such as bazaar or VT API.

Code:
 tip.kaspersky.com/Help/Doc_data/en-US/ThreatLookupAPI.htm

Some of these APIs are not free, subscriptions are required as threat intelligence, specially when curated and properly checked for FPs is not free.
Many AV vendors offer APIs as well.
The Bazaar API should be free but it is plagued with false positives.
You implement it via HTTP Post request like this:
Code:
wget --post-data "query=get_info&hash=7de2c1bf58bce09eecc70476747d88a26163c3d6bb1d85235c24a558d1f16754" https://mb-api.abuse.ch/api/v1/

In addition, the Sophos Sorel collection contains 20 million samples you can use to train ML models, be advised that you will also need a large number of safe files for false positives control.

I also found this, that contains more APIs, supposedly open source.
 
Last edited by a moderator:

Kongo

Level 36
Verified
Top Poster
Well-known
Feb 25, 2017
2,593
Too bad that Malc0de, MDL and clean-mx are no more. But the S!Ri site is still there:


Edit: I forgot about Malwshare:

I also used VxVault years ago. But now you need to apply to get access and I don't even know where
 

n1d0

New Member
Thread author
Apr 3, 2024
2
Just malware hashes, you must use an API such as bazaar or VT API.
Code:
 tip.kaspersky.com/Help/Doc_data/en-US/ThreatLookupAPI.htm

Some of these APIs are not free, subscriptions are required as threat intelligence, specially when curated and properly checked for FPs is not free.
Many AV vendors offer APIs as well.
The Bazaar API should be free but it is plagued with false positives.
You implement it via HTTP Post request like this:
Code:
wget --post-data "query=get_info&hash=7de2c1bf58bce09eecc70476747d88a26163c3d6bb1d85235c24a558d1f16754" https://mb-api.abuse.ch/api/v1/

In addition, the Sophos Sorel collection contains 20 million samples you can use to train ML models, be advised that you will also need a large number of safe files for false positives control.

I also found this, that contains more APIs, supposedly open source.

Hello, Trident.

The Malware BaaZar website contains the information I am looking for. Thank you very much also for the documentation that you shared, it may be useful to me.
 
Last edited by a moderator:

B-boy/StyLe/

Level 3
Verified
Well-known
Mar 10, 2023
147
I also used VxVault years ago. But now you need to apply to get access and I don't even know where
That's true. However, the hashes are still visible (and that's what the OP asked for if I am not mistaken).
Also, the VT links are visible as well, and most malware researchers can download malware samples directly from VT.
So VxVault can still be useful. :):)
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top