Merge pull request #70 from alexandreborges/dev

Malwoverview 6.2 | merge from dev to master.

Authorized by Alexandre Borges.

Author: alexandreborges

.malwapi.conf

@@ -29,4 +29,10 @@ INQUESTAPI =
 VXAPI = 
 
 [IPINFO]
-IPINFOAPI =
+IPINFOAPI =
+
+[BAZAAR]
+BAZAARAPI = 
+
+[THREATFOX]
+THREATFOXAPI = 

README.md

@@ -1,6 +1,6 @@
 # Malwoverview
 
-[<img alt="GitHub release (latest by date)" src="https://img.shields.io/github/v/release/alexandreborges/malwoverview?color=red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases/tag/v6.1.1) [<img alt="GitHub last commit" src="https://img.shields.io/github/last-commit/alexandreborges/malwoverview?color=Yellow&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/alexandreborges/malwoverview?label=Release%20Date&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub" src="https://img.shields.io/github/license/alexandreborges/malwoverview?style=for-the-badge">](https://github.com/alexandreborges/malwoverview/blob/master/LICENSE) 
+[<img alt="GitHub release (latest by date)" src="https://img.shields.io/github/v/release/alexandreborges/malwoverview?color=red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases/tag/v6.2) [<img alt="GitHub last commit" src="https://img.shields.io/github/last-commit/alexandreborges/malwoverview?color=Yellow&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub Release Date" src="https://img.shields.io/github/release-date/alexandreborges/malwoverview?label=Release%20Date&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/releases) [<img alt="GitHub" src="https://img.shields.io/github/license/alexandreborges/malwoverview?style=for-the-badge">](https://github.com/alexandreborges/malwoverview/blob/master/LICENSE) 
 [<img alt="GitHub stars" src="https://img.shields.io/github/stars/alexandreborges/malwoverview?logoColor=Red&style=for-the-badge">](https://github.com/alexandreborges/malwoverview/stargazers)
 [<img alt="Twitter Follow" src="https://img.shields.io/twitter/follow/ale_sp_brazil?style=for-the-badge&logo=X&color=blueviolet">](https://twitter.com/ale_sp_brazil)
 [<img alt="Downloads/Last Month" src="https://img.shields.io/pypi/dm/malwoverview?color=blue&style=for-the-badge&label=Last%20Month">](https://pypistats.org/packages/malwoverview)
@@ -73,7 +73,7 @@
       See GNU Public License on <http://www.gnu.org/licenses/>.
 
 
-## Current Version: 6.1.1
+## Current Version: 6.2
 
      Important note:  Malwoverview does NOT submit samples to any endpoint by default, 
      so it respects possible Non-Disclosure Agreements (NDAs). There're specific options
@@ -152,7 +152,7 @@ branch and a new Python package is generated.
 This tool has been tested on REMnux, Ubuntu, Kali Linux, macOS and Windows. Malwoverview 
 can be installed by executing the following command:
 
-      * pip3.11 install git+https://github.com/alexandreborges/malwoverview (preferred method) 
+      * pip3.11 install git+https://github.com/alexandreborges/malwoverview
       
       or...
       
@@ -182,16 +182,13 @@ AFTER having installed Malwoverview:
 
 ## REQUIRED APIs
 
-Malwoverview does not require to insert all APIs anymore. Therefore, professionals can 
-us it without having registered such APIs. Obviously, to use certain options is necessary to 
-add respective API into .malwapi.conf file, whose format is shown below. 
-
-To use all options of Malwoverview you must insert respective API of the following services:
+It is possible to start using Malwoverview does without inserting all APIs. However, 
+to use all options of Malwoverview, you must insert the respective API of the following services:
 VirusTotal, Hybrid Analysis, URLHaus, Malshare, Polyswarm, Alien Vault, Malpedia, Triage, 
-InQuest, Virus Exchange and APInfo into the .malwapi.conf configuration file, which must be present 
-(or created) in the home directory (/home/[username] or /root on Linux, and C:\Users\[username] 
-on Windows. Alternatively, users could create a custom configuration file and indicate it by 
-using the -c option.
+InQuest, Virus Exchange, APInfo, Malware Bazaar and ThreatFox into the .malwapi.conf 
+configuration file, which must be present (or created) in the home directory (/home/[username]
+or /root on Linux, and C:\Users\[username] on Windows. Alternatively, users can create 
+a custom configuration file and indicate it by using the -c option.
 
 To highlight: if the .malwapi.conf file does not exist in your home directory, so you must 
 create it!
@@ -233,6 +230,12 @@ The .malwapi.conf configuration file has the following format:
 
       [IPINFO]
       IPINFOAPI =  
+      
+      [BAZAAR]
+      BAZAARAPI = 
+
+      [THREATFOX]
+      THREATFOXAPI = 
 
 The APIs can be requested on the respective service websites:
 
@@ -245,17 +248,17 @@ The APIs can be requested on the respective service websites:
 07. Malpedia: It doesn't offer open registration, but you can request an user account 
     directly through Twitter (DM) or feedback e-email. The Malpedia Twitter 
     handle is @malpedia.
-08. Malware Bazaar: It isn't necessary an API.
-09. ThreatFox: It isn't necessary an API.
+08. Malware Bazaar: https://bazaar.abuse.ch/api/#auth\_key
+09. ThreatFox: https://threatfox.abuse.ch/api/#auth\_key
 10. InQuest: https://labs.inquest.net/.
 11. Triage: https://tria.ge/signup.
 12. Virus Exchange: https://virus.exchange/ 
 13. IPInfo: https://ipinfo.io/ 
-14. BGPView: ihttps://bgpview.docs.apiary.io/
+14. BGPView: https://bgpview.docs.apiary.io/
 
 
 ----------------------------------------------------
-A special note about API requests to the MALPEDIA:
+Note about API requests to the MALPEDIA:
 ----------------------------------------------------
 
 The service and acceptance is based on the community vetting. Thus, it's recommended 
@@ -267,7 +270,7 @@ legitimacy, so making quicker the approval of your request.
 
 
 ----------------------------------------------------
-Additional explanation about Triage:
+Note about Triage:
 ----------------------------------------------------
 
 Every Triage operation is based on the Triage ID of each artifact, so you need to
@@ -276,6 +279,14 @@ so use this ID information with the remaining Triage options (-x [2-7]) for gett
 further threat hunting information from Triage endpoint.
 
 
+----------------------------------------------------
+Note about Malware Bazaar and Threat Fox: 
+----------------------------------------------------
+
+Since second semester of 2025, it is required the Auth-Key (API) to use Malware 
+Bazaar and Threat Fox services.
+
+
 ----------------------------------------------------
 Note about background color of the terminal:
 ----------------------------------------------------
@@ -787,6 +798,13 @@ Malwoverview is a first response tool for threat hunting written by Alexandre Bo
 ## HISTORY
 
 
+Version 6.2:
+
+      This version:
+
+            * Modifies Malware Bazaar option to use Auth-Key.
+            * Modifies Threat Fox option to use Auth-Key.
+
 Version 6.1.1:
 
       This version:

malwoverview/malwoverview.py

@@ -21,7 +21,7 @@
 # Christian Clauss (https://github.com/cclauss)
 # Artur Marzano (https://github.com/Macmod)
 
-# Malwoverview.py: version 6.1.1
+# Malwoverview.py: version 6.2
 
 import os
 import argparse
@@ -56,7 +56,7 @@
 __author__ = "Alexandre Borges"
 __copyright__ = "Copyright 2018-2025, Alexandre Borges"
 __license__ = "GNU General Public License v3.0"
-__version__ = "6.1.1"
+__version__ = "6.2"
 __email__ = "reverseexploit at proton.me"
 
 def finish_hook(signum, frame):
@@ -133,6 +133,8 @@ def getoption(section, name):
     INQUESTAPI = getoption('INQUEST', 'INQUESTAPI')
     VXAPI = getoption('VIRUSEXCHANGE', 'VXAPI')
     IPINFOAPI = getoption('IPINFO', 'IPINFOAPI')
+    BAZAARAPI = getoption('BAZAAR', 'BAZAARAPI')
+    THREATFOXAPI = getoption('THREATFOX', 'THREATFOXAPI')
 
     optval = range(2)
     optval1 = range(3)
@@ -227,8 +229,8 @@ def getoption(section, name):
     # Module objects
     polyswarm = PolyswarmExtractor(POLYAPI)
     alien = AlienVaultExtractor(ALIENAPI)
-    bazaar = BazaarExtractor()
-    threatfox = ThreatFoxExtractor()
+    bazaar = BazaarExtractor(BAZAARAPI)
+    threatfox = ThreatFoxExtractor(THREATFOXAPI)
     triage = TriageExtractor(TRIAGEAPI)
     inquest = InQuestExtractor(INQUESTAPI)
     malpedia = MalpediaExtractor(MALPEDIAAPI)

malwoverview/modules/bazaar.py

@@ -7,15 +7,22 @@
 class BazaarExtractor():
     urlbazaar = 'https://mb-api.abuse.ch/api/v1/'
 
-    def __init__(self):
-        pass
+    def __init__(self, BAZAARAPI):
+        self.BAZAARAPI = BAZAARAPI
+
+    def requestBAZAARAPI(self):
+        if (self.BAZAARAPI == ''):
+            print(mycolors.foreground.red + "\nTo be able to get/submit information from/to Malware Bazaar, you must create the .malwapi.conf file under your user home directory (on Linux is $HOME\\.malwapi.conf and on Windows is in C:\\Users\\[username]\\.malwapi.conf) and insert the Malware Bazaar API (Auth-Key) according to the format shown on the Github website." + mycolors.reset + "\n")
+            exit(1)
 
     def bazaar_tag(self, bazaarx):
         bazaar = BazaarExtractor.urlbazaar
         bazaartext = ''
         bazaarresponse = ''
         params = ''
 
+        self.requestBAZAARAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "MALWARE BAZAAR REPORT".center(100)), end='')
@@ -24,6 +31,7 @@ def bazaar_tag(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.BAZAARAPI})
             params = {'query': 'get_taginfo', "tag": bazaarx, "limit": 50}
             bazaarresponse = requestsession.post(bazaar, data=params)
             bazaartext = json.loads(bazaarresponse.text)
@@ -201,6 +209,8 @@ def bazaar_imphash(self, bazaarx):
         bazaartext = ''
         params = ''
 
+        self.requestBAZAARAPI()
+
         try:
 
             print("\n")
@@ -210,6 +220,7 @@ def bazaar_imphash(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.BAZAARAPI})
             params = {'query': 'get_imphash', "imphash": bazaarx, "limit": 50}
             bazaarresponse = requestsession.post(bazaar, data=params)
             bazaartext = json.loads(bazaarresponse.text)
@@ -389,6 +400,8 @@ def bazaar_lastsamples(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestBAZAARAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "MALWARE BAZAAR REPORT".center(100)), end='')
@@ -397,6 +410,7 @@ def bazaar_lastsamples(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.BAZAARAPI})
             params = {'query': 'get_recent', "selector": bazaarx}
             bazaarresponse = requestsession.post(bazaar, data=params)
             bazaartext = json.loads(bazaarresponse.text)
@@ -570,6 +584,8 @@ def bazaar_download(self, bazaarx):
         params = ''
         resource = bazaarx
 
+        self.requestBAZAARAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "MALWARE BAZAAR REPORT".center(100)), end='')
@@ -578,6 +594,7 @@ def bazaar_download(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/gzip'})
+            requestsession.headers.update({'Auth-Key': self.BAZAARAPI})
             params = {'query': 'get_file', "sha256_hash": bazaarx}
             bazaarresponse = requestsession.post(bazaar, data=params, allow_redirects=True)
             bazaartext = bazaarresponse.text
@@ -623,6 +640,8 @@ def bazaar_hash(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestBAZAARAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "MALWARE BAZAAR REPORT".center(100)), end='')
@@ -631,6 +650,7 @@ def bazaar_hash(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.BAZAARAPI})
             params = {'query': 'get_info', "hash": bazaarx}
             bazaarresponse = requestsession.post(bazaar, data=params)
             bazaartext = json.loads(bazaarresponse.text)

malwoverview/modules/threatfox.py

@@ -7,8 +7,13 @@
 class ThreatFoxExtractor():
     urlthreatfox = 'https://threatfox-api.abuse.ch/api/v1/'
 
-    def __init__(self):
-        pass
+    def __init__(self,THREATFOXAPI):
+        self.THREATFOXAPI = THREATFOXAPI
+
+    def requestTHREATFOXAPI(self):
+        if (self.THREATFOXAPI == ''):
+            print(mycolors.foreground.red + "\nTo be able to get/submit information from/to THREATFOX, you must create the .malwapi.conf file under your user home directory (on Linux is $HOME\\.malwapi.conf and on Windows is in C:\\Users\\[username]\\.malwapi.conf) and insert the THREATFOX API (Auth-Key) according to the format shown on the Github website." + mycolors.reset + "\n")
+            exit(1)
 
     def threatfox_listiocs(self, bazaarx):
         bazaar = ThreatFoxExtractor.urlthreatfox
@@ -17,6 +22,8 @@ def threatfox_listiocs(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestTHREATFOXAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "THREATFOX REPORT".center(100)), end='')
@@ -25,6 +32,7 @@ def threatfox_listiocs(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.THREATFOXAPI})
             params = {'query': "get_iocs", 'days': int(bazaarx)}
 
             bazaarresponse = requestsession.post(
@@ -196,6 +204,8 @@ def threatfox_searchiocs(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestTHREATFOXAPI()
+
         try:
             print("\n")
             print((mycolors.reset + "THREATFOX REPORT".center(100)), end='')
@@ -204,6 +214,7 @@ def threatfox_searchiocs(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.THREATFOXAPI})
             params = {'query': "search_ioc", 'search_term': bazaarx}
             bazaarresponse = requestsession.post(url=bazaar, data=json.dumps(params))
             bazaartext = json.loads(bazaarresponse.text)
@@ -386,6 +397,8 @@ def threatfox_searchtags(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestTHREATFOXAPI()
+
         try:
 
             print("\n")
@@ -395,6 +408,7 @@ def threatfox_searchtags(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.THREATFOXAPI})
             params = {'query': "taginfo", 'tag': bazaarx}
             bazaarresponse = requestsession.post(url=bazaar, data=json.dumps(params))
             bazaartext = json.loads(bazaarresponse.text)
@@ -584,6 +598,8 @@ def threatfox_searchmalware(self, bazaarx):
         bazaarresponse = ''
         params = ''
 
+        self.requestTHREATFOXAPI()
+
         try:
 
             print("\n")
@@ -593,6 +609,7 @@ def threatfox_searchmalware(self, bazaarx):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.THREATFOXAPI})
             params = {'query': "malwareinfo", 'malware': bazaarx}
             bazaarresponse = requestsession.post(url=bazaar, data=json.dumps(params))
             bazaartext = json.loads(bazaarresponse.text)
@@ -775,6 +792,8 @@ def threatfox_listmalware(self):
         bazaarresponse = ''
         params = ''
 
+        self.requestTHREATFOXAPI()
+
         try:
 
             print("\n")
@@ -784,6 +803,7 @@ def threatfox_listmalware(self):
 
             requestsession = requests.Session()
             requestsession.headers.update({'accept': 'application/json'})
+            requestsession.headers.update({'Auth-Key': self.THREATFOXAPI})
             params = {'query': "malware_list"}
             bazaarresponse = requestsession.post(url=bazaar, data=json.dumps(params))
             bazaartext = json.loads(bazaarresponse.text)

malwoverview/modules/triage.py

@@ -746,7 +746,7 @@ def triage_download(self, triagex):
                         print("\n" + mycolors.foreground.red + triagetext['message'] + mycolors.reset, end='\n\n')
                     exit(1)
 
-            outputpath = os.path.join(cv.output_dir, )
+            outputpath = os.path.join(cv.output_dir, triagex)
             open(outputpath, 'wb').write(triageresponse.content)
             if (cv.bkg == 1):
                 print("\n" + mycolors.foreground.yellow + f"Sample downloaded to: {outputpath}" + mycolors.reset, end=' ')

setup.py

@@ -11,7 +11,7 @@
 
 setup(
     name="malwoverview",
-    version="6.1.1",
+    version="6.2",
     author="Alexandre Borges",
     author_email="reverseexploit@proton.me",
     license="GNU GPL v3.0",