MalwareBazaar

---

MalwareBazaar is an all-in-one database for malware collection and analysis.

• Search syntax: sha256:<file_hash>
• Link 

Features

• Malware Samples Upload
  • analysts can upload their malware samples for analysis and build the intelligence database
  • via browser or API
• Malware Hunting: can hunt for malware with:
  • Malware Family tagging
    • find files classified by their malware families
    • e.g., a file with only 5/70 detections on VirusTotal but tagged as IcedID in MalwareBazaar
      • should be treated as malicious
  • YARA rule integration
    • submissions include detection rules for EDR/SIEM for future hunting
  • Campaign attribution
    • Tags help link observed incidents to known adversaries
    • can help identify coordinated attacks against an environment
  • Sample Availability
    • Malware samples are available for download and analysis