Merge pull request #728 from TheHive-Project/feature/malwarebazaar

malwarebazaar hash search

analyzers/MalwareBazaar/MalwareBazaar.json

@@ -0,0 +1,19 @@
+{
+  "name": "MalwareBazaar",
+  "author": "Andrea Garavaglia, Davide Arcuri - LDO-CERT",
+  "license": "AGPL-V3",
+  "url": "https://github.com/TheHive-Project/Cortex-Analyzers",
+  "version": "1.0",
+  "baseConfig": "MalwareBazaar",
+  "description": "Search hashes on MalwareBazaar.",
+  "dataTypeList": ["domain", "fqdn", "url", "hash", "ip"],
+  "command": "MalwareBazaar/MalwareBazaar_analyzer.py",
+  "configurationItems": [    {
+      "name": "api_key",
+      "description": "MalwareBazaar api key",
+      "multi": false,
+      "required": true,
+      "type": "string"
+    }
+  ]
+}

analyzers/MalwareBazaar/MalwareBazaar_analyzer.py

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+import requests
+from cortexutils.analyzer import Analyzer
+
+BASEURL = 'https://mb-api.abuse.ch/api/v1/'
+
+class MalwareBazaarAnalyzer(Analyzer):
+    def __init__(self):
+        Analyzer.__init__(self)
+        self.api_key = self.get_param("config.api_key", None)
+
+    def run(self):
+        data = self.get_data()
+        if not data:
+            self.error('No observable or file given.')
+
+        results = {}
+        if self.data_type == 'hash':
+            if len(data) in [32, 40, 64]:
+                headers = { 'API-KEY': self.api_key }
+                data = {
+                    'query': 'get_info',
+                    'hash': data,
+                }
+                results = requests.post(BASEURL, data=data, timeout=15, headers=headers)
+
+                if results.status_code == 200:
+                    results = results.json()
+                    if results['query_status'] in ['http_post_expected', 'illegal_hash', 'no_hash_provided']:
+                        self.error('MalwareBazaar returned error: %s' % results['query_status'])
+                    elif results['query_status'] != 'hash_not_found':
+                        results['data'] = results['data'][0]
+            else:
+                self.error('Only sha256, sha1 and md5 supported by MalwareBazaar.')
+        else:
+            self.error('Datatype not supported.')
+
+        self.report(results)
+
+    def summary(self, raw):
+        taxonomies = []
+        namespace = "MalwareBazaar"
+
+        if raw['query_status'] == 'hash_not_found':
+            taxonomies.append(self.build_taxonomy(
+                'info',
+                namespace,
+                'Search',
+                'No results'
+            ))
+        else:
+            taxonomies.append(self.build_taxonomy(
+                'malicious',
+                namespace,
+                'Signature',
+                raw['data'].get('signature', 'Unknown')
+            ))
+        return {"taxonomies": taxonomies}
+
+
+if __name__ == '__main__':
+    MalwareBazaarAnalyzer().run()

analyzers/MalwareBazaar/requirements.txt

@@ -0,0 +1,2 @@
+cortexutils
+requests

thehive-templates/MalwareBazaar_1_0/long.html

@@ -0,0 +1,115 @@
+<div class="panel panel-info" ng-if="success && content.query_status == 'ok'">
+    <div class="panel-heading">
+        MalwareBazaar search results for
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <div>
+            <dl class="dl-horizontal">
+                <dt>Hashes</dt>
+                <dd class="wrap">
+                    md5: {{content.data.md5_hash}}<br />
+                    sha256: {{content.data.sha256_hash}}<br />
+                    sha1: {{content.data.sha1_hash}}<br />
+                    imphash: {{content.data.imphash}}<br />
+                    ssdeep: {{content.data.ssdeep}}
+                </dd>
+                <dt>Reporter</dt>
+                <dd>{{content.data.reporter}}</dd>
+                <dt>First seen (UTC)</dt>
+                <dd>{{content.data.first_seen}}</dd>
+                <dt ng-if="content.data.last_seen">Last seen (UTC)</dt>
+                <dd ng-if="content.data.last_seen">{{content.data.last_seen}}</dd>
+                <dt>Filename</dt>
+                <dd>{{content.data.file_name}}</dd>
+                <dt>Filetype</dt>
+                <dd>{{content.data.file_type}} {{content.data.file_type_mime}}</dd>
+                <dt ng-if="content.data.delivery_method">Delivery Method</dt>
+                <dd ng-if="content.data.delivery_method">{{content.data.delivery_method}}</dd>
+                <dt>Signature</dt>
+                <dd><span class="label label-primary">{{content.data.signature}}</span></dd>
+                <dt>Tags</dt>
+                <dd><span ng-repeat="tag in content.data.tags" class="label label-info">{{tag}}</span></dd>               
+            </dl>
+        </div>
+    </div>
+</div>
+<div class="panel panel-info" ng-if="success && content.data.intelligence">
+    <div class="panel-heading">Intelligence</div>
+    <div class="panel-body">
+        <div>
+            <dl class="dl-horizontal">
+                <dt ng-if="content.data.intelligence.clamav">Clamav</dt>
+                <dd ng-if="content.data.intelligence.clamav">{{content.data.intelligence.clamav}}</dd>
+
+                <dt ng-if="content.data.intelligence.downloads">Downloads</dt>
+                <dd ng-if="content.data.intelligence.downloads">{{content.data.intelligence.downloads}}</dd>
+
+                <dt ng-if="content.data.intelligence.uploads">Uploads</dt>
+                <dd ng-if="content.data.intelligence.uploads">{{content.data.intelligence.uploads}}</dd>
+
+                <dt ng-if="content.data.intelligence.mail">Mail</dt>
+                <dd ng-if="content.data.intelligence.mail">
+                    <span ng-repeat="(k,v) in content.data.intelligence.mail">
+                        {{k}} > {{v}}<br/>
+                    </span>
+                </dd>
+            </dl>
+        </div>
+    </div>
+</div>
+
+<div class="panel panel-info" ng-if="success && content.data.file_information">
+    <div class="panel-heading">File Information</div>
+    <div class="panel-body">
+        <p ng-repeat="info in content.data.file_information">
+            {{info.context}}: {{info.value}}
+        </p>
+    </div>
+</div>
+
+<div class="panel panel-info" ng-if="success && content.data.comments">
+    <div class="panel-heading">Comments</div>
+    <div class="panel-body">
+        <div>
+            <dl class="dl-horizontal">
+                <dt ng-repeat-start="comment in content.data.comments">{{comment.display_name}} - {{comment.date_added}}</dt>
+                <dd ng-repeat-end>{{comment.comment}}</dd>  
+                <hr/>   
+                <hr/>   
+                <dt ng-if="content.data.comment">Comment</dt>
+                <dd ng-if="content.data.comment">{{content.data.comment}}</dd>                           
+            </dl>
+        </div>
+    </div>
+</div>
+
+<!-- No results -->
+<div class="panel panel-danger" ng-if="content.query_status == 'hash_not_found'">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal">
+            <dt>
+                <i class="fa fa-warning"></i> MalwareBazaar:
+            </dt>
+            <dd class="wrap">No results</dd>
+        </dl>
+    </div>
+</div>
+
+<!-- General error  -->
+<div class="panel panel-danger" ng-if="!success">
+    <div class="panel-heading">
+        <strong>{{artifact.data | fang}}</strong>
+    </div>
+    <div class="panel-body">
+        <dl class="dl-horizontal" ng-if="content.errorMessage">
+            <dt>
+                <i class="fa fa-warning"></i> MalwareBazaar:
+            </dt>
+            <dd class="wrap">{{content.errorMessage}}</dd>
+        </dl>
+    </div>
+</div>

thehive-templates/MalwareBazaar_1_0/short.html

@@ -0,0 +1,3 @@
+<span class="label" ng-repeat="t in content.taxonomies" ng-class="{'info': 'label-info', 'safe': 'label-success', 'suspicious': 'label-warning', 'malicious':'label-danger'}[t.level]">
+  {{t.namespace}}:{{t.predicate}}="{{t.value}}"
+</span>