search

CybercentreCanada / assemblyline

AssemblyLine 4: File triage and malware analysis
https://cybercentrecanada.github.io/assemblyline4_docs/
MIT License
235 stars 14 forks source link

Badlist cannot consume a source with TLSH hashes #259

Closed kam193 closed 2 weeks ago

kam193 commented 2 weeks ago

Describe the bug I've started generating internally some IoCs from collected samples, and one of the types I use are TLSH hashes. Badlist service seems to be prepared to use them, but the core badlist client reject them as not having a valid hash.

Badlist sends found hashes here, one by one: https://github.com/CybercentreCanada/assemblyline-service-badlist/blob/5a959d79079ae845197de3160f26fdfb4af50416/badlist/update_server.py#L233

But the core client requires other hashes here: https://github.com/CybercentreCanada/assemblyline-core/blob/d520dac0290e978ad69aa6ee4ea39dbc24e2f21d/assemblyline_core/badlist_client.py#L63

To Reproduce Steps to reproduce the behavior:

  1. Add a new update source to the badlist, providing TLSH hashes. Do not forget to configure it in the service config.
  2. Trigger an update and observe No valid hash found error

Expected behavior TLSH hashes are imported to the badlist.

Screenshots

Environment (please complete the following information if pertinent):

Additional context