Closed rachejazz closed 3 years ago
In addition to the CVE module by @z3y50n mentioned in #63 . We can have the following analyzer for available ioc's for existing malwares. Link to ThreatFox I will add this once v2.0 comes out! (And no it does not need API key for basic searchlist)
┬─[divya at racharch in ~/a/c/crypto] ╰──> λ curl -X POST https://threatfox-api.abuse.ch/api/v1/ -d '{ "query": "malwareinfo", "malware": "FluBot", "limit": 10 }' { "query_status": "ok", "data": [ { "id": "3033", "ioc": "70eea8fb0b93988c1c46460922d74ca4ab2eb0f7f51be307c12932ac510cdd27", "threat_type": "payload", "threat_type_desc": "Indicator that identifies a malware sample (payload)", "ioc_type": "sha256_hash", "ioc_type_desc": "SHA256 hash of a malware sample (payload)", "malware": "apk.flubot", "malware_printable": "FluBot", "malware_alias": null, "malware_malpedia": "https:\/\/malpedia.caad.fkie.fraunhofer.de\/details\/apk.flubot", "confidence_level": 100, "first_seen": "2021-03-10 09:04:38 UTC", "last_seen": null, "reference": null, "reporter": "0xabc0", "tags": null },
I am also adding -
exploit db
You can also work on exploit-database.net website. It's very easy to scrape.
Ah yes that too. I will add a search module and put all of these as search engines into it then
In addition to the CVE module by @z3y50n mentioned in #63 . We can have the following analyzer for available ioc's for existing malwares. Link to ThreatFox I will add this once v2.0 comes out! (And no it does not need API key for basic searchlist)
I am also adding -
exploit db