xorhex / mlget

A golang CLI tool to download malware from a variety of sources.
139 stars 20 forks source link

hybrid-analysis failing despite dedicaed client working with the same API key #11

Open psifertex opened 1 month ago

psifertex commented 1 month ago
$ mlget fc17c021f18ec73d1544ad46dde6a1f1949f126bf3e75f97e241f982e2b07c86
Hashes Passed Via the Command Line:
  - fc17c021f18ec73d1544ad46dde6a1f1949f126bf3e75f97e241f982e2b07c86

Look up fc17c021f18ec73d1544ad46dde6a1f1949f126bf3e75f97e241f982e2b07c86 (sha256) - (1 of 1)
Querying all services

<SNIP>

  [*] HybridAnalysis: https://www.hybrid-analysis.com/api/v2
    [!] Not authorized.  Check the URL and APIKey in the config.
Could also be that the sample is not allowed to be downloaded.

<SNIP>

Hashes not found!
    0: fc17c021f18ec73d1544ad46dde6a1f1949f126bf3e75f97e241f982e2b07c86

Compared to:

$ python3 vxapi.py search_hash fc17c021f18ec73d1544ad46dde6a1f1949f126bf3e75f97e241f982e2b07c86
[]
$ python3 vxapi.py feed_get_latest|head
{
    "count": 248,
    "data": [
        {
            "analysis_start_time": "2024-07-20 06:53:40",
            "domains": [
                "apple.hkmyzs.com",
                "appleid.cdn-apple.com",
                "www.apple.com"
            ],

Same API key for both.

xorhex commented 1 month ago

Just saw this. Thanks for the report. I'm digging into it.

xorhex commented 1 month ago

Not seeing that sample in the UI. Does it render in the UI for you?

Screenshot from 2024-07-22 18-03-43

If it does, is the download functionality disabled for that sample? Sometimes you can view the report but they will have the download feature disabled (even when you are logged in).

psifertex commented 1 month ago

Sorry, I didn't meant to imply the file existed. I was pointing out that the error was incorrect. The API key is fine, there should just be no results, not an error about an invalid API key.

xorhex commented 1 month ago

Planning on updating the UI a bit. I'll make sure the error messages reflect better what is going on. Thanks

Leaving this open until the new UI is done.