Malwareconfig Lookup and Yara Rule Additions

[nadouani]

Requested by @darksheer (TheHive-Project/Cortex#57)

Request Type

Feature Request

Problem Description

Cortex currently doesn't support lookups via http://malwareconfig.com. Having the ability to enrich data via Malware config would be a nice addition to the suite of Cortex analyzers.

Possible Solutions

Malwareconfig's API documentation is available here: https://malwareconfig.com/api/

Lookups to Malwareconfig.com are:

• MD5
• SHA256
• Config
• IP
• Domain

File submission is also possible.

Stat information, based on sample type ( https://malwareconfig.com/stats/ ) could also be used for weighting of results.

Screenshots, Geo locations, and other data is also available, which would be great to pass over to theHive for visual enrichment (I'll cut a separate issue to theHive referencing this request).

Malwareconfig also allows for downloading of Yara files, based on OS types, along with individual yara files. Having the Yara cortex analyzer auto-download those along with the Git repo would be an added value.

Complementary information

https://malwareconfig.com/yara/
https://malwareconfig.com/api/

[dadokkio]

Seems that API are not available anymore, I'm going to close the issue.