Delete a sample (not yet implemented)

Malwarehouse is a warehouse for your malware. Malwarehouse is a useful command line utility for storing, tagging, storing, and searching for malware. This is intended to help analyst manage their workflow by conducting basic triage and making it easy to look up past samples.

Requirements

• Python 3.9+

Installation

Install dependencies using pip:

pip install -r requirements.txt

Libraries

• SQLAlchemy - Database ORM
• python-magic - File type identification (requires libmagic)
• ppdeep - Fuzzy hashing
• requests - HTTP library for API integrations
• yara-python (optional) - YARA rule matching

Authors

• Scott J Roberts - @sroberts
• Mina Naguib - @warebot

Setup - Databases

For initial DB setup, run python setup_db.py Using sqlalchecmy, Malwarehouse can now support a wider variety of database engines.

• You simply need to create the database and a user account with sufficient read/write privileges.
• Once created, setup the database section of the malwarehouse.cfg file accordingly.
  • EXAMPLE: postgresql://USER:PASSWORD@SERVER/DB

For more information, refer to http://docs.sqlalchemy.org/en/rel_0_8/core/engines.html#database-urls

Usage

Malwarehouse now uses Google Fire for a more intuitive CLI interface. Commands are simple method calls:

Basic Commands

# Display help
python malwarehouse.py --help

# Display the 5 most recent samples (default)
python malwarehouse.py recent

# Display the 10 most recent samples
python malwarehouse.py recent 10

# Find a sample by name, md5, or sha256
python malwarehouse.py find <hash_or_name>

# Load a new sample for analysis
python malwarehouse.py load <file_path>

# Load a sample with metadata
python malwarehouse.py load <file_path> --source="malware_bazaar" --notes="Suspicious dropper" --tags="trojan,dropper"

# Delete a sample (not yet implemented)
python malwarehouse.py delete <hash_or_name>

Examples

# Load a sample from a file
python malwarehouse.py load /path/to/malware.exe

# Load with additional context
python malwarehouse.py load /path/to/malware.exe --source="email_attachment" --notes="Phishing campaign 2024-01" --tags="phishing,ransomware"

# Find a specific sample
python malwarehouse.py find d41d8cd98f00b204e9800998ecf8427e

# View recent 20 samples
python malwarehouse.py recent 20

Plugins

Malwarehouse now allows you to seamlessly integrate your own plugins to automagically run during analysis. For now, please see the virus total plugin for reference.

License

See LICENSE for more information

Thanks

• Jonathan Hencinski
• Chris St.Myers
• @Xen0ph0n