A .NET implementation of the MalShare API MalShare.com is a free malware repository providing researchers access to samples, malicous feeds, and Yara results.
What's currently supported (https://malshare.com/doc.php):
- List hashes from the past 24 hours. Endpoint: "getlist".
- List of sample sources from the past 24 hours. Endpoint: "getsources".
- Get stored file details. Endpoint: "details".
- List MD5/SHA1/SHA256 hashes of a specific type from the past 24 hours. Endpoint: "type".
- Search sample hashes, sources and file names. Endpoint: "search". - New in 2.4: fixed this functionality, to reflect the changes to the endpoint
- Upload using FormData field "upload". Endpoint: "upload".
- Get list of file types & count from the past 24 hours. Endpoint: "gettypes".
- GET allocated number of API key requests per day and remaining. Endpoint: "getlimit".
- Download file. Endpoint: "getfile".
- Perform URL download and add result to sample collection. Endpoint: "download_url".
- Check status of download task via GUID. Endpoint: "download_url_check".
- Partial support for "Supply an array of hex-encoded hashes in a POST field named hashes". Right now you can supply only 1 hash per call, you can't supply an array. Endpoint: "hashlookup".
How to install:
You have 3 options:
- Add reference to the .dll file in your project, you will need to add the NewtonSoft.Json dependency yourself
- Install the NuGet Package from nuget.org (https://www.nuget.org/packages/MalShare.NET)
- Install the .nupkg file manually
- Microsoft.CSharp (>= 4.7.0)
- Newtonsoft.Json (>= 12.0.3)
- NETStandard.Library (>= 2.0.3)
How to use:
You can find usage examples and explanations for each endpoint here: https://pastebin.com/8n61zvas