Malwareconfig Lookup and Yara Rule Additions

[darksheer]

Request Type

Feature Request

Problem Description

Cortex currently doesn't support lookups via http://mawareconfig.com. Having the ability to enrich data via Malware config would be a nice addition to the suite of Cortex analyzers.

Possible Solutions

Malwareconfig's API documentation is available here: https://malwareconfig.com/api/

Lookups to Malwareconfig.com are:

• MD5
• SHA256
• Config
• IP
• Domain

File submission is also possible.

Stat information, based on sample type ( https://malwareconfig.com/stats/ ) could also be used for weighting of results.

Screenshots, Geo locations, and other data is also available, which would be great to pass over to theHive for visual enrichment (I'll cut a separate issue to theHive referencing this request).

Malwareconfig also allows for downloading of Yara files, based on OS types, along with individual yara files. Having the Yara cortex analyzer auto-download those along with the Git repo would be an added value.

Complementary information

https://malwareconfig.com/yara/
https://malwareconfig.com/api/

[darksheer]

I'll happily take a look to see if this is something I could assist with, but didn't want to go down the path silently in case it's already being addressed.

[nadouani]

Hello @darksheer, thanks for the suggestion. I'll move this issue to https://github.com/TheHive-Project/Cortex-Analyzers repo since it's related to analyzers development.

If you are willing to help, you can contribute that analyzer, we can review it and make it public ;)

Thanks