mbzr - MalwareBazaar CLI Client

A command-line tool for interacting with the MalwareBazaar API.

Part of the abuse.ch CLI toolkit - This project is part of a collection of CLI tools for interacting with abuse.ch services:

urlhs - URLhaus (malware URL database)

tfox - ThreatFox (IOC database)

yrfy - YARAify (YARA scanning)

mbzr - MalwareBazaar (malware samples)

Features

✅ Uses only Go standard libraries
📝 JSON output for easy parsing
⚡️ Built-in rate limiting (10 req/s)
🐳 Docker, Podman, and Apple container support

Installation

Using Homebrew

brew install andpalmier/tap/mbzr

Using Go

go install github.com/andpalmier/mbzr@latest

Using Container (Docker/Podman)

# Pull pre-built image
docker pull ghcr.io/andpalmier/mbzr:latest

# Or build locally
docker build -t mbzr .

From Source

git clone https://github.com/andpalmier/mbzr.git
cd mbzr
make build

Quick Start

Get your API key from abuse.ch Authentication Portal
Set your API key:

export ABUSECH_API_KEY="your_api_key_here"

Query samples by tag:

mbzr query -tag Emotet -limit 10

Usage

Commands

| Command | Description | |---------|-------------| | query | Query samples by hash, tag, signature, file type, etc. | | download | Download a malware sample by SHA256 hash | | upload | Upload a file or directory to MalwareBazaar | | comment | Add a comment to a malware sample | | latest | Get latest malware samples | | cscb | Query the Code Signing Certificate Blocklist | | version | Show version information |

Query Samples

# By hash (SHA256, SHA1, or MD5)
mbzr query -hash ac25758feaf1ba3fe21e02e29681b2addc0246b507e4f6641a68d4baf73c9652

# By tag
mbzr query -tag Emotet -limit 50

# By signature
mbzr query -signature "Trojan.Generic"

# By file type
mbzr query -file_type exe

# By ClamAV signature
mbzr query -clamav "Win.Trojan.Agent"

# By YARA rule
mbzr query -yara rule_name

# By imphash
mbzr query -imphash 1234567890abcdef1234567890abcdef

# By TLSH
mbzr query -tlsh T1A5B...

Download Samples

mbzr download -sha256 ac25758feaf1ba3fe21e02e29681b2addc0246b507e4f6641a68d4baf73c9652

Note: Downloaded files are saved as <sha256>.zip (password: infected)

Upload Samples

# Single file
mbzr upload -file malware.exe -tags trojan,banker

# Directory
mbzr upload -dir /path/to/samples -tags malware

# Anonymous upload
mbzr upload -file sample.exe -anonymous

Get Latest Samples

# Last 60 minutes
mbzr latest

# Last 100 samples
mbzr latest -selector 100

Container Usage

# Run with Docker
docker run --rm -e ABUSECH_API_KEY="your_key" ghcr.io/andpalmier/mbzr query -tag Emotet

# Run with Podman
podman run --rm -e ABUSECH_API_KEY="your_key" ghcr.io/andpalmier/mbzr query -tag Emotet

# Run with Apple container
container run --rm -e ABUSECH_API_KEY="your_key" ghcr.io/andpalmier/mbzr query -tag Emotet

# Mount volume for downloads
docker run --rm -e ABUSECH_API_KEY="your_key" -v $(pwd):/data ghcr.io/andpalmier/mbzr download -sha256 <hash>

Environment Variables

| Variable | Description | |----------|-------------| | ABUSECH_API_KEY | Your abuse.ch API key (required) |

License

This project is licensed under the AGPLv3 License - see the LICENSE file for details.

Acknowledgments

MalwareBazaar by abuse.ch
abuse.ch for their work in fighting malware

Mbzr

Install / Use

README