Tier 4: MalwareBazaar fetcher by sha256 #4

New issue

Closed

opened 2026-04-30 00:10:40 -05:00 by max · 0 comments

max commented

2026-04-30 00:10:40 -05:00

Owner

The samples/manifest.toml schema already supports sample.sha256 + sample.source (Sample.kind == "real" when sha256 is present). What is missing:

tools/fetch_sample.py — pulls a sample by sha256 from MalwareBazaar (https://bazaar.abuse.ch/api/), verifies hash, lands at samples/store/<sha256> (gitignored).
Driver dispatch: when sample.kind == "real", upload the binary into the session and execute it instead of the exploits.workloads mimic. The mimic remains the fallback when the binary is absent.
Sample manifest: add real entries with sha256 once known-good binaries are picked.

Note: MalwareBazaar requires an API key (free, registration). The fetcher should read from samples/.bazaar.token (gitignored) or env.

The samples/manifest.toml schema already supports `sample.sha256` + `sample.source` (Sample.kind == "real" when sha256 is present). What is missing: - `tools/fetch_sample.py` — pulls a sample by sha256 from MalwareBazaar (https://bazaar.abuse.ch/api/), verifies hash, lands at `samples/store/<sha256>` (gitignored). - Driver dispatch: when `sample.kind == "real"`, upload the binary into the session and execute it instead of the `exploits.workloads` mimic. The mimic remains the fallback when the binary is absent. - Sample manifest: add real entries with sha256 once known-good binaries are picked. Note: MalwareBazaar requires an API key (free, registration). The fetcher should read from `samples/.bazaar.token` (gitignored) or env.