{"id":13843436,"url":"https://github.com/alphaSeclab/malware-ioc-hash","last_synced_at":"2025-07-11T19:31:41.052Z","repository":{"id":111962585,"uuid":"293993133","full_name":"alphaSeclab/malware-ioc-hash","owner":"alphaSeclab","description":"Collection of malware ioc hashes from blog posts. A Python script is provided to search through it.","archived":false,"fork":false,"pushed_at":"2020-09-10T04:12:04.000Z","size":5903,"stargazers_count":17,"open_issues_count":0,"forks_count":4,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-11-18T09:32:58.583Z","etag":null,"topics":["indicators-of-compromise","malware","malware-ioc"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/alphaSeclab.png","metadata":{"files":{"readme":"Readme.md","changelog":"history/20200910094654_post_hash.json","contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-09-09T03:31:22.000Z","updated_at":"2024-10-03T05:14:58.000Z","dependencies_parsed_at":"2023-04-20T04:04:54.419Z","dependency_job_id":null,"html_url":"https://github.com/alphaSeclab/malware-ioc-hash","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alphaSeclab%2Fmalware-ioc-hash","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alphaSeclab%2Fmalware-ioc-hash/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alphaSeclab%2Fmalware-ioc-hash/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/alphaSeclab%2Fmalware-ioc-hash/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/alphaSeclab","download_url":"https://codeload.github.com/alphaSeclab/malware-ioc-hash/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225754994,"owners_count":17519184,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["indicators-of-compromise","malware","malware-ioc"],"created_at":"2024-08-04T17:02:08.452Z","updated_at":"2024-11-21T15:30:59.300Z","avatar_url":"https://github.com/alphaSeclab.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python"],"sub_categories":[],"readme":"1. [MalwareIoCHash](#malwareiochash)\r\n2. [仓库内容](#仓库内容)\r\n3. [使用](#使用)\r\n   1. [支持的命令行](#支持的命令行)\r\n   2. [打印文件信息](#打印文件信息)\r\n   3. [搜索哈希值](#搜索哈希值)\r\n   4. [搜索文章标题(内容)](#搜索文章标题内容)\r\n   5. [搜索文章链接](#搜索文章链接)\r\n   6. [搜索包含哈希值的文件](#搜索包含哈希值的文件)\r\n   7. [输出搜索结果: 导出与打印、自定义字段选择](#输出搜索结果-导出与打印自定义字段选择)\r\n      1. [导出到`json`文件](#导出到json文件)\r\n      2. [指定输出(导出/打印)的内容](#指定输出导出打印的内容)\r\n4. [TODO](#todo)\r\n\r\n# MalwareIoCHash\r\n- 对从多个站点抓取的包含IoC-Hash的文章进行搜索.\r\n- 当前包括文章个数: `11757`\r\n- 当前包括Hash个数: `37871`\r\n\r\n# 仓库内容\r\n- `data.json`: 从多个网站抓取包含Hash的文章后, 对IoC进行在线验证与扩充(VT/HybridAnalysis)后的数据\r\n    - 每个文章包括的字段：\r\n        - `time`: 文章发布日期(可能不准确)\r\n        - `title`: 文章标题\r\n        - `link`: 文章链接\r\n        - `pending`: 从文章内容中提取的Hash值, 没有在VT/HybridAnalysis等站点中找到对应项, 导致此哈希值没有完整的`(md5, sha1, sha256)`对, 则为`pending`\r\n        - `confirmed`: 从文章中提取的Hash值, 在VT/HybridAnalysis等站点中找到了对应项, 补全了`(md5, sha1, sha256)`对, 则为`confirmed`\r\n        - `topic_list`: 在文章内容中搜索到的预定义的`topic`列表.\r\n            - `topic`来源: [MIPS](https://www.misp-project.org/), [Malpedia](https://malpedia.caad.fkie.fraunhofer.de/)\r\n            - 以字符串包含方式, 将`topic`与文章正文内容进行匹配\r\n- `cli.py`: Python脚本, 对`data.json`中的内容进行过滤、导出等操作\r\n\r\n# 使用\r\n- 只支持Python3\r\n- `pip3 install -r requirements.txt`: 安装依赖\r\n- `chmod +x cli`: 在`Linux`系统下, 可直接使用`cli`\r\n    - `Windows`系统使用`python3 cli.py`\r\n\r\n## 支持的命令行\r\n- `./cli --help`: 根命令\r\n```\r\nCommands:\r\n  info    打印信息.\r\n  search  -\u003e 搜索.\r\n```\r\n- `./cli search --help`: 搜索命令\r\n```\r\n  -\u003e 搜索.\r\nCommands:\r\n  file  从指定文件中读取哈希值, 并搜索.\r\n  hash  搜索哈希值.\r\n  url   搜索链接.\r\n  word  搜索文章关键词(默认只有title, 如果需要搜索content则指定 --content).\r\n```\r\n\r\n## 打印文件信息\r\n- `./cli info`\r\n```\r\ntopic 个数: 3684\r\n['gobrut', 'smominru', 'ismo', 'lsmo', 'botnet', 'chachaddos', 'shade', 'zebrocy', 'zekapab', 'loudminer', 'buhtrap', 'ratopak', 'fakeapp', 'winnti', 'agent.alqhi', 'etso', 'miner', 'plead', 'apt28', 'sofacy', 'sednit', 'fancybear', 'pawnstorm', 'tsarteam', 'jkeyskw', 'carberplike', 'downrage', 'jhuhugit', 'komplex', 'seduploader', 'gamefish', 'sofacycarberp', 'tg-4127', 'grey-cloud', 'group-4127', 'strontium', 'threatgroup-4127', 'swallowtail', 'irontwilight', 'tag_0700', 'group74', 'oceanlotus', 'emotet', 'gobotkr', 'android.filecoder', 'amavaldo', 'balkan', 'balkanrat', 'balkandoor', 'newsource', 'armageddon', 'systemcrypter', 'loocipher', 'freeme', 'boooamcrypt', 'eris', 'expboot', 'doppelpaymer', 'skystars', 'zerofucks', 'tflower', 'xorist', 'syrk', 'arsium', 'yobacrypt', 'plague', 'mykings', 'xrat', 'gootkit', 'talalpek', 'xswkit', 'trickbot', 'trickloader', 'trickster', 'thetrick', 'remcos', 'miraixminer', 'viagra', 'asruex', 'necro', 'agenttesla', 'nymaim', 'nymain', 'pinkslipbot', 'qakbot', 'qbot', 'ramnit', 'nimnul', 'zegost', 'lokibot', 'expiro', 'cerber', 'crbrencryptor', 'tofsee', 'gheg', 'mondera', 'kovter', 'xtremerat', 'extrat', 'gh0strat'] ...\r\n个数: 11757\r\npending-hash 个数: 419\r\nconfirmed-sha256 个数: 37452\r\n```\r\n\r\n## 搜索哈希值\r\n- 当前只支持完整的`md5/sha1/sha256`哈希值的搜索\r\n- `./cli search hash -h ec2ed8e85eb96c65c64f666a63a5e9e6`\r\n```\r\n要搜索的哈希值: ec2ed8e85eb96c65c64f666a63a5e9e6\r\n待搜索个数: 11757\r\n搜索结果: 1\r\n------------------------------\r\n2014-07-22\r\nThe Bank INTERAC was accepted. - virus\r\nhttps://techhelplist.com/spam-list/605-the-bank-interac-was-accepted-virus\r\nconfirmed:\r\n    ec2ed8e85eb96c65c64f666a63a5e9e6\r\n    90a4e2156839d855d29952a4ebf1d54f3c9b1950\r\n    c83c891dbdd02f7f45bde586a1e802276819267904190e2f053a6f50da3513ad\r\n```\r\n\r\n## 搜索文章标题(内容)\r\n- `./cli search word -w apt28`: 未指定`--content`, 只匹配标题, 搜索结果: `19`\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 19\r\n------------------------------\r\n2019-11-07\r\nHere We GO: Crimeware \u0026 APT Journey From “RobbinHood” to APT28\r\nhttps://www.sentinelone.com/blog/here-we-go-crimeware-apt-journey-from-robbinhood-to-apt28/\r\nconfirmed:\r\n    602d2901d55c2720f955503456ac2f68\r\n    80e61ba572b2c955c50d8359eb68e6c13fc16ae1\r\n    93680d34d798a22c618c96dec724517829ec3aad71215213a2dcb1eb190ff9fa\r\n    // ...\r\n------------------------------\r\n2019-08-10\r\nAPT28分析之X-agent样本分析\r\nhttps://xz.aliyun.com/t/5898\r\nconfirmed:\r\n    6fc8602c8b3a18765bb6d2307d8a4ae1\r\n    57f455bfc074c881076f506aa8e3090f75e2e0ac\r\n    dfba21b4b7e1e6ebd162010c880c82c9b04d797893311c19faab97431bf25927\r\n    // ...\r\n// ........\r\n```\r\n- `./cli search word -w apt28 --content`: 指定`--content`, 搜索结果: `55`\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 55\r\n------------------------------\r\n2020-03-26\r\nThe Dukes of Moscow\r\nhttps://www.carbonblack.com/2020/03/26/the-dukes-of-moscow/\r\nconfirmed:\r\n    28f96a57fa5ff663926e9bad51a1d0cb\r\n    a75995f94854dea8799650a2f4a97980b71199d2\r\n    19972cc87c7653aff9620461ce459b996b1f9b030d7c8031df0c8265b73f670d\r\n// ....\r\n```\r\n- `./cli search word -w keylogger`\r\n```\r\n要搜索的词: keylogger\r\n待搜索个数: 11757\r\n搜索结果: 46\r\n------------------------------\r\n2019-10-07\r\nDissecting Ardamax Keylogger\r\nhttps://medium.com/p/f33f922d2576\r\nconfirmed:\r\n    4a57ce1565f05454e9b5a4a80d048865\r\n    24362704e540b58aafbc6d736bb99b5b1b28e784\r\n    907587a797ef5ee759534b95e6f886cdea5989129d65de5b684b6d3b4aa645dc\r\n// ...\r\n```\r\n\r\n## 搜索文章链接\r\n- `./cli search url alienvault.com`\r\n```\r\n要搜索的链接: alienvault.com\r\n待搜索个数: 11757\r\n搜索结果: 43\r\n------------------------------\r\n2019-04-02\r\nXwo - A Python-based bot scanner\r\nhttps://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner\r\nconfirmed:\r\n    fd67a98599b08832cf8570a641712301\r\n    1faf363809f266bb2d90fb8d3fc43c18253d0048\r\n    6408c69e802de04e949ed3047dc1174ef20125603ce7ba5c093e820cb77b1ae1\r\n// ...\r\n```\r\n\r\n## 搜索包含哈希值的文件\r\n- `cat ~/tmp/xx.txt`: 文件内包括2个哈希值\r\n```\r\nfd67a98599b08832cf8570a641712301\r\n4a57ce1565f05454e9b5a4a80d048865\r\n```\r\n- `./cli search file -f ~/tmp/xx.txt`\r\n```\r\n文件路径: /home/xxx/tmp/xx.txt\r\n原文件行数: 2\r\n过滤后剩余行数: 2\r\n过滤后剩余有效哈希数: 2\r\n待搜索个数: 11757\r\n搜索结果: 2\r\n------------------------------\r\n2019-10-07\r\nDissecting Ardamax Keylogger\r\nhttps://medium.com/p/f33f922d2576\r\nconfirmed:\r\n    4a57ce1565f05454e9b5a4a80d048865\r\n    24362704e540b58aafbc6d736bb99b5b1b28e784\r\n    907587a797ef5ee759534b95e6f886cdea5989129d65de5b684b6d3b4aa645dc\r\n    // ...\r\n------------------------------\r\n2019-04-02\r\nXwo - A Python-based bot scanner\r\nhttps://www.alienvault.com/blogs/labs-research/xwo-a-python-based-bot-scanner\r\nconfirmed:\r\n    fd67a98599b08832cf8570a641712301\r\n    1faf363809f266bb2d90fb8d3fc43c18253d0048\r\n    6408c69e802de04e949ed3047dc1174ef20125603ce7ba5c093e820cb77b1ae1\r\n    // ...\r\n```\r\n\r\n## 输出搜索结果: 导出与打印、自定义字段选择\r\n- **适用于以上所有搜索命令**\r\n- 支持选项:\r\n```\r\n  --out TEXT       将搜索结果导出到指定目录(目录必须存在)(未指定则打印到控制台)\r\n  --col TEXT       要导出/打印的列, 中间以逗号(,)分割\r\n                   不指定则导出/打印全部(可选:\"time/title/link/hash/sha256)\"\r\n  --json           是否以 json 格式导出/打印\r\n```\r\n\r\n### 导出到`json`文件\r\n- `./cli search word -w apt28 --out ~/tmp`\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 19\r\n结果导出至文件: /home/xxx/tmp/20200910115449_hash_output.txt\r\n```\r\n\r\n### 指定输出(导出/打印)的内容\r\n- `./cli search word -w apt28 --col title,time`\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 19\r\n------------------------------\r\n2019-11-07\r\nHere We GO: Crimeware \u0026 APT Journey From “RobbinHood” to APT28\r\n------------------------------\r\n2019-08-10\r\nAPT28分析之X-agent样本分析\r\n// ....\r\n```\r\n- `./cli search word -w apt28 --col hash`: 只输出哈希值\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757搜索结果: 19\r\n65de07fc6b821d9fd3497cfa64212df2d39935dd515a86eda80d08086b183a3f\r\n7cd1b5f6774b25727e1d80b29979dadd1d427d3a\r\n// ...\r\n```\r\n- `./cli search word -w apt28 --col sha256`: 对于`confirmed`类型的哈希值, 只输出`sha256`\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 19\r\ne7dd9678b0a1c4881e80230ac716b21a41757648d71c538417755521438576f6\r\n6ad3eb8b5622145a70bec67b3d14868a1c13864864afd651fe70689c95b1399a\r\nfcf03bf5ef4babce577dd13483391344e957fd2c855624c9f0573880b8cba62e\r\n// ....\r\n```\r\n- `./cli search word -w apt28 --col title,sha256`: 混合\r\n```\r\n要搜索的词: apt28\r\n待搜索个数: 11757\r\n搜索结果: 19\r\n------------------------------\r\nHere We GO: Crimeware \u0026 APT Journey From “RobbinHood” to APT28\r\nhash:\r\n    93680d34d798a22c618c96dec724517829ec3aad71215213a2dcb1eb190ff9fa\r\n    3bc78141ff3f742c5e942993adfbef39c2127f9682a303b5e786ed7f9a8d184b\r\n------------------------------\r\nAPT28分析之X-agent样本分析\r\nhash:\r\n    dfba21b4b7e1e6ebd162010c880c82c9b04d797893311c19faab97431bf25927\r\n    5f6b2a0d1d966fc4f1ed292b46240767f4acb06c13512b0061b434ae2a692fa1\r\n// ....\r\n```\r\n\r\n# TODO\r\n- 1. 搜索时可指定同名(alias)\r\n\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FalphaSeclab%2Fmalware-ioc-hash","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FalphaSeclab%2Fmalware-ioc-hash","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FalphaSeclab%2Fmalware-ioc-hash/lists"}