canonical: https://jentic.com/apis/abuse.ch/abuse-ch # Abuse Ch MalwareBazaar API Jentic publishes the only available OpenAPI specification for MalwareBazaar API, keeping it validated and agent-ready. MalwareBazaar is operated by abuse.ch as a community-driven repository for malware samples, sharing payloads with infosec teams and AV vendors. The API is a single POST endpoint where the action is selected via a query parameter (get_info, get_file, query_hash, query_tag, query_signature, etc.), letting clients upload, download, search, and tag samples. Authentication is an Auth-Key header tied to an abuse.ch account, and responses come back as JSON or, for file downloads, an encrypted ZIP. ## For AI agents Look up, download, and tag malware samples from MalwareBazaar's community repository through a single POST endpoint that switches behaviour by query action. ## Scope Does not handle live malware detonation, sandboxing, or AV scanning - use for sample lookup, retrieval, and submission only. ## Capabilities - Look up a malware sample's metadata by SHA-256, MD5, or SHA-1 hash - Download an encrypted ZIP of a malware sample for sandbox analysis - Search MalwareBazaar by tag (e.g. emotet, qakbot) to pull recent samples - Search by YARA signature name to retrieve matching samples - Submit a malware sample to MalwareBazaar with tags and intelligence comments ## Use cases ### Hash reputation check in incident response When a SOC analyst sees an unknown file hash on an endpoint, an automation calls the MalwareBazaar API with action=get_info to retrieve known-bad metadata, family tags, and first-seen date. This shortcuts the triage step and feeds straight into the case ticket. Example prompt: POST / with query=get_info and hash=; if data is non-empty, attach the malware family and tags to the incident ticket ### Sandbox-pull-and-detonate pipeline A malware research pipeline calls action=get_file to download the encrypted ZIP for a hash, unpacks it with the standard 'infected' password, and detonates in a sandbox. Useful for rebuilding detections against fresh samples without manually fetching from the website. Example prompt: POST / with query=get_file and sha256_hash=, then save the encrypted ZIP and queue it to the sandbox ### Threat-actor sample feed A threat-intel team subscribes to a tag-based feed by polling the API with action=get_taginfo for tags like emotet, qakbot, or icedid. Each poll returns a list of recently submitted samples for that family, including first-seen and YARA matches. Example prompt: POST / with query=get_taginfo and tag=emotet, limit=50; pipe new sample hashes to the threat-intel queue ### AI agent IOC enrichment via Jentic An agent enriching IOCs from an EDR queue calls the MalwareBazaar API via Jentic to attach malware family, tags, and YARA matches to each suspicious hash. The Auth-Key is held by Jentic, so the agent never sees the raw credential. Example prompt: For each hash from the EDR feed, POST / with query=get_info and append signature, file_type, and tags to the IOC record ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | / | Query, download, or submit malware samples - action selected via the 'query' form field | ## Key resources - **Sample query** — Single POST endpoint that switches behaviour by the 'query' form field - supports get_info, get_file, get_taginfo, get_siginfo, and submit ## Why Jentic - **Setup:** Wiring the MalwareBazaar API by hand means posting form-encoded queries to a single endpoint and attaching the Auth-Key header yourself on every request. Through Jentic you install once, import the MalwareBazaar API from the API Directory, store the Auth-Key once, and your agent calls it. - **Permission scoping:** MalwareBazaar routes everything through one POST endpoint whose action travels in the request body, so limit the agent to the operations it needs, such as looking up a sample by hash. You choose the operations it may call, so sample submission is not included unless you add it. - **Credential handling:** Your abuse.ch Auth-Key is stored once, encrypted, by your own Jentic One instance and injected as the Auth-Key header at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'look up malware hash' or 'download sample for sandbox', and Jentic returns the matching MalwareBazaar operation with its input schema so the agent supplies only hash or tag values without browsing the reference docs. ## Related APIs - **URLhaus** — abuse.ch repository for malicious URLs used for malware distribution - **Shodan** — Search engine for internet-exposed services and infrastructure - **AbuseIPDB** — Community database of IPs reported for abuse and malicious activity ## FAQ ### Why is there no official OpenAPI spec for MalwareBazaar API? abuse.ch documents MalwareBazaar in HTML at bazaar.abuse.ch/api/ but does not publish a structured OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MalwareBazaar API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the MalwareBazaar API use? An Auth-Key header tied to a free abuse.ch account. Through Jentic the Auth-Key is held encrypted in the vault and injected at execution, so the agent never sees the raw key. ### Can I download a malware sample with this API? Yes. POST / with query=get_file and sha256_hash=. The response is a ZIP encrypted with the password 'infected'; unpack inside an isolated environment before analysis. ### What are the rate limits for the MalwareBazaar API? abuse.ch enforces fair-use rate limits per Auth-Key - typically a few hundred requests per minute. The spec does not encode the exact limits; refer to your abuse.ch account dashboard or contact abuse.ch if you need a sustained higher rate for research. ### How do I look up a hash through Jentic? Search Jentic for 'look up malware hash', load the POST / operation on mb-api.abuse.ch/api/v1, then execute with query=get_info and hash. Install with pip install jentic and use await client.search, load, execute. ### Is the MalwareBazaar API free? Yes. Free abuse.ch accounts can use MalwareBazaar for non-commercial threat intelligence work. Heavy automated use should respect the fair-use policy and credit abuse.ch in derivative datasets. ### Can I limit what my agent is allowed to do with the MalwareBazaar API? Yes. Because you run Jentic One yourself, your own rules decide which MalwareBazaar operations the agent may call and which credentials it may use. Even though the API routes everything through one POST endpoint whose action travels in the request body, you can restrict the agent to just the operations it needs, such as looking up a sample by hash (get_info) or downloading a sample (get_file). Sample submission stays off unless you explicitly allow it.