Abuse Ch MalwareBazaar API

Name: MalwareBazaar API
Brand: MalwareBazaar API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityThreat DetectionapiKey1 EndpointsREST

For Agents

Look up, download, and tag malware samples from MalwareBazaar's community repository through a single POST endpoint that switches behaviour by query action.

Install Jentic One Beta

Connect the MalwareBazaar API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the MalwareBazaar API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with MalwareBazaar API.

Look up a malware sample's metadata by SHA-256, MD5, or SHA-1 hash

Download an encrypted ZIP of a malware sample for sandbox analysis

Search MalwareBazaar by tag (e.g. emotet, qakbot) to pull recent samples

GET STARTED

Start building with MalwareBazaar API

Explore with Jentic

View OpenAPI Document

Jentic publishes the only available OpenAPI specification for MalwareBazaar API, keeping it validated and agent-ready. MalwareBazaar is operated by abuse.ch as a community-driven repository for malware samples, sharing payloads with infosec teams and AV vendors. The API is a single POST endpoint where the action is selected via a query parameter (get_info, get_file, query_hash, query_tag, query_signature, etc.), letting clients upload, download, search, and tag samples. Authentication is an Auth-Key header tied to an abuse.ch account, and responses come back as JSON or, for file downloads, an encrypted ZIP.

Use Cases

Patterns agents use MalwareBazaar API for, with concrete tasks.

★ Hash reputation check in incident response

When a SOC analyst sees an unknown file hash on an endpoint, an automation calls the MalwareBazaar API with action=get_info to retrieve known-bad metadata, family tags, and first-seen date. This shortcuts the triage step and feeds straight into the case ticket.

POST / with query=get_info and hash=<sha256>; if data is non-empty, attach the malware family and tags to the incident ticket

Sandbox-pull-and-detonate pipeline

A malware research pipeline calls action=get_file to download the encrypted ZIP for a hash, unpacks it with the standard 'infected' password, and detonates in a sandbox. Useful for rebuilding detections against fresh samples without manually fetching from the website.

POST / with query=get_file and sha256_hash=<hash>, then save the encrypted ZIP and queue it to the sandbox

Threat-actor sample feed

A threat-intel team subscribes to a tag-based feed by polling the API with action=get_taginfo for tags like emotet, qakbot, or icedid. Each poll returns a list of recently submitted samples for that family, including first-seen and YARA matches.

POST / with query=get_taginfo and tag=emotet, limit=50; pipe new sample hashes to the threat-intel queue

AI agent IOC enrichment via Jentic

An agent enriching IOCs from an EDR queue calls the MalwareBazaar API via Jentic to attach malware family, tags, and YARA matches to each suspicious hash. The Auth-Key is held by Jentic, so the agent never sees the raw credential.

For each hash from the EDR feed, POST / with query=get_info and append signature, file_type, and tags to the IOC record

Key Endpoints

1 endpoints — jentic publishes the only available openapi specification for malwarebazaar api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

Query, download, or submit malware samples - action selected via the 'query' form field

POST

Query, download, or submit malware samples - action selected via the 'query' form field

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your abuse.ch Auth-Key is stored once, encrypted, by your own Jentic One instance and injected as the Auth-Key header at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'look up malware hash' or 'download sample for sandbox', and Jentic returns the matching MalwareBazaar operation with its input schema so the agent supplies only hash or tag values without browsing the reference docs.

Time to first call

FAQs

Specific to using MalwareBazaar API through Jentic.

Why is there no official OpenAPI spec for MalwareBazaar API?

abuse.ch documents MalwareBazaar in HTML at bazaar.abuse.ch/api/ but does not publish a structured OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call MalwareBazaar API via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the MalwareBazaar API use?

An Auth-Key header tied to a free abuse.ch account. Through Jentic the Auth-Key is held encrypted in the vault and injected at execution, so the agent never sees the raw key.

Can I download a malware sample with this API?

Yes. POST / with query=get_file and sha256_hash=<hash>. The response is a ZIP encrypted with the password 'infected'; unpack inside an isolated environment before analysis.

What are the rate limits for the MalwareBazaar API?

abuse.ch enforces fair-use rate limits per Auth-Key - typically a few hundred requests per minute. The spec does not encode the exact limits; refer to your abuse.ch account dashboard or contact abuse.ch if you need a sustained higher rate for research.

How do I look up a hash through Jentic?

Search Jentic for 'look up malware hash', load the POST / operation on mb-api.abuse.ch/api/v1, then execute with query=get_info and hash. Install with pip install jentic and use await client.search, load, execute.

Is the MalwareBazaar API free?

Yes. Free abuse.ch accounts can use MalwareBazaar for non-commercial threat intelligence work. Heavy automated use should respect the fair-use policy and credit abuse.ch in derivative datasets.

Can I limit what my agent is allowed to do with the MalwareBazaar API?

Yes. Because you run Jentic One yourself, your own rules decide which MalwareBazaar operations the agent may call and which credentials it may use. Even though the API routes everything through one POST endpoint whose action travels in the request body, you can restrict the agent to just the operations it needs, such as looking up a sample by hash (get_info) or downloading a sample (get_file). Sample submission stays off unless you explicitly allow it.