mirror of https://github.com/MISP/misp-modules
chg: [modules] formatting updated
parent
80f1f6ec1e
commit
55a3d8e9f5
|
@ -16,11 +16,12 @@ moduleinfo = {
|
||||||
'module-type': ['expansion'],
|
'module-type': ['expansion'],
|
||||||
'name': 'MalShare Upload',
|
'name': 'MalShare Upload',
|
||||||
'requirements': ['requests library'],
|
'requirements': ['requests library'],
|
||||||
'logo': ''
|
'logo': '',
|
||||||
}
|
}
|
||||||
|
|
||||||
moduleconfig = ['malshare_apikey']
|
moduleconfig = ['malshare_apikey']
|
||||||
|
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
if q is False:
|
if q is False:
|
||||||
return False
|
return False
|
||||||
|
@ -54,10 +55,7 @@ def handler(q=False):
|
||||||
|
|
||||||
try:
|
try:
|
||||||
url = "https://malshare.com/api.php"
|
url = "https://malshare.com/api.php"
|
||||||
params = {
|
params = {'api_key': malshare_apikey, 'action': 'upload'}
|
||||||
'api_key': malshare_apikey,
|
|
||||||
'action': 'upload'
|
|
||||||
}
|
|
||||||
files = {"upload": (sample_filename, data)}
|
files = {"upload": (sample_filename, data)}
|
||||||
response = requests.post(url, params=params, files=files)
|
response = requests.post(url, params=params, files=files)
|
||||||
response.raise_for_status()
|
response.raise_for_status()
|
||||||
|
@ -69,13 +67,17 @@ def handler(q=False):
|
||||||
|
|
||||||
if response_text.startswith("Success"):
|
if response_text.startswith("Success"):
|
||||||
# If upload was successful or file already exists
|
# If upload was successful or file already exists
|
||||||
malshare_link = f"https://malshare.com/sample.php?action=detail&hash={sha256}"
|
malshare_link = (
|
||||||
|
f"https://malshare.com/sample.php?action=detail&hash={sha256}"
|
||||||
|
)
|
||||||
elif "sample already exists" in response_text:
|
elif "sample already exists" in response_text:
|
||||||
# If file already exists, extract SHA256 from response
|
# If file already exists, extract SHA256 from response
|
||||||
match = re.search(r'([a-fA-F0-9]{64})', response_text)
|
match = re.search(r'([a-fA-F0-9]{64})', response_text)
|
||||||
if match:
|
if match:
|
||||||
sha256 = match.group(1)
|
sha256 = match.group(1)
|
||||||
malshare_link = f"https://malshare.com/sample.php?action=detail&hash={sha256}"
|
malshare_link = (
|
||||||
|
f"https://malshare.com/sample.php?action=detail&hash={sha256}"
|
||||||
|
)
|
||||||
else:
|
else:
|
||||||
# If there's any other error
|
# If there's any other error
|
||||||
raise Exception(f"Upload failed: {response_text}")
|
raise Exception(f"Upload failed: {response_text}")
|
||||||
|
@ -84,12 +86,22 @@ def handler(q=False):
|
||||||
misperrors['error'] = f"Unable to send sample to MalShare: {str(e)}"
|
misperrors['error'] = f"Unable to send sample to MalShare: {str(e)}"
|
||||||
return misperrors
|
return misperrors
|
||||||
|
|
||||||
r = {'results': [{'types': 'link', 'values': malshare_link, 'comment': 'Link to MalShare analysis'}]}
|
r = {
|
||||||
|
'results': [
|
||||||
|
{
|
||||||
|
'types': 'link',
|
||||||
|
'values': malshare_link,
|
||||||
|
'comment': 'Link to MalShare analysis',
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
return r
|
return r
|
||||||
|
|
||||||
|
|
||||||
def introspection():
|
def introspection():
|
||||||
return mispattributes
|
return mispattributes
|
||||||
|
|
||||||
|
|
||||||
def version():
|
def version():
|
||||||
moduleinfo['config'] = moduleconfig
|
moduleinfo['config'] = moduleconfig
|
||||||
return moduleinfo
|
return moduleinfo
|
||||||
|
|
|
@ -12,11 +12,12 @@ moduleinfo = {
|
||||||
'description': 'Module to submit samples to tria.ge',
|
'description': 'Module to submit samples to tria.ge',
|
||||||
'module-type': ['expansion', 'hover'],
|
'module-type': ['expansion', 'hover'],
|
||||||
'name': 'Triage Submit',
|
'name': 'Triage Submit',
|
||||||
'logo': ''
|
'logo': '',
|
||||||
}
|
}
|
||||||
|
|
||||||
moduleconfig = ['apikey', 'url_mode']
|
moduleconfig = ['apikey', 'url_mode']
|
||||||
|
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
if q is False:
|
if q is False:
|
||||||
return False
|
return False
|
||||||
|
@ -30,9 +31,7 @@ def handler(q=False):
|
||||||
api_key = request['config']['apikey']
|
api_key = request['config']['apikey']
|
||||||
url_mode = request['config'].get('url_mode', 'submit') # 'submit' or 'fetch'
|
url_mode = request['config'].get('url_mode', 'submit') # 'submit' or 'fetch'
|
||||||
base_url = 'https://tria.ge/api/v0/samples'
|
base_url = 'https://tria.ge/api/v0/samples'
|
||||||
headers = {
|
headers = {'Authorization': f'Bearer {api_key}'}
|
||||||
'Authorization': f'Bearer {api_key}'
|
|
||||||
}
|
|
||||||
|
|
||||||
if 'attachment' in request:
|
if 'attachment' in request:
|
||||||
data = request['data']
|
data = request['data']
|
||||||
|
@ -49,6 +48,7 @@ def handler(q=False):
|
||||||
misperrors['error'] = 'Unsupported input type'
|
misperrors['error'] = 'Unsupported input type'
|
||||||
return misperrors
|
return misperrors
|
||||||
|
|
||||||
|
|
||||||
def submit_file(headers, base_url, data, filename, is_malware_sample=False):
|
def submit_file(headers, base_url, data, filename, is_malware_sample=False):
|
||||||
try:
|
try:
|
||||||
if is_malware_sample:
|
if is_malware_sample:
|
||||||
|
@ -66,12 +66,21 @@ def submit_file(headers, base_url, data, filename, is_malware_sample=False):
|
||||||
sample_id = result['id']
|
sample_id = result['id']
|
||||||
sample_url = f'https://tria.ge/{sample_id}'
|
sample_url = f'https://tria.ge/{sample_id}'
|
||||||
|
|
||||||
return {'results': [{'types': 'link', 'values': sample_url, 'comment': 'Link to tria.ge analysis'}]}
|
return {
|
||||||
|
'results': [
|
||||||
|
{
|
||||||
|
'types': 'link',
|
||||||
|
'values': sample_url,
|
||||||
|
'comment': 'Link to tria.ge analysis',
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
|
misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
|
||||||
return misperrors
|
return misperrors
|
||||||
|
|
||||||
|
|
||||||
def submit_url(headers, base_url, url, mode):
|
def submit_url(headers, base_url, url, mode):
|
||||||
try:
|
try:
|
||||||
if mode == 'fetch':
|
if mode == 'fetch':
|
||||||
|
@ -86,15 +95,25 @@ def submit_url(headers, base_url, url, mode):
|
||||||
sample_id = result['id']
|
sample_id = result['id']
|
||||||
sample_url = f'https://tria.ge/{sample_id}'
|
sample_url = f'https://tria.ge/{sample_id}'
|
||||||
|
|
||||||
return {'results': [{'types': 'link', 'values': sample_url, 'comment': f'Link to tria.ge analysis ({mode} mode)'}]}
|
return {
|
||||||
|
'results': [
|
||||||
|
{
|
||||||
|
'types': 'link',
|
||||||
|
'values': sample_url,
|
||||||
|
'comment': f'Link to tria.ge analysis ({mode} mode)',
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
|
||||||
except Exception as e:
|
except Exception as e:
|
||||||
misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
|
misperrors['error'] = f'Error submitting to tria.ge: {str(e)}'
|
||||||
return misperrors
|
return misperrors
|
||||||
|
|
||||||
|
|
||||||
def introspection():
|
def introspection():
|
||||||
return mispattributes
|
return mispattributes
|
||||||
|
|
||||||
|
|
||||||
def version():
|
def version():
|
||||||
moduleinfo['config'] = moduleconfig
|
moduleinfo['config'] = moduleconfig
|
||||||
return moduleinfo
|
return moduleinfo
|
||||||
|
|
|
@ -15,11 +15,12 @@ moduleinfo = {
|
||||||
'module-type': ['expansion'],
|
'module-type': ['expansion'],
|
||||||
'name': 'VirusTotal Upload',
|
'name': 'VirusTotal Upload',
|
||||||
'requirements': ['requests library'],
|
'requirements': ['requests library'],
|
||||||
'logo': 'virustotal.png'
|
'logo': 'virustotal.png',
|
||||||
}
|
}
|
||||||
|
|
||||||
moduleconfig = ['virustotal_apikey']
|
moduleconfig = ['virustotal_apikey']
|
||||||
|
|
||||||
|
|
||||||
def handler(q=False):
|
def handler(q=False):
|
||||||
if q is False:
|
if q is False:
|
||||||
return False
|
return False
|
||||||
|
@ -69,12 +70,22 @@ def handler(q=False):
|
||||||
misperrors['error'] = f"Unable to send sample to VirusTotal: {str(e)}"
|
misperrors['error'] = f"Unable to send sample to VirusTotal: {str(e)}"
|
||||||
return misperrors
|
return misperrors
|
||||||
|
|
||||||
r = {'results': [{'types': 'link', 'values': virustotal_link, 'comment': 'Link to VirusTotal analysis'}]}
|
r = {
|
||||||
|
'results': [
|
||||||
|
{
|
||||||
|
'types': 'link',
|
||||||
|
'values': virustotal_link,
|
||||||
|
'comment': 'Link to VirusTotal analysis',
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
return r
|
return r
|
||||||
|
|
||||||
|
|
||||||
def introspection():
|
def introspection():
|
||||||
return mispattributes
|
return mispattributes
|
||||||
|
|
||||||
|
|
||||||
def version():
|
def version():
|
||||||
moduleinfo['config'] = moduleconfig
|
moduleinfo['config'] = moduleconfig
|
||||||
return moduleinfo
|
return moduleinfo
|
||||||
|
|
Loading…
Reference in New Issue