3c7 / bazaar

Python based CLI for MalwareBazaar

Hi! 👋

I'm Nils (@0x3c7) and I work as a threat intelligence analyst. The projects you find here are written in my freetime - I'm not a professional dev, you've been warned. :)

In case you want to get in touch, please find me on 🔐 keybase.

🔭 I’m currently working on webapps to organize malware sample hunting and infrastructure tracking
🌱 I’m currently learning reverse engineering
💬 Ask me about infrastructure tracking
📫 How to reach me: 🔐 keybase

---

Publications

2021

• 2021-07-30 Approach on Malware Sophistication Measurement Based on Leaked CIA Documents (Master Thesis)

2020

• 2020-12-07 Advanced Persistent (Infrastrucure) Tracking [Archive]

---

Github Stats

bazaar's Issues

"--limit" behaving oddly?

I seem to be getting non deterministic returns from my queries,

malwarebazzar % bazaar query --limit 900 -s tag ransomware | wc -l
1170

malwarebazzar % bazaar query --limit 900 -s tag ransomware | wc -l
1317

Another example:

malwarebazzar % bazaar query --limit 300 -c -s tag ransomware | wc -l
301
malwarebazzar % bazaar query --limit 900 -c -s tag ransomware | wc -l
901
malwarebazzar % bazaar query --limit 1000 -c -s tag ransomware | wc -l
1001
malwarebazzar % bazaar query --limit 2000 -c -s tag ransomware | wc -l
101

There doesn't seem to be a lot going on in the code that could cause this so I think it is on the server side, but has anyone observed this behavior? I am just trying to get all the ransomware binaries on malware bazaar...

Typo line 68

Hey,

seems like the line 68 has a typo :
csv_colums instead of csv_columns
init process is crashing because of this.

Upgrade PyYAML

Is it possible to upgrade the version of the PyYAML dependency? I face errors with wheel and versions below 6.0.1.

Collecting PyYAML<6.0.0,>=5.4.1 (from malwarebazaar->-r requirements.txt (line 3))
  Downloading PyYAML-5.4.1.tar.gz (175 kB)
     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ 175.1/175.1 kB 17.2 MB/s eta 0:00:00
  Installing build dependencies: started
  Installing build dependencies: finished with status 'done'
  Getting requirements to build wheel: started
  Getting requirements to build wheel: finished with status 'error'
  error: subprocess-exited-with-error
  
  × Getting requirements to build wheel did not run successfully.
  │ exit code: 1
  ╰─> [68 lines of output]