malwaredb / gosdhash

Golang binding for sdhash

MalwareDB

Inspired by VXCage, MalwareDB is a malware knowledge management system which handles the book-keeping regarding malware/goodware samples: hashes, origination, similarity, file types, and more. It's intention is to help malware/cybersecurity researchers, forensic investigators, and others who have a need to handle malware, or other files of potentially unknown origin. This is very much a work in progress and alpha-quality project at present.

Key Features:

• Store malware/goodware samples
• Categorize samples
  • Tags
  • Origin
• Fetch samples
• Search based on file similarity (requires the Postgres plugins mentioned below)
• Plugin architecture for added functionality, with a PDF plugin provided as an example.

Requirements:

• Postgres database server
• Go
• Optional:
  • SDHash
  • Postgres plugins enabling searches by file similarity:
    • LZJD
    • SSDeep
    • SDHash
    • TLSH

Status

At present, this is a minimum viable product as not all features are currently implemented. Future updates will likely change the database schema, API, etc. But it's suitable for testing.

Current issues:

The search by similarity feature requires the whole file to be sent to the server for the similarity hashes to be calculated. This is a portability issue. Some of the similarity metrics use CPU intrinsics, C/C++ libraries, or other code which has made it difficult to compile on non-Intel architectures or for Windows. Once this compilation issue is addressed, file searches won't require sending the binary to the server. The intention is to remove dependencies on third party non-Go libraries.

Future

• Planned features:
  • Web interface as a separate application
  • GUI applications
  • API libraries in C, C++, Python, Java, Rust
  • Plugins for analytics
• Potential features:
  • Swift framework & GUI for macOS.
  • File storage backends for HDFS, S3, others.