Written and maintained by CASRAI Editorial Board
Last updated
Who this is for: researchers, students and analysts in cybersecurity who need to look up, study or share malware samples and want to know what MalwareBazaar is, whether it costs anything, and how to query it. After reading you should be able to request access, run a hash lookup and know which query fits which question.
What is MalwareBazaar?
MalwareBazaar is a project of abuse.ch that collects and shares malware samples with security researchers and analysts. Its API documentation describes a community API for submitting samples, downloading them and running bulk queries. It is one of several abuse.ch platforms; the others cover malicious URLs and indicators of compromise (see the table below).
What is abuse.ch?
abuse.ch describes itself as an independent, community-driven cyber threat intelligence project, and shares malware and botnet data together with Spamhaus. Its platforms include MalwareBazaar (newly observed malware samples), ThreatFox (indicators of compromise), URLhaus (malicious URLs), plus Feodo Tracker, SSLBL, YARAify and Hunting. Source: abuse.ch, read 2026-11-07.
Is MalwareBazaar free? Is abuse.ch free?
Yes, within limits. The MalwareBazaar FAQ states that it is free and that you can upload and download as many samples as you want, and the API documentation says the API is “available free of charge under the fair use principles”. Two conditions apply. File downloads through the API are capped at 2,000 per IP address per day, and the FAQ points bulk users to the hourly and daily batch exports instead. Companies, networks or individuals with commercial or for-profit needs may require a paid subscription to the enhanced abuse.ch commercial API, so check the abuse.ch terms of use before building a commercial workflow on it. Using the API means accepting those terms. Sources: MalwareBazaar FAQ and API documentation, read 2026-11-07.
What it is used for in research
- Looking up a file you already hold by SHA256, MD5 or SHA1 to see whether it is known and how it is labelled.
- Collecting samples of a malware family by tag, signature, file type, ClamAV signature or YARA rule for analysis or dataset building.
- Finding related samples through similarity hashes (imphash, TLSH, telfhash, gimphash, icon dhash) and code-signing certificate fields.
- Monitoring new activity through recent detections and the hourly and daily bulk exports.
Research groups that move samples or indicators between institutions should also treat this as a data-governance question; see data sharing agreement and research security.
Install or access (official source only)
There is nothing to install. You can browse the database on bazaar.abuse.ch. For the API, every request must carry an HTTP header named Auth-Key, and the key is free from the abuse.ch Authentication Portal at auth.abuse.ch. The API endpoint is https://mb-api.abuse.ch/api/v1/. If a request is sent without a key, the response query_status is no_api_key. Source: MalwareBazaar API documentation, read 2026-11-07.
Step-by-step: look up a hash, then download a sample
The documentation’s examples use wget with POST form data. Replace YOUR-AUTH-KEY-HERE with your key.
- Look up the hash first. This returns metadata without handling the file:
wget --header "Auth-Key: YOUR-AUTH-KEY-HERE" --post-data "query=get_info&hash=<SHA256|MD5|SHA1>" https://mb-api.abuse.ch/api/v1/ -O- - Download only if you need the file. The request takes a SHA256 hash and returns a zip:
wget --header "Auth-Key: YOUR-AUTH-KEY-HERE" --post-data "query=get_file&sha256_hash=<SHA256>" https://mb-api.abuse.ch/api/v1/ - Unzip with the documented password. Samples are zipped with AES128 encryption and the password is
infected. If extraction fails withNotImplementedError: compression type 99, your zip library lacks AES support; the documentation suggestspyzipperfor Python. - Look at recent activity (optional):
query=recent_detections&hours=2returns files from the last two hours that were assigned a malware family label.
Handling note. The files are real malware. The password convention exists so the archive is not scanned or opened by accident. Keep downloaded samples out of general-purpose machines and shared drives, and follow your institution’s security rules. The hash-first order above lets you answer many questions without downloading anything.
Which query fits which question
| Question | Query | Parameters and limits (per the docs) |
|---|---|---|
| Is this hash known? | get_info |
hash (SHA256, MD5 or SHA1) |
| Give me the file | get_file |
sha256_hash; returns a zip |
| What was labelled recently? | recent_detections |
hours, default 48, maximum 168 |
| What was added in the last hour, or the latest 100? | get_recent |
selector = time or 100 |
| Samples of one family or tag | get_taginfo, get_siginfo |
tag or signature, limit default 100, max 1000 |
| Samples of a file type, ClamAV or YARA match | get_file_type, get_clamavinfo, get_yarainfo |
limit default 100, max 1000 |
| Similar samples | get_imphash, get_tlsh, get_telfhash, get_gimphash, get_dhash_icon |
limit default 100, max 1000; get_dhash_icon covers PE executables only |
| Samples by signing certificate | get_issuerinfo, get_subjectinfo, get_certificate |
Maximum 100 results |
| Code Signing Certificate Blocklist | get_cscb |
No parameters |
| Everything, in bulk | Hourly and daily ZIP exports | Password infected |
Uploading uses a multipart POST with file and json_data. You can only update your own entries. The submission policy on the FAQ asks for confirmed malware only (no adware, worms or file infectors), samples no older than 10 days, one sample per campaign and no fake indicators; repeated violations can get an account banned.
Output and how to read it
Responses are JSON with a query_status field. ok (for get_recent) or the result data indicates success; no_results means the query ran but matched nothing. Records returned by the recent queries include sha256_hash, first_seen, file_name and signature; get_recent also returns tags and an intelligence field. The signature is the family label, which is why recent_detections only lists files where a family could be assigned.
Troubleshooting
| Symptom | Meaning per the documentation |
|---|---|
no_api_key |
The Auth-Key header is missing |
http_post_expected |
The query was not sent as a POST |
user_blacklisted |
The response status for a blacklisted user |
illegal_hash, illegal_sha256_hash |
The hash is malformed |
hash_not_found, file_not_found |
The hash is not in the database |
illegal_hours |
hours was outside 0 to 168 |
NotImplementedError: compression type 99 |
Your zip library lacks AES support; use pyzipper |
Related abuse.ch tools and free alternatives
The other abuse.ch platforms answer different questions from the same organisation.
| Platform | What it holds | Use it when |
|---|---|---|
| MalwareBazaar | Newly observed malware samples | You need the file or its file-level metadata |
| ThreatFox | Indicators of compromise | You need network or host indicators rather than files |
| URLhaus | Malicious URLs | You need to check or collect malware-distribution URLs |
Platform descriptions are from abuse.ch, read 2026-11-07. Open data from a security feed raises the same reuse questions as other open data; confirm the terms before redistributing a dataset, and see research security policy for the institutional side.
FAQ
What is MalwareBazaar?
An abuse.ch project for collecting and sharing malware samples with security researchers, browsable on the website and queryable through an API.
Is MalwareBazaar free?
Yes. The FAQ says it is free, and the API is free under fair use, with a 2,000-per-IP-per-day cap on API file downloads. Commercial or for-profit users may require a paid commercial API.
Is abuse.ch free?
abuse.ch describes its platforms as free of charge, subject to its terms of use and fair use principles, with the commercial-use caveat above.
What is abuse.ch?
An independent, community-driven cyber threat intelligence project that runs MalwareBazaar, ThreatFox, URLhaus and related platforms.
Do I need an API key?
Yes. Every API request needs the Auth-Key header with a free key from the abuse.ch Authentication Portal. Browsing the website does not use the API.
