A Python RESTful API framework for querying multiple online malware analysis and threat intelligence services.
malsub is a Python RESTful API framework that consolidates access to multiple online malware analysis and threat intelligence services. It allows security analysts to programmatically submit files/URLs, retrieve analysis reports, download samples, and check quotas across services like VirusTotal and Hybrid Analysis through a unified command-line interface. The framework solves the problem of writing individual wrappers for each service by providing a modular, reusable architecture.
Incident responders, forensic analysts, malware researchers, and security practitioners who need to automate interactions with multiple threat intelligence platforms for investigations and analysis.
Developers choose malsub because it eliminates the need to write separate API clients for each service, offering a consistent, multi-threaded interface that saves time and reduces code duplication. Its modular design makes it easy to extend with new services, and its focus on automation streamlines threat intelligence workflows.
A Python RESTful API framework for online malware analysis and threat intelligence services.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Wraps over 20 malware analysis services like VirusTotal and Hybrid Analysis into a single CLI, eliminating the need to write separate API clients for each service.
Dispatches API calls across thread pools per input argument, enabling efficient parallel submission or retrieval for multiple files, hashes, or URLs.
New services can be added by subclassing a provided base template, making it easy to extend and reuse code without rewriting wrappers from scratch.
Includes a pause interval between requests to handle API cooldown periods, helping avoid quota issues when processing large batches.
Some bundled services have restricted operations due to reliance on free API keys, which may not support all features available with paid subscriptions.
Requires users to manually register for API keys and configure them in a YAML file, adding complexity compared to tools with built-in key management.
The README notes documentation as future work, so advanced usage and module development may lack guidance, increasing the learning curve.