A Python utility for checking file hashes against multiple malware analysis services like VirusTotal, Hybrid Analysis, and MISP.
Munin is a Python-based online hash checker that queries multiple malware analysis and threat intelligence services to provide detailed information on files and indicators of compromise. It automates the process of checking hashes against platforms like VirusTotal, Hybrid Analysis, MISP, and others, aggregating results for security analysis.
Security analysts, incident responders, and malware researchers who need to quickly assess the reputation of files and indicators across multiple threat intelligence sources.
Developers choose Munin for its ability to query over ten security services from a single command-line interface, its built-in caching to avoid rate limits, and its flexible output formats including CSV and JSON for easy integration into analysis workflows.
Online hash checker for Virustotal and other services
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Queries over ten security services like VirusTotal, Hybrid Analysis, and MISP in a single run, as listed in the README, eliminating the need to manually check each platform.
Uses a JSON cache to store results and avoid redundant API calls for previously queried hashes, reducing rate limit issues and speeding up batch processing.
Supports CLI interactive mode, batch file processing, and a RESTful web service, allowing integration into various workflows from command-line analysis to automated pipelines.
Generates CSV reports with AV matches, filenames, PE metadata, and submission history, providing rich data for post-analysis and documentation.
Requires obtaining and managing API keys for multiple services, and the README notes installation hurdles like pycurl issues on macOS, adding significant setup time.
Functionality is tied to third-party APIs; if services are down or rate-limited, queries fail, and the web service enforces cooldown times due to VirusTotal restrictions.
Adding new threat intelligence services requires modifying Python source code, as it's not plug-and-play, which may deter non-developers from customization.