01 · Product name
MalwareBazaar
A public exchange for malware samples and their hashes.
Published by abuse.ch.
In short
MalwareBazaar is a sample-sharing platform operated by abuse.ch. Researchers upload malware and look up what others have submitted. The community API is free under the fair-use note on the API page, and that page says commercial use may require the paid abuse.ch API. A hash is a lead about a file. It is not a conviction, and this directory does not host the samples.
Product pricing strategy
02
Free and paid
MalwareBazaar’s website and community API are free under the fair-use terms on the API page. That page says commercial or for-profit use may require a paid subscription to the enhanced abuse.ch API. No dollar amount was printed in the API text reviewed for this listing, so none is quoted here. Read the API page before you script it.
Utility and features
03
The about page says MalwareBazaar collects and shares malware samples so researchers and analysts can protect their networks. The homepage, which also names Spamhaus alongside abuse.ch, describes upload, browse, alerts, and an API. You can search the database and set alerts for newly seen malware. That is the product: a commons for files, not a scanner you point at your own disk.
- Share and look up samples. Upload, browse, and alerts are the homepage’s loop. The about page states the purpose: help researchers protect their networks.
- Community API. Free under fair use, as the API page describes it. Bulk commercial querying is the paid API’s job.
- Not a verdict engine. You get the sample and the metadata contributors attached. VirusTotal is the multi-scanner lookup.
The API page draws a line. The community API is free under fair use. Companies and for-profit use may need the commercial abuse.ch API, which the page says adds reliability and a shared query language. This listing does not quote that commercial price, because the page did not print one in the text we reviewed. VirusTotal is where you go for multi-engine verdicts on a hash you already have. MalwareBazaar is where the sample itself is shared.
- 1
Search a hash you already have, on a machine that is not your daily workstation.
- 2
Read who submitted the sample and which tags they applied.
- 3
Use the community API only inside the fair-use note. Move to the commercial API if that note excludes you.
- 4
Cite the hash and the date, not a screenshot of someone else’s malware.
Caveats
04
Samples are malware. Download them only in a lab you control. This directory does not link a sample file.
A record in the bazaar is a submission. Confirm the hash against a second source before you treat the family name as settled. Fair use on the community API is abuse.ch’s rule, not a blank check for a company pipeline.
Screenshots
05
Potential use cases
06
- You have a hash from an incident and you want to know if the community has shared a sample. Search MalwareBazaar. The output is the record: hashes, tags, and the family’s name as submitted. Confirm the hash in VirusTotal before you treat the family tag as settled. Download a sample only in a lab you control. This directory does not link a sample file and does not describe detonation.
- You already track a family and you want alerts for newly submitted samples. Set the alert the homepage describes, and treat each alert as a submission to review, not as a confirmed incident on your network. The pivot for a multi-engine opinion is VirusTotal. The pivot for sharing inside your team is a MISP event you create on purpose.
- A lab needs a sample source that is not a random forum. Use the bazaar under its rules, in a lab, and keep the hash you searched even if you never download the file. The community API is free under the fair-use rule abuse.ch states. Commercial use may need their commercial API. This listing does not quote that price because the page we reviewed did not print one.
Hard cases
The case where the first result is easy to over-read.
The tag says a family and the hash is all you have
Do not download the sample to ‘see if the tag is right,’ and do not detonate it on a workstation. Search the hash in VirusTotal, record both labels, and if they disagree, say they disagree. A bazaar tag is a submission. The lab is a separate authorization. This page stops at the lookup.
Questions
Is MalwareBazaar free?
The site and the community API are free under fair use. The API page says commercial use may need the paid abuse.ch API.
Should you open a sample on a work laptop?
No. These are malware samples. Use a lab. The listing is about the catalog, not a place to detonate files.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
MalwareBazaar
https://bazaar.abuse.ch/Documentation
MalwareBazaar about
https://bazaar.abuse.ch/about/Documentation
MalwareBazaar API
https://bazaar.abuse.ch/api/