Malware Patrol CDF

The web format of this guide reflects the most current release.  Guides for older iterations are available in PDF format.  

This integration can be installed in the My Integration section of your ThreatQ instance. See the Adding an Integration topic for more details.

Malware Patrol Malware URLs (Sanitized)

Gunzipped JSON Sample Response:

[
    {
        "malware_classification":"Trojan-Banker.Win32.Banker.etk",
        "malware_SHA1":"7c9c5ed13022df06545be28b3193ee6baeb2e4b5",
        "ASN":"12479",
        "detection_timestamp":"20060119150041",
        "AS_information":"UNI2-AS Uni2 Autonomous System",
        "domain":"perso.wanadoo.es",
        "malware_URL":"http://perso.wanadoo.es/selviba101",
        "MBL_ID":"MBL#14021",
        "malware_extension":"exe",
        "malware_MD5":"fe516740fb2a7b7fe8411963fa5e0e57"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol Command and Control Server Addresses (Sanitized)

Gunzipped JSON Sample Response:

[
    {
        "C2_URL":"http://www.technlip.com/wp-includes/pomo/joe/cp.php",
        "malware_family":"ZeuS",
        "detection_timestamp":"2014-03-30 19:14:47"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol Malware Hashes

Gunzipped JSON Sample Response:

[
    {
        "timestamp":"20060119150041",
        "md5":"fe516740fb2a7b7fe8411963fa5e0e57",
        "sha1":"7c9c5ed13022df06545be28b3193ee6baeb2e4b5",
        "classification":"TrojanBanker.Win32.Banker.etk"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol Malicious IP Addresses

Gunzipped JSON Sample Response:

[
    {
        "MBL_ID": "MBL-M-11386919",
        "IP_address": "122.226.188.6",
        "type": "malware_url",
        "classification": "Win32.210.Eldorado",
        "detection_timestamp": "20180714231621"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol Real Time DDoS Attacks

CSV Sample Response:

20181117034914,hpot,US-DC02,132.232.237.18,11211,N/A,Amplification/Reflection,3,3,2
20181116020037,hpot,US-DC02,197.219.208.66,11211,N/A,Amplification/Reflection,3,3,2
20181116170931,hpot,US-DC01,221.229.196.61,11211,N/A,Amplification/Reflection,3,3,2
20181116134950,hpot,US-DC02,66.240.205.221,1900,12,Amplification/Reflection,3,3,2

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol Domains Generated via DGA

Gunzipped JSON Sample Response:

[
    {
    "domain": "zpjnllaabettingk.com",
    "classification": "Banjori",
    "timestamp": "0000-00-00 00:00:00"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol - Anti Mining

Gunzipped JSON Sample Response:

[
    {
        "domain": "tovar4ka.ru",
        "IP":"5.101.152.21"
        "rank":">30M"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

Malware Patrol - Phishing

Gunzipped JSON Sample Response:

[
    {
        "domain": "shamoc.com",
        "language": "ro",
        "brand": "Microsoft",
        "id": "396390",
        "screenshot_file_name": "cd5c732c566ada475ef2acdc5fdfd081",
        "domain_ranking": "0",
        "score": "100",
        "flag_screenshot": "1",
        "detection_timestamp": "2019-09-23 21:35:54",
        "url": "http://www.christianbeaulieu.com/wp-includes/pomo/dol/uy131aguhv8lqpk9tsq63z1r.php"
    },
    ...
]

ThreatQuotient provides the following default mapping for this feed:

PDF Guides