New service - the Team Cymru Malware Hash Registry!
Hi This email is to announce a new look-up service that Team Cymru is launching today. The Malware Hash Registry (MHR) service allows you to query our database of many millions of unique malware samples for a computed MD5 or SHA-1 hash of a file. If it is malware and we know about it, we return the last time we've seen it along with an approximate anti-virus detection percentage. THERE IS NO COST FOR NON-COMMERCIAL USE OF THIS TOOL. ACCESS IS PUBLICLY AVAILABLE TO ANYONE. Upon submission of a malware hash, the output of the command will return a date the sample was first seen as well as the detection rate we've seen using up to 30 AV packages. The detection rate is based on the first time we scanned the sample. Queries, including reasonable bulk queries, may be made using the command line only. The MHR compliments an anti-virus (AV) strategy by helping to identify unknown or suspicious files that we have already identified as malicious. This enables you to take action earlier than you would otherwise be able to. Full details including command syntax and procedures can be found at: https://www.team-cymru.org/Services/MHR/ This is one of several new (free) data sets and services we are currently providing to the community; if you haven't visited our (recently revamped) site recently please do so for details of the extensive work we do for the security community as well as further advice, data and tips to help you make your networks more secure: https://www.team-cymru.org/Services We very much look forward to working with you all on this new project and we sincerely hope that as many of you as possible will be able to actively participate in the use of this unique and very exciting new service. Warm regards, Team Cymru.
Interesting idea -- two questions: a) Will Cymru be developing any plugins for sendmail and the like that facilitate Cymru's MHR to be queried? b) Is Cymru cooperating with VirusTotal on this project? They compute hashes, too, and it could be a data feed for Cymru's content Frank -----Original Message----- From: Ian Cook [mailto:ian@cymru.com] Sent: Monday, October 27, 2008 1:12 PM To: nanog@nanog.org Subject: New service - the Team Cymru Malware Hash Registry! Hi This email is to announce a new look-up service that Team Cymru is launching today. The Malware Hash Registry (MHR) service allows you to query our database of many millions of unique malware samples for a computed MD5 or SHA-1 hash of a file. If it is malware and we know about it, we return the last time we've seen it along with an approximate anti-virus detection percentage. THERE IS NO COST FOR NON-COMMERCIAL USE OF THIS TOOL. ACCESS IS PUBLICLY AVAILABLE TO ANYONE. Upon submission of a malware hash, the output of the command will return a date the sample was first seen as well as the detection rate we've seen using up to 30 AV packages. The detection rate is based on the first time we scanned the sample. Queries, including reasonable bulk queries, may be made using the command line only. The MHR compliments an anti-virus (AV) strategy by helping to identify unknown or suspicious files that we have already identified as malicious. This enables you to take action earlier than you would otherwise be able to. Full details including command syntax and procedures can be found at: https://www.team-cymru.org/Services/MHR/ This is one of several new (free) data sets and services we are currently providing to the community; if you haven't visited our (recently revamped) site recently please do so for details of the extensive work we do for the security community as well as further advice, data and tips to help you make your networks more secure: https://www.team-cymru.org/Services We very much look forward to working with you all on this new project and we sincerely hope that as many of you as possible will be able to actively participate in the use of this unique and very exciting new service. Warm regards, Team Cymru.
Hi, Frank.
Interesting idea -- two questions:
Thanks!
a) Will Cymru be developing any plugins for sendmail and the like that facilitate Cymru's MHR to be queried?
We've not done so, but it's an interesting idea. Would it make more sense to focus on a plugin for sundry anti-spam and anti-virus products instead? We have a few more services to release first, though, so stay tuned. :)
b) Is Cymru cooperating with VirusTotal on this project? They compute hashes, too, and it could be a data feed for Cymru's content
We work with with lots of folks, and are happy to work with even more. Introductions or suggestions are always welcome! Got a name or email address handy? Thanks, Rob. -- Rob Thomas Team Cymru http://www.team-cymru.org/ cmn_err(CEO_PANIC, "Out of coffee!");
Yes, for antivirus checking. I can't direct you on how development on those plugins could be focused, but I'm sure there are listservs/people who could help you with that. I don't have any special inroads, but I'll send you the contact info for Virustotal offline. Frank -----Original Message----- From: Rob Thomas [mailto:robt@cymru.com] Sent: Tuesday, October 28, 2008 12:04 PM To: Frank Bulk Cc: ian@cymru.com; nanog@nanog.org Subject: Re: New service - the Team Cymru Malware Hash Registry! Hi, Frank.
Interesting idea -- two questions:
Thanks!
a) Will Cymru be developing any plugins for sendmail and the like that facilitate Cymru's MHR to be queried?
We've not done so, but it's an interesting idea. Would it make more sense to focus on a plugin for sundry anti-spam and anti-virus products instead? We have a few more services to release first, though, so stay tuned. :)
b) Is Cymru cooperating with VirusTotal on this project? They compute hashes, too, and it could be a data feed for Cymru's content
We work with with lots of folks, and are happy to work with even more. Introductions or suggestions are always welcome! Got a name or email address handy? Thanks, Rob. -- Rob Thomas Team Cymru http://www.team-cymru.org/ cmn_err(CEO_PANIC, "Out of coffee!");
participants (3)
-
Frank Bulk -
Ian Cook -
Rob Thomas