bazaar_list_samples.py

#!/usr/bin/env python3
import requests
import sys
import argparse
import json

from jq import jq

__author__ = "Corsin Camichel"
__copyright__ = "Copyright 2020, Corsin Camichel"
__license__ = "Creative Commons Attribution-ShareAlike 4.0 International License."
__version__ = "1.0"
__email__ = "cocaman@gmail.com"

parser = argparse.ArgumentParser(description='Get most recent samples on Malware Bazaar by abuse.ch')
parser.add_argument('-s', '--selector', help='Selector type you want', type=str, metavar="SELECTOR", required=False, default="100", choices=['100', 'time'])
parser.add_argument('-f', '--field', help='Single field you want', type=str, metavar="FIELD", required=False, choices=['sha256_hash', 'sha1_hash', 'md5_hash', 'file_name', 'signature', 'imphash'])

args = parser.parse_args()

headers = { 'API-KEY': '' }

data = {
    'query': 'get_recent',
    'selector': str(args.selector),
}

response = requests.post('https://mb-api.abuse.ch/api/v1/', data=data, timeout=15, headers=headers)
json_response = response.content.decode("utf-8", "ignore")

if(args.field):
    query = ".data[]." + args.field
    json_response = jq(query).transform(text=json_response, text_output=True)

print(json_response)