Wheres My Malware

How many times have you come across a sample in a report that you want to find but to check your N number of internal or external services for it? Well this tool aims to remove some of that headache. WheresMyMalware will query known malware services and check if the sample exists in those repositories. Out of the box it supports the following services:

• VirusTotal
• Malshare
• HybridAnalysis

Adding Services

Knowing that each of us has their own private repos of malware or custom APIs for handling malware, I tried to make it as easy as possible to add more services. Services must expose the following functions.

type MalwareService interface {
	QueryForSample(hash string) (bool, error)
	DownloadSample(hash string) ([]byte, error)
}

With these functions created, you need to expose an init function that will to the setup of the malware service client.

type Initialize func() (malsrc.MalwareService, error)

Once that is done, the service just has to be added to the services slice in main.go.