munin

 _________   _    _   ______  _____  ______
| | | | | \ | |  | | | |  \ \  | |  | |  \ \     /.)
| | | | | | | |  | | | |  | |  | |  | |  | |    /)\|
|_| |_| |_| \_|__|_| |_|  |_| _|_|_ |_|  |_|   // /
                                              /'" "

Online Hash Checker for Virustotal and Other Services
Florian Roth

What is Munin?

Munin is a online hash checker utility that retrieves valuable information from various online sources

The current version of Munin queries the following services:

• Virustotal
• HybridAnalysis
• Any.Run
• URLhaus
• MISP
• CAPE
• Malshare
• Valhalla
• Hashlookup

Screenshot

Default Mode - Read Hashes from File

Usage

usage: munin.py [-h] [-f path] [--vh search-string]
                [--vhrule search-string] [-o output] [--vtwaitquota]
                [--vtminav min-matches] [--limit hash-limit]
                [--vhmaxage days] [-c cache-db] [-i ini-file]
                [-s sample-folder] [--comment] [-p vt-comment-prefix]
                [--download] [-d download_path] [--nocache] [--nocsv]
                [--verifycert] [--sort] [--web] [-w port] [--cli]
                [--rescan] [--debug]

Online Hash Checker

optional arguments:
  -h, --help            show this help message and exit
  -f path               File to process (hash line by line OR csv with hash
                        in each line - auto-detects position and comment)
  --vh search-string    Query Valhalla for hashes by keyword, tags, YARA
                        rule name, Mitre ATT&CK software (e.g. S0154),
                        technique (e.g. T1023) or threat group (e.g. G0049)
  --vhrule search-string
                        Query Valhalla for hashes via rules by keyword,
                        tags, YARA rule name, Mitre ATT&CK software (e.g.
                        S0154), technique (e.g. T1023) or threat group
                        (e.g. G0049)
  -o output             Output file for results (CSV)
  --vtwaitquota         Do not continue if VT quota is exceeded but wait
                        for the next day
  --vtminav min-matches
                        Minimum number of AV matches to query hash info
                        from VT"
  --limit hash-limit    Exit after handling this much new hashes in batch
                        mode (cache ignored).
  --vhmaxage days       Maximum age of sample on Valhalla to process
  -c cache-db           Name of the cache database file (default: vt-hash-
                        db.json)
  -i ini-file           Name of the ini file that holds the API keys
  -s sample-folder      Folder with samples to process
  --comment             Posts a comment for the analysed hash which
                        contains the comment from the log line
  -p vt-comment-prefix  Virustotal comment prefix
  --download            Enables Sample Download from Hybrid Analysis.
                        SHA256 of sample needed.
  -d download_path      Output Path for Sample Download from Hybrid
                        Analysis. Folder must exist
  --nocache             Do not use cache database file
  --nocsv               Do not write a CSV with the results
  --verifycert          Verify SSL/TLS certificates
  --sort                Sort the input lines
  --web                 Run Munin as web service
  -w port               Web service port
  --cli                 Run Munin in command line interface mode
  --rescan              Trigger a rescan of each analyzed file
  --debug               Debug output

Features

• Retrieves valuable information from Virustotal via API (JSON response) and other information via permalink (HTML parsing)
• Retrieves extra information from a list of platforms
• Keeps a history (cache) to query the services only once for a hash that may appear multiple times in the text file
• Cached objects are stored in JSON
• Creates CSV file with the findings for easy post-processing and reporting
• Appends results to a previous CSV if available

Displays

• Hash and comment (comment is the rest of the line of which the hash has been extracted)
• AV vendor matches based on a user defined list
• Filenames used in the wild
• PE information like the description, the original file name and the copyright statement
• Signer of a signed portable executable
• Result based on Virustotal ratio
• First and last submission
• Tags for certain indicators: Harmless, Signed, Expired, Revoked, MSSoftware

Extra Checks

• Queries Malshare.com for sample uploads
• Queries Hybrid-Analysis.com for reports
• Queries multiple MISP instances for available events
• Queries Any.run sandbox for reports
• Queries CAPE sandbox for reports
• Queries URLhaus for reports
• Queries Malshare for available samples
• Queries Valhalla for YARA rule matches
• Imphash duplicates in current batch > allows you to spot overlaps in import table hashes
• PE signature duplicate checks

Operation Modes

1. Default - by providing an input file (-f) with hashes or sample directory (-s)
2. Query - to search hashes from Valhalla by keyword, tags, ATT&CK technique (e.g. T1023), ATT&CK threat group (e.g. G0049) or rule name (-q)
3. Command Line Interface - using the --cli parameter
4. Web Service Mode - using the --web parameter

Getting started

1. Download / clone the repo
2. Install required packages: pip3 install -r requirements.txt (on macOS add --user)
3. Set the API keys for the different services in your custom ini file cp munin.ini my.ini (see section Get the API Keys for help)
4. Use the demo file for a first run: python munin.py -i my.ini -f munin-demo.txt

Requirements

• Python 3.7 and higher
• Internet Connection (Proxy Support; SSL/TLS interception can be a problem)

Typical Command Lines

Process a Virustotal Retrohunt result and sort the lines before checking so that matched signatures are checked in blocks

python3 munin.py -i my.ini -f ~/Downloads/retro_hunt

Process a directory with samples and check their hashes online

python3 munin.py -i my.ini -s ~/malware/case34

Use the command line interface mode (new in v0.14)

python3 munin.py -i my.ini

Get the API Keys

Virustotal

1. Create an account here https://www.virustotal.com/#/join-us
2. Check Profile > My API key for your public API key

MalShare

Register here https://malshare.com/register.php

Malware Bazaar

Register here https://bazaar.abuse.ch/. You can then find your API key in your Account Overview.

Hybrid Analysis

1. Create an account here https://www.hybrid-analysis.com/signup
2. After login, check Profile > API key

MISP

1. Log into your MISP
2. Go to your profile "My Profile"
3. The value of Authkey is used as API key
4. Note that the .ini file uses both a list for the MISP instances and for the respective API keys

Valhalla