InQuest Labs Command Line Driver

Usage:
    inquestlabs [options] dfi list
    inquestlabs [options] dfi details <sha256> [--attributes]
    inquestlabs [options] dfi download <sha256> <path> [--encrypt]
    inquestlabs [options] dfi attributes <sha256> [--filter=<filter>]
    inquestlabs [options] dfi search (code|context|metadata|ocr) <keyword>
    inquestlabs [options] dfi search (md5|sha1|sha256|sha512) <hash>
    inquestlabs [options] dfi search (domain|email|filename|filepath|ip|registry|url|xmpid) <ioc>
    inquestlabs [options] dfi sources
    inquestlabs [options] dfi upload <path>
    inquestlabs [options] iocdb list
    inquestlabs [options] iocdb search <keyword>
    inquestlabs [options] iocdb sources
    inquestlabs [options] repdb list
    inquestlabs [options] repdb search <keyword>
    inquestlabs [options] repdb sources
    inquestlabs [options] yara (b64re|base64re) <regex> [(--big-endian|--little-endian)]
    inquestlabs [options] yara hexcase <instring>
    inquestlabs [options] yara uint <instring> [--offset=<offset>] [--hex]
    inquestlabs [options] yara widere <regex> [(--big-endian|--little-endian)]
    inquestlabs [options] yara cidr <ipv4>
    inquestlabs [options] lookup ip <ioc>
    inquestlabs [options] lookup domain <ioc>
    inquestlabs [options] report <ioc>
    inquestlabs [options] stats
    inquestlabs [options] setup <apikey>
    inquestlabs [options] trystero list-days
    inquestlabs [options] trystero list-samples <yyyy-mm-dd>

Options:
    --attributes        Include attributes with DFI record.
    --api=<apikey>      Specify an API key.
    --big-endian        Toggle big endian.
    --config=<config>   Configuration file with API key [default: ~/.iqlabskey].
    --debug             Docopt debugging.
    --encrypt           Zip sample with password 'infected' before downloading.
    --filter=<filter>   Filter by attributes type (domain, email, filename, filepath, ip, registry, url, xmpid)
    -h --help           Show this screen.
    --hex               Treat <instring> as hex bytes.
    -l --limits         Show remaining API credits and limit reset window.
    --little-endian     Toggle little endian.
    --offset=<offset>   Specify an offset other than 0 for the trigger.
    --proxy=<proxy>     Intermediate proxy
    --timeout=<timeout> Maximum amount of time to wait for IOC report.
    --verbose=<level>   Verbosity level, outputs to stderr [default: 0].
    --version           Show version.

$ inquestlabs trystero list-days | jq .
{
  "2021-01-08": 27,
  "2021-01-09": 26,
  "2021-04-20": 47,
  "2020-12-31": 304,
  "2021-01-03": 21,
  "2021-01-01": 7,
  "2021-01-06": 35,
  "2021-01-07": 17,
  "2021-01-04": 17,
  "2021-01-05": 20,
  "2021-06-14": 8,
  "2021-07-27": 55,
  "2021-03-28": 17,
  "2021-03-29": 18,
  "2021-03-26": 269,
  "2021-03-27": 52,
  "2021-03-24": 169,
  "2021-03-25": 543,
  "2021-03-22": 5,
  "2021-03-23": 197,
  "2021-03-20": 28,
  "2021-03-21": 46,
  "2021-04-12": 5,
  "2021-04-13": 23,
  "2021-03-18": 142,
  "2021-04-11": 13,
  "2021-04-16": 28,
  "2021-04-17": 94,
  "2021-04-14": 30,
  "2021-04-15": 46,
  "2021-06-21": 9,
  "2021-04-18": 13,
  "2021-04-19": 16,
  "2021-04-07": 40,
  "2021-06-20": 33,
  "2021-07-11": 22,
  "2021-08-09": 22,
  "first_record": "2020-08-09",
  "2021-06-22": 23,
  "2021-05-20": 490,
  "2021-01-19": 139,
  "2021-01-18": 16,
  "2021-04-26": 11,
  "2020-12-20": 3,
  "2020-12-23": 124,
  "2021-05-07": 60,
  "2021-01-11": 42,
  "2021-01-10": 5,
  "2021-01-13": 4,
  "2021-01-15": 35,
  "2021-01-14": 115,
  "2021-01-17": 15,
  "2021-01-16": 26,
  "2021-07-10": 43,
  "2021-04-02": 117,
  "2021-06-24": 88,
  "2021-06-25": 67,
  "2021-04-05": 16,
  "2021-05-21": 741,
  "2021-06-26": 4,
  "2021-03-31": 54,
  "2021-03-30": 51,
  "2021-06-23": 48,
  "2021-04-04": 18,
  "2021-02-21": 9,
  "2021-02-20": 113,
  "2021-02-23": 47,
  "2021-02-22": 10,
  "2021-02-25": 235,
  "2021-02-24": 54,
  "2021-02-27": 39,
  "2021-02-26": 42,
  "2021-04-09": 15,
  "2021-02-28": 19,
  "2021-04-06": 32,
  "2021-07-22": 147,
  "2021-04-08": 42,
  "2021-05-22": 1314,
  "2021-04-24": 35,
  "2021-05-02": 22,
  "2021-01-28": 60,
  "2021-01-29": 183,
  "2020-11-06": 1,
  "2021-01-25": 19,
  "2021-01-26": 42,
  "2020-11-05": 2,
  "2021-01-20": 1168,
  "2020-11-03": 26,
  "2021-01-22": 516,
  "2021-01-23": 361,
  "2021-03-01": 12,
  "2021-03-02": 117,
  "2021-03-03": 31,
  "2021-03-04": 17,
  "2021-03-05": 11,
  "2021-03-06": 10,
  "2021-03-07": 9,
  "2021-03-08": 13,
  "2021-03-09": 19,
  "2021-04-03": 45,
  "2021-05-03": 7,
  "2021-02-14": 5,
  "2021-02-15": 8,
  "2021-02-16": 19,
  "2021-02-17": 426,
  "2021-02-10": 113,
  "2021-02-11": 107,
  "2021-02-12": 77,
  "2021-02-13": 67,
  "2021-02-18": 40,
  "2021-02-19": 121,
  "2021-05-24": 20,
  "2021-06-30": 64,
  "2021-08-05": 30,
  "2021-08-04": 406,
  "2021-08-07": 30,
  "2021-08-06": 49,
  "2021-08-01": 582,
  "2021-08-03": 154,
  "2021-08-02": 60,
  "2021-07-13": 17,
  "2021-01-31": 19,
  "2021-01-30": 144,
  "2021-05-05": 95,
  "2021-07-12": 174,
  "2020-11-15": 1,
  "2021-04-10": 24,
  "2021-03-17": 113,
  "2021-03-16": 92,
  "2021-02-09": 389,
  "2021-02-08": 26,
  "2021-03-13": 197,
  "2021-03-12": 147,
  "2020-08-28": 1,
  "2021-03-10": 595,
  "2021-02-03": 87,
  "2021-02-02": 48,
  "2021-02-01": 13,
  "2020-08-25": 26,
  "2021-02-07": 33,
  "2021-02-06": 27,
  "2021-02-05": 103,
  "2021-02-04": 141,
  "2021-05-28": 33,
  "2021-07-15": 51,
  "2021-06-06": 154,
  "2021-06-09": 33,
  "2021-07-14": 43,
  "2021-03-15": 26,
  "2021-06-08": 33,
  "2020-12-18": 55,
  "2020-12-19": 14,
  "2021-03-14": 26,
  "2021-08-10": 36,
  "2021-04-29": 122,
  "2020-12-11": 1,
  "2020-12-15": 4,
  "2020-12-16": 18,
  "2020-12-17": 22,
  "2021-05-19": 180,
  "2021-03-11": 168,
  "2020-11-26": 1,
  "2021-07-16": 16,
  "2021-05-27": 236,
  "2020-08-26": 22,
  "2021-05-06": 71,
  "2021-04-28": 51,
  "2020-08-27": 7,
  "2020-08-31": 1,
  "2020-08-24": 5,
  "2021-05-31": 16,
  "2021-05-30": 11,
  "2021-05-18": 242,
  "2020-09-22": 1,
  "2020-09-25": 1,
  "2020-09-26": 1,
  "2020-08-22": 63,
  "2021-06-07": 22,
  "2021-05-01": 20,
  "2020-08-23": 2,
  "2021-01-24": 35,
  "2021-06-27": 2,
  "2020-08-20": 26,
  "2020-12-07": 1,
  "2020-12-05": 6,
  "2020-12-04": 4,
  "2020-12-03": 3,
  "2021-01-27": 99,
  "2021-01-21": 73,
  "2021-07-09": 30,
  "2021-04-27": 35,
  "2021-07-29": 184,
  "2021-06-11": 30,
  "2021-05-26": 27,
  "2021-07-23": 54,
  "2021-07-20": 5,
  "2021-07-26": 17,
  "2021-06-12": 26,
  "2021-07-24": 7,
  "2021-07-04": 8,
  "2021-06-13": 9,
  "2021-05-23": 31,
  "2021-04-01": 47,
  "2021-06-15": 15,
  "2021-03-19": 189,
  "2021-07-07": 31,
  "2021-06-16": 10,
  "2021-06-05": 49,
  "2021-06-18": 20,
  "2021-04-25": 24,
  "2021-07-02": 50,
  "2021-06-19": 135,
  "2020-09-02": 3,
  "2020-09-01": 2,
  "2020-09-05": 1,
  "2020-09-04": 11,
  "2021-06-03": 36,
  "2021-07-30": 505,
  "2021-04-23": 48,
  "2020-08-19": 93,
  "2021-05-15": 38,
  "2021-06-02": 50,
  "2021-05-14": 575,
  "2020-12-29": 457,
  "2021-04-22": 61,
  "2021-05-17": 14,
  "2021-05-16": 4,
  "2021-05-04": 79,
  "2021-04-30": 288,
  "2021-06-01": 49,
  "2021-07-08": 46,
  "2021-05-13": 156,
  "2021-04-21": 75,
  "2021-07-05": 19,
  "2021-07-06": 23,
  "2021-05-12": 23,
  "2021-07-01": 64,
  "2020-08-21": 29,
  "2021-07-03": 44,
  "2021-06-29": 4,
  "2021-05-25": 83
}

$ inquestlabs trystero list-samples 2021-06-29 | jq .
[
  {
    "analysis_completed": true,
    "bypasses": "google,microsoft",
    "subcategory": "macro_hunter",
    "classification": "MALICIOUS",
    "subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/macro_hunter.rule",
    "file_type": "OLE",
    "image": false,
    "vt_positives": 3,
    "inquest_alerts": [
      {
        "category": "info",
        "description": "Detected macro logic that can write data to the file system.",
        "reference": null,
        "title": "Macro with File System Write"
      },
      {
        "category": "evasive",
        "description": "Detected a macro with an elusive start-up hook. These esoteric hooks result in automated macro logic execution which may not be detected by dynamic analysis systems.",
        "reference": null,
        "title": "Macro with Esoteric Startup Hook"
      },
      {
        "category": "info",
        "description": "Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.",
        "reference": null,
        "title": "Macro with Startup Hook"
      },
      {
        "category": "malicious",
        "description": "An InQuest machine-learning model classified this macro as potentially malicious.",
        "reference": null,
        "title": "InQuest Machine Learning"
      },
      {
        "category": "suspicious",
        "description": "Detected macro logic that will load additional functionality from Dynamically Linked Libraries (DLLs). While not explicitly malicious, this is a common tactic for accessing APIs that are not otherwised exposed via Visual Basic for Applications (VBA).",
        "reference": null,
        "title": "Macro with DLL Reference"
      }
    ],
    "downloadable": true,
    "available_on_labs": true,
    "vt_weight": 0,
    "last_inquest_featext": "2021-06-28T04:16:36",
    "first_seen": "2021-06-28T04:15:47",
    "sha256": "c1df09944fe4eb4f7f86bd3a342e4548e584290167623959bca58acef4e25a1d",
    "mime_type": "application/cdfv2",
    "size": 1305088
  },
  {
    "analysis_completed": true,
    "bypasses": "microsoft",
    "subcategory": "macro_hunter",
    "classification": "MALICIOUS",
    "subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/macro_hunter.rule",
    "file_type": "OLE",
    "image": false,
    "vt_positives": 12,
    "inquest_alerts": [
      {
        "category": "info",
        "description": "Detected macro logic that can write data to the file system.",
        "reference": null,
        "title": "Macro with File System Write"
      },
      {
        "category": "info",
        "description": "Detected macro logic that will automatically execute on document open. Most malware contains some execution hook.",
        "reference": null,
        "title": "Macro with Startup Hook"
      },
      {
        "category": "info",
        "description": "Detected a macro with a suspicious string. Suspicious strings include privileged function calls, obfuscations, odd registry keys, etc...",
        "reference": null,
        "title": "Macro Contains Suspicious String"
      },
      {
        "category": "suspicious",
        "description": "Detected a macro that leverages Windows Management Instrumentation (WMI) functionality.",
        "reference": null,
        "title": "WMI Functionality"
      }
    ],
    "downloadable": true,
    "available_on_labs": true,
    "vt_weight": 6.199999809265137,
    "last_inquest_featext": "2021-06-28T12:14:44",
    "first_seen": "2021-06-28T12:13:41",
    "sha256": "59876f4baebcc78f3fcc944b24efb475f5030f6bb10190f4c07a6af5fa5c1568",
    "mime_type": "application/cdfv2",
    "size": 22528
  },
  {
    "analysis_completed": false,
    "bypasses": "google,microsoft",
    "subcategory": "maldoc_hunter",
    "classification": "MALICIOUS",
    "subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/maldoc_hunter.rule",
    "file_type": "OTHER",
    "image": false,
    "vt_positives": 9,
    "inquest_alerts": [
      {
        "category": "info",
        "description": "Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.",
        "reference": null,
        "title": "Windows PE Executable"
      },
      {
        "category": "suspicious",
        "description": "Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.",
        "reference": null,
        "title": "Base64 Encoded URL"
      }
    ],
    "downloadable": false,
    "available_on_labs": false,
    "vt_weight": 5.800000190734863,
    "last_inquest_featext": null,
    "first_seen": "2021-06-28T12:58:56",
    "sha256": "bd736e5b4dc9e802a4b9c4cab0d1e0df872ce3c42091142d50b7520dc02abaad",
    "mime_type": "application/x-msi",
    "size": 4687360
  },
  {
    "analysis_completed": false,
    "bypasses": "microsoft",
    "subcategory": "maljar_hunter",
    "classification": "MALICIOUS",
    "subcategory_url": "https://github.com/InQuest/yara-rules/blob/master/labs.inquest.net/maljar_hunter.rule",
    "file_type": "OTHER",
    "image": false,
    "vt_positives": 9,
    "inquest_alerts": [],
    "downloadable": false,
    "available_on_labs": false,
    "vt_weight": 3.5999999046325684,
    "last_inquest_featext": null,
    "first_seen": "2021-06-28T13:43:23",
    "sha256": "e4ae2b5eb9b8549a322354dff9e88a0a356646351f5087e2d6ef91a630ef6007",
    "mime_type": "application/x-java-applet",
    "size": 19799
  }
]