MalwareBazaar offers the exporting of hash lists in the following formats:

CSV files Plain text files Daily MISP Events Code Signin Certificate Blocklist (CSCB) YARA Rules Statistics

CSV files

The following data exports exists in CSV format:

Plain text files

The following data exports exists in plain text format:

Daily MISP Events

You can download MalwareBazaar IOCs as daily MISP events. New MISP events get generated at midnight. Plese do not try to fetch them before 00:15 UTC.

Code Signing Certificate Blocklist (CSCB)

MalwareBazaar maintains a blocklist that consists of Code Signing Certificates used by threat actors to sign malware. It is being generated every 5 minutes. More information about the CSCB is available on the FAQ page.

YARA Rule Statistics

The following statistics documents all YARA rules known to MalwareBazaar, includ the number of malware samples that match a certain YARA rule and when the last hit has been observed (timestamp). You can use this statistic to query the corresponding API endpoint for a specific YARA rule.

Please note that this statistic is generated once per hour and available via JSON and CSV format. Please do not fetch it more often than that.