OpenSec Atlas

hash_hunter: An Open Source Tool for Threat Intelligence | OpenSec Atlas

Threat Intelligence

Tool

hash_hunter

Hash Hunter is a multithreaded CLI tool that checks if malware sample hashes exist across multiple threat intelligence repositories.

View on GitHub

About This Tool

Command-line tool to search for malware samples in various repositories

Primary Use Case

This tool is designed for security analysts and threat hunters who need to quickly verify the presence and verdict of malware samples by their hashes across various public and private repositories. It streamlines threat intelligence gathering by automating hash lookups, saving time in malware analysis workflows.

Key Features

Multithreaded hash search across multiple malware repositories
Supports Virus Total, Hybrid Analysis, MalShare, Malware Bazaar, Intezer, Maltiverse, URLHaus, Tri.age, InQuest Labs, and Hashlookup
Requires API keys or registrations for most services
Simple command-line interface for manual or batch hash input
Configurable via JSON file for API keys
Provides detailed sample availability and verdict results
Optimized for latency-based result ordering

Insights & Recommendations

Users must obtain and configure API keys or accounts for most integrated services to fully utilize the tool. Virus Total requires a paid API key. The tool relies on external services which may have query limits or require registration. Latency of API responses can affect result ordering.

Installation

Install Go programming language if not already installed
Get the JSON parsing module with: go get github.com/tidwall/gjson
Clone or download the repository from GitHub
Build the program from source using Go build tools
Create a config.json file with your API keys for supported services
Run the compiled executable from the command line

Usage

no flag

Manually enter SHA256 hashes one by one via standard input

-f <path/to/file>

Provide a file containing a list of SHA256 hashes separated by carriage returns for batch processing

Smart Usage Notes

Integrate Hash Hunter into automated threat intelligence pipelines to accelerate malware triage and reduce analyst workload.Use batch hash lookups during incident response to quickly correlate malware samples across multiple repositories.Leverage latency-based result ordering to prioritize faster sources for real-time threat hunting scenarios.Combine with sandboxing tools to enrich malware analysis with behavioral data after hash verification.Incorporate into SOC dashboards to provide analysts immediate visibility of malware prevalence and verdicts.