Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: InfoSec Handlers Diary Blog - Team CYMRU's Malware Hash Registry InfoSec Handlers Diary Blog

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

Team CYMRU's Malware Hash Registry

Published: 2008-12-17
Last Updated: 2008-12-18 18:07:51 UTC
by donald smith (Version: 1)
1 comment(s)

Team Cymru has a new look-up service that launched recently.
The Malware Hash Registry (MHR) service allows you to
query their database of many millions of unique malware samples
for a computed MD5 or SHA-1 hash of a file. If it is malware
and they know about, they return the last time they have seen
it along with an approximate anti-virus detection percentage.


Upon submission of a malware hash, the output of the command will return
a date the sample was first seen as well as the detection rate they've
seen using up to 30 AV packages. The detection rate is based on the
first time they scanned the sample.

Queries, including reasonable bulk queries, may be made using the
command line only.

The MHR compliments an anti-virus (AV) strategy by helping to identify
unknown or suspicious files that they have already identified as
malicious. This enables you to take action earlier than you would
otherwise be able to.

Full details including command syntax and procedures can be found at

This is one of several new (free) data sets and services they are
currently providing to the community; if you haven't visited their
(recently revamped) site recently please do so for details of the
extensive work they do for the security community as well as further
advice, data and tips to help you make your networks more secure:

If you want to use this as an IDS like tool Seth Hall from
released this bro script into the public.

If you need to know which virus is being detected, you could use a
service like virustotal with an md5 hash lookup. Just go to this url and enter the checksum
(md5,sha1 or sha256) into the search bar. and are not related. So they won't have
all the same hashes. But there should be pretty good cross service hash matching.


Seth Hall wrote in and advised us that he has put a short wiki up about installing the necessary support for using his changes.

1 comment(s)
Diary Archives