{"id":175,"date":"2026-08-14T15:02:53","date_gmt":"2026-08-14T15:02:53","guid":{"rendered":"https:\/\/www.limite-cero.com\/?p=175"},"modified":"2026-08-14T15:02:53","modified_gmt":"2026-08-14T15:02:53","slug":"malwarebazaar-api-guide-python","status":"publish","type":"post","link":"https:\/\/www.limite-cero.com\/es\/malwarebazaar-api-guide-python\/","title":{"rendered":"MalwareBazaar API: Getting Malware APK Lists with Python (Step by Step)"},"content":{"rendered":"<p>MalwareBazaar, run by abuse.ch, is one of the most useful free sources of live malware samples. Analysts use it every day to track new threats, and its public API makes it easy to pull recent hashes, filter by tag (for example <code>apk<\/code> or <code>emotet<\/code>), and enrich lists programmatically. Best of all: the basic API needs <strong>no API key<\/strong>.<\/p>\n<p>In this guide you&#8217;ll learn how to query MalwareBazaar with <code>curl<\/code>, then write a small Python script that downloads a list of recent Android malware hashes and saves it as JSON.<\/p>\n<p><img data-recalc-dims=\"1\" decoding=\"async\" class=\"aligncenter\" src=\"https:\/\/i0.wp.com\/www.limite-cero.com\/wp-content\/uploads\/2026\/08\/malwarebazaar-api-terminal.png?w=3840&#038;ssl=1\" alt=\"MalwareBazaar API terminal session querying recent malware samples with curl and Python\"  \/><\/p>\n<h2>What is MalwareBazaar?<\/h2>\n<p>MalwareBazaar is a free community platform that collects malware samples shared by researchers around the world. Each entry has metadata: SHA-256 hash, file type, tag, first seen date, and links to detection results. The API lets you search and download this data programmatically, which makes it perfect for threat-intelligence dashboards, feed automation, and research scripts.<\/p>\n<h2>API basics<\/h2>\n<ul>\n<li>Endpoint: <code>https:\/\/mb-api.abuse.ch\/api\/v1\/<\/code><\/li>\n<li>Authentication: none required for read-only queries (a few, like <code>get_file<\/code>, may be rate-limited for anonymous users).<\/li>\n<li>Requests: HTTP POST with form fields.<\/li>\n<li>Rate limits: keep requests modest (a few per minute is fine).<\/li>\n<\/ul>\n<h2>Getting recent samples with curl<\/h2>\n<pre><code>curl -X POST https:\/\/mb-api.abuse.ch\/api\/v1\/      -d 'query=get_recent'      -d 'selector=100'<\/code><\/pre>\n<p>This returns the 100 most recent samples as JSON. To filter only Android APKs, use <code>get_tag_information<\/code>:<\/p>\n<pre><code>curl -X POST https:\/\/mb-api.abuse.ch\/api\/v1\/      -d 'query=get_tag_information'      -d 'tag=apk'<\/code><\/pre>\n<h2>A Python script to fetch and save the list<\/h2>\n<pre><code>import json\nimport requests\n\nAPI = \"https:\/\/mb-api.abuse.ch\/api\/v1\/\"\n\ndef get_apk_hashes(limit=50):\n    resp = requests.post(API, data={\n        \"query\": \"get_tag_information\",\n        \"tag\": \"apk\",\n    }, timeout=30)\n    resp.raise_for_status()\n    data = resp.json()\n    if data.get(\"query_status\") != \"ok\":\n        raise RuntimeError(data.get(\"query_status\"))\n    rows = []\n    for item in data.get(\"data\", [])[:limit]:\n        rows.append({\n            \"sha256\": item[\"sha256_hash\"],\n            \"first_seen\": item.get(\"first_seen\"),\n            \"signature\": item.get(\"signature\"),\n            \"tags\": item.get(\"tags\", []),\n        })\n    return rows\n\nif __name__ == \"__main__\":\n    hashes = get_apk_hashes(50)\n    with open(\"apk_list.json\", \"w\") as f:\n        json.dump(hashes, f, indent=2)\n    print(f\"Saved {len(hashes)} APK hashes to apk_list.json\")<\/code><\/pre>\n<h2>Enriching the list<\/h2>\n<p>Once you have SHA-256 hashes, you can cross-check them with the MalwareBazaar <code>get_hash<\/code> query for detections, or enrich them with VirusTotal if you have an API key. A nice end goal is a small CSV that maps each hash to its signature and first-seen date &mdash; exactly the kind of dataset you can feed into a dashboard.<\/p>\n<h2>A note on ethics and safety<\/h2>\n<p>Always analyze downloaded samples in an <strong>isolated environment<\/strong> (a sandbox or a dedicated VM with no network access). MalwareBazaar exists to help defenders, so use these lists to study threats &mdash; never to test them on systems you do not own.<\/p>\n<h2>Related<\/h2>\n<p>We built a ready-to-use Python tool that does exactly this &mdash; <a href=\"https:\/\/www.limite-cero.com\/2021\/03\/malwarebazaar-apk_list\/\">MalwareBazaar-APK_list<\/a> &mdash; and you can find all our repositories on the <a href=\"https:\/\/www.limite-cero.com\/repositories\/\">Repositories<\/a> page.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A practical guide to the MalwareBazaar API: fetch recent malware APK hashes and enrich them with Python, with no API key required.<\/p>","protected":false},"author":1,"featured_media":165,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[3],"tags":[],"class_list":["post-175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.limite-cero.com\/wp-content\/uploads\/2026\/08\/malware-analysis-code-screen.jpg?fit=1920%2C1280&ssl=1","_links":{"self":[{"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/posts\/175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/comments?post=175"}],"version-history":[{"count":1,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/posts\/175\/revisions"}],"predecessor-version":[{"id":179,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/posts\/175\/revisions\/179"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/media\/165"}],"wp:attachment":[{"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/media?parent=175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/categories?post=175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.limite-cero.com\/es\/wp-json\/wp\/v2\/tags?post=175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}