MalwareBazaar API: Getting Malware APK Lists with Python (Step by Step)

by admin
in News
on 08/14/2026

MalwareBazaar, run by abuse.ch, is one of the most useful free sources of live malware samples. Analysts use it every day to track new threats, and its public API makes it easy to pull recent hashes, filter by tag (for example apk or emotet), and enrich lists programmatically. Best of all: the basic API needs no API key.

In this guide you’ll learn how to query MalwareBazaar with curl, then write a small Python script that downloads a list of recent Android malware hashes and saves it as JSON.

What is MalwareBazaar?

MalwareBazaar is a free community platform that collects malware samples shared by researchers around the world. Each entry has metadata: SHA-256 hash, file type, tag, first seen date, and links to detection results. The API lets you search and download this data programmatically, which makes it perfect for threat-intelligence dashboards, feed automation, and research scripts.

API basics

Endpoint: https://mb-api.abuse.ch/api/v1/
Authentication: none required for read-only queries (a few, like get_file, may be rate-limited for anonymous users).
Requests: HTTP POST with form fields.
Rate limits: keep requests modest (a few per minute is fine).

Getting recent samples with curl

curl -X POST https://mb-api.abuse.ch/api/v1/      -d 'query=get_recent'      -d 'selector=100'

This returns the 100 most recent samples as JSON. To filter only Android APKs, use get_tag_information:

curl -X POST https://mb-api.abuse.ch/api/v1/      -d 'query=get_tag_information'      -d 'tag=apk'

A Python script to fetch and save the list

import json
import requests

API = "https://mb-api.abuse.ch/api/v1/"

def get_apk_hashes(limit=50):
    resp = requests.post(API, data={
        "query": "get_tag_information",
        "tag": "apk",
    }, timeout=30)
    resp.raise_for_status()
    data = resp.json()
    if data.get("query_status") != "ok":
        raise RuntimeError(data.get("query_status"))
    rows = []
    for item in data.get("data", [])[:limit]:
        rows.append({
            "sha256": item["sha256_hash"],
            "first_seen": item.get("first_seen"),
            "signature": item.get("signature"),
            "tags": item.get("tags", []),
        })
    return rows

if __name__ == "__main__":
    hashes = get_apk_hashes(50)
    with open("apk_list.json", "w") as f:
        json.dump(hashes, f, indent=2)
    print(f"Saved {len(hashes)} APK hashes to apk_list.json")

Enriching the list

Once you have SHA-256 hashes, you can cross-check them with the MalwareBazaar get_hash query for detections, or enrich them with VirusTotal if you have an API key. A nice end goal is a small CSV that maps each hash to its signature and first-seen date — exactly the kind of dataset you can feed into a dashboard.

A note on ethics and safety

Always analyze downloaded samples in an isolated environment (a sandbox or a dedicated VM with no network access). MalwareBazaar exists to help defenders, so use these lists to study threats — never to test them on systems you do not own.

We built a ready-to-use Python tool that does exactly this — MalwareBazaar-APK_list — and you can find all our repositories on the Repositories page.

MalwareBazaar API: Getting Malware APK Lists with Python (Step by Step)