Repolode
Submit
alexandreborges

alexandreborges/malwoverview

A command-line first-response tool that queries many threat intelligence services, sandboxes and malware repositories for hashes, URLs, IPs and domains.

Open-source alternative to:VirusTotal Graph

View on GitHubWebsite
Stars
4,139
Forks
556
Open issues
0
Last commit
2 months ago

What is it?

Malwoverview is a first-response triage tool for threat hunters and malware analysts. It acts as a client for many services at once, including VirusTotal, Hybrid Analysis, URLHaus, Malware Bazaar, ThreatFox, Malshare, Polyswarm, AlienVault OTX, Malpedia, Triage, Shodan, AbuseIPDB, GreyNoise, URLScan.io and NIST NVD, so an analyst can check a hash, URL, IP, domain or CVE from one command line instead of visiting each site.

Beyond lookups, it can submit and download samples, batch-check hash lists, scan directories, extract IOCs from text, and scan files with YARA rules. Local features such as PE triage, entropy and overlay reporting, and Authenticode signature checks work without any API key. Optional LLM enrichment appends a risk assessment and MITRE ATT&CK mapping to query results, using Claude, Gemini, OpenAI or a local Ollama model.

The tool runs as a CLI, an interactive REPL or a text-based TUI, and can output JSON or CSV. It is installed from PyPI and requires Python 3.11 or later. By default it does not submit samples to any endpoint, so it can be used under NDA constraints.

Key features

  • 01Queries VirusTotal, Hybrid Analysis, Malware Bazaar, URLHaus, ThreatFox and many other threat intel sources from one CLI.
  • 02Batch hash checks, directory scans and IOC extraction from text files.
  • 03YARA scanning of files and directories, plus VirusTotal Retrohunt and Livehunt support.
  • 04Local PE triage and Authenticode signature checks that need no API key.
  • 05Optional LLM enrichment with Claude, Gemini, OpenAI or local Ollama.
  • 06Interactive REPL and TUI modes, with JSON and CSV output.

Use cases

  • First-pass triage of a suspicious file, hash, URL or IP during an incident.
  • Batch-checking a list of hashes or IPs against several threat intel services at once.
  • Scanning a folder of samples with YARA rules and summarizing matches.
  • Checking whether an Android device's installed APKs are known to sandboxes or VirusTotal.

Quick start

  1. 1

    Install Malwoverview with pip

    python -m pip install -U malwoverview
  2. 2

    Optionally install extras such as YARA scanning or TUI dashboard

    pip install malwoverview[all]
  3. 3

    Add your API keys to the .malwapi.conf file in your home directory

Things to know

  • Full functionality requires API keys for many separate third-party services.
  • Windows needs a specific python-magic setup, and macOS needs extra Homebrew steps.

Topics

#malware-analysis#threat-intelligence#threat-hunting#cybersecurity#virustotal#yara#ioc#alienvault#cve#cve-search

FAQ

What is malwoverview?
A command-line first-response tool that queries many threat intelligence services, sandboxes and malware repositories for hashes, URLs, IPs and domains. Malwoverview is a first-response triage tool for threat hunters and malware analysts. It acts as a client for many services at once, including VirusTotal, Hybrid Analysis, URLHaus, Malware Bazaar, ThreatFox, Malshare, Polyswarm, AlienVault OTX, Malpedia, Triage, Shodan, AbuseIPDB, GreyNoise, URLScan.io and NIST NVD, so an analyst can check a hash, URL, IP, domain or CVE from one command line instead of visiting each site.
Is malwoverview free to use? What license does it have?
malwoverview is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is malwoverview still maintained?
Updated within 6 months. The last commit to malwoverview was on Sep 22, 2026.
What can I use malwoverview for?
First-pass triage of a suspicious file, hash, URL or IP during an incident. Batch-checking a list of hashes or IPs against several threat intel services at once. Scanning a folder of samples with YARA rules and summarizing matches. Checking whether an Android device's installed APKs are known to sandboxes or VirusTotal.
How do I install malwoverview?
Install Malwoverview with pip: python -m pip install -U malwoverview Optionally install extras such as YARA scanning or TUI dashboard: pip install malwoverview[all] Add your API keys to the .malwapi.conf file in your home directory
Where can I get malwoverview?
The source code and installation instructions are on GitHub: https://github.com/alexandreborges/malwoverview

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects