Looks up a file hash in abuse.ch MalwareBazaar: malware family, tags, file type, first seen date and reporter
Community-packaged from github.com/3c7/bazaar: the registry's community pins the upstream release; the tool is its authors' work. Maintain that project? Claim this package.
Run
Through ot mcp, an agent calls run_tool with this; ot asks you before anything that goes online or touches a target. Set it up: ot mcp install claude (or cursor, vscode, codex, gemini).
{"tool":"osintverse-community/malwarebazaar","target":"275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f","input_type":"hash"}Or just say: "Run osintverse-community/malwarebazaar on 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f with OTInstaller." The registry's read-only MCP server at api.otinstaller.com/mcp can find tools without installing anything.
ot run osintverse-community/malwarebazaar --hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f --format tableot install osintverse-community/malwarebazaarDocker image in a read-only container · network allowed · needs ABUSECH_AUTH_KEY · up to 2 min. The first ot run installs the tool after asking once. The example value is the registry's own test input, so this command has run. Drop --format table for JSON.
ot? Install it in one linecurl -fsSL https://get.otinstaller.com/ot | shot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in /usr/local/bin or ~/.local/bin. Nothing else is written. Read the script.irm https://get.otinstaller.com/ot.ps1 | iexot release for your machine from GitHub Releases.checksums.txt, and the Ed25519 signature on that file against the key built into the script.ot in %LOCALAPPDATA%\Programs\ot, and adds it to your PATH. Nothing else is written. Read the script.sha256:5134a5c6…891f42. The same bytes on every install; ot pulls by digest, never by tag.ot checks the same identity before every install and refuses another signer.ot pulls the same digest from the mirror and checks the same signature.Not health-checked yet; 0.2.9 came out today; nobody has said yet whether it works.
0.2.9 is in its first week. Nobody has said whether it works yet.
Used 0.2.9?It's broken for me
{
"envelope": 1,
"tool": "osintverse-community/malwarebazaar@0.2.9",
"runtime": "docker",
"input": {
"hash": "275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f"
},
"started_at": "2026-10-21T09:00:00Z",
"duration_ms": 4100,
"exit_code": 0,
"entities": [
{
"type": "document",
"value": "report.pdf",
"attrs": {
"author": "Jane Doe"
}
}
],
"warnings": []
}Every tool returns this shape, shaped here from what this tool declares it finds. --format table to read it; ot extract and ot auto to continue.
This repository packages github.com/3c7/bazaar for the OTInstaller Registry as osintverse-community/malwarebazaar. The tool is the work of its authors, under the MIT license; this repository only holds the manifest and release workflow.
Report problems with the tool upstream, and problems with the packaging here. If you maintain the upstream project and want to publish it yourself, open an issue or run ot claim osintverse-community/malwarebazaar: the package is transferred to you.
The Dockerfile here installs the upstream release from PyPI at a pinned version, and the otinstaller release workflow builds, signs and publishes the image.
malwarebazaar.sh writes the ABUSECH_AUTH_KEY secret into the bazaar CLI's config file inside the container (the CLI reads its key only from there) and runs bazaar query --json hash. The image installs the cli extra, which the command needs. A hash MalwareBazaar doesn't know, or a key it refuses, prints [].
ot run osintverse-community/malwarebazaar --hash …Packaged version: 0.2.9.
Alternatives to malwarebazaar that also take a hash; ot auto runs every installed one on the same value.
Looks up a file hash in PolySwarm and shows how its marketplace of malware engines judged the file
Searches Joe Sandbox for earlier malware analyses of a file hash, URL or domain, with verdicts and scores
Looks up a file hash in CIRCL hashlookup to see whether it belongs to known software, such as NSRL sets
Looks up an IP, domain, URL or file hash in AlienVault OTX: the threat reports that mention it, malware, tags
Looks up an IP, domain, URL or file hash in VirusTotal: engine verdicts, reputation, tags, owner, DNS records