Open Source - First response tool for threat hunting

It is a first response tool used for threat hunting and offers intel information from Virus Total, Hybrid Analysis, URLHaus, Polyswarm, Malshare, Alien Vault, Malpedia, Malware Bazaar, ThreatFox, Triage, InQuest and it is able to scan Android devices against VT.

It performs an initial and quick triage of malware samples, URLs, IP addresses, domains, malware families, IOCs and hashes. Additionally, Malwoverview is able to get dynamic and static behavior reports, submit and download samples from several endpoints. In few words, it works as a client to main existing sandboxes.

It can 

• Determine similar executable malware samples (PE/PE+) according to the import table (imphash) and group them by different colors (pay attention to the second column from output). Thus, colors matter!
• Show hash information on Virus Total, Hybrid Analysis, Malshare, Polyswarm, URLhaus, Alien Vault, Malpedia and ThreatCrowd engines.
• Determining whether the malware samples contain overlay and, if you want, extract it.
• Check suspect files on Virus Total, Hybrid Analysis and Polyswarm.
• Check URLs on Virus Total, Malshare, Polyswarm, URLhaus engines and Alien Vault.
• Download malware samples from Hybrid Analysis, Malshare, URLHaus, Polyswarm and Malpedia engines.
• Submit malware samples to VirusTotal, Hybrid Analysis and Polyswarm.
• List last suspected URLs from URLHaus.
• List last payloads from URLHaus.
• Search for specific payloads on the Malshare.
• Search for similar payloads (PE32/PE32+) on Polyswarm engine.
• Classify all files in a directory searching information on Virus Total and Hybrid Analysis.
• Make reports about a suspect domain using different engines such as VirusTotal, Malpedia and ThreatCrowd.
• Check APK packages directly from Android devices against Hybrid Analysis and Virus Total.
• Submit APK packages directly from Android devices to Hybrid Analysis and Virus Total.
• Show URLs related to an user provided tag from URLHaus.
• Show payloads related to a tag (signature) from URLHaus.
• Show information about an IP address from Virus Total, Alien Vault, Malpedia and ThreatCrowd.
• Show IP address, domain and URL information from Polyswarm.
• Perform meta-search on Polyswarm Network using several criteria: imphash, IPv4, domain, URL and malware family.
• Gather threat hunting information from AlienVault using different criteria.
• Gather threat hunting information from Malpedia using different criteria.
• Gather threat hunting information from Malware Bazaar using different criteria.
• Gather IOC information from ThreatFox using different criteria.
• Gather threat hunting information from Triage using different criteria.
• Get evaluation to hashes from a given file against Virus Total.
• Submit large files (>= 32 MB) to Virus Total.
• Malwoverview uses Virus Total API v.3, so there isn't longer any option using v.2.
• Retrieve different information from InQuest Labs and download samples from there.

Download Malwoverview