| name | analyzing-malware-family-relationships-with-malpedia |
| description | Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages. |
| domain | cybersecurity |
| subdomain | threat-intelligence |
| tags | ["malpedia","malware-family","yara","threat-actor","malware-tracking","threat-intelligence","variant-analysis","malware-intelligence"] |
| version | 1.0 |
| author | mahipal |
| license | Apache-2.0 |
Analyzing Malware Family Relationships with Malpedia
Overview
Malpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.
Prerequisites
- Python 3.9+ with
requests, yara-python, stix2 libraries
- Malpedia API key (register at https://malpedia.caad.fkie.fraunhofer.de/)
- Understanding of malware classification and naming conventions
- Familiarity with YARA rule syntax for detection
- Access to malware samples for validation (optional)
Key Concepts
Malpedia Data Model
Malpedia organizes malware into Families (e.g., "win.cobalt_strike"), each containing: aliases (vendor-specific names like "Beacon", "CobaltStrike"), YARA rules (community and vendor-contributed), actor associations (threat groups using the family), reference reports (CTI reports documenting the family), and sample hashes (representative samples for each variant).
Malware Family Naming
Malpedia uses the format platform.family_name (e.g., win.emotet, elf.mirai, apk.flubot). Platforms include win (Windows), elf (Linux), apk (Android), osx (macOS), and py (Python). This standardized naming resolves the "many names" problem where different vendors assign different names to the same malware.
Family Relationships
Malware families have relationships including: parent-child (code reuse, forks), loader-payload (Emotet loads TrickBot loads Ryuk), shared authorship (same threat actor develops multiple tools), and infrastructure sharing (common C2 frameworks).
Practical Steps
Step 1: Query Malpedia API for Malware Families
import requests
import json
from collections import defaultdict
class MalpediaClient:
BASE_URL = "https://malpedia.caad.fkie.fraunhofer.de/api"
def __init__(self, api_key):
self.headers = {"Authorization": f"apitoken {api_key}"}
def get_family_list(self):
"""Get list of all malware families."""
resp = requests.get(f"{self.BASE_URL}/list/families",
headers=self.headers, timeout=30)
if resp.status_code == 200:
families = resp.json()
print(f"[+] Malpedia: {len(families)} malware families")
return families
return {}
def get_family_info(self, family_name):
"""Get detailed information about a malware family."""
resp = requests.get(f"{self.BASE_URL}/get/family/{family_name}",
headers=self.headers, timeout=30)
if resp.status_code == 200:
info = resp.json()
print(f"[+] Family: {family_name}")
print()
()
()
info
()
():
resp = requests.get(,
headers=.headers, timeout=)
resp.status_code == :
rules = resp.json()
rule_count = ((v) v rules.values()) (rules, )
()
rules
{}
():
resp = requests.get(,
headers=.headers, timeout=)
resp.status_code == :
data = resp.json()
families = data.get(, {})
()
data
{}
():
all_families = .get_family_list()
matches = {
name: info name, info all_families.items()
keyword.lower() name.lower()
keyword.lower() (info.get(, [])).lower()
}
()
matches
client = MalpediaClient()
families = client.get_family_list()
emotet_info = client.get_family_info()
Step 2: Map Malware Family Relationships
class MalwareFamilyMapper:
def __init__(self, malpedia_client):
self.client = malpedia_client
self.relationship_graph = defaultdict(list)
def map_actor_ecosystem(self, actor_name):
"""Map the malware ecosystem used by a threat actor."""
actor_data = self.client.get_actor_families(actor_name)
families = actor_data.get("families", {})
ecosystem = {
"actor": actor_name,
"families": [],
"family_count": len(families),
}
for family_name in families:
info = self.client.get_family_info(family_name)
if info:
ecosystem["families"].append({
"name": family_name,
"aliases": info.get("alt_names", []),
"description": info.get("description", "")[:200],
"shared_actors": [
a.get("value", "")
for a in info.get("attribution", [])
],
"reference_count": len(info.get("urls", [])),
})
print(f"\n=== {actor_name} Malware Ecosystem ===")
fam ecosystem[]:
shared = [a a fam[] a != actor_name]
()
()
shared:
()
ecosystem
():
actor_families = {}
actor actor_names:
data = .client.get_actor_families(actor)
actor_families[actor] = (data.get(, {}).keys())
shared = {}
i, actor1 (actor_names):
actor2 actor_names[i+:]:
common = actor_families[actor1] & actor_families[actor2]
common:
shared[] = (common)
()
pair, families shared.items():
()
f families[:]:
()
shared
():
info = .client.get_family_info(family_name)
info:
{}
chain = {
: family_name,
: info.get(, ),
: [],
: [],
}
known_chains = {
: {: [], : [, , ]},
: {: [], : [, , ]},
: {: [, ], : [, ]},
: {: [, , ], : []},
}
family_name known_chains:
chain[] = known_chains[family_name][]
chain[] = known_chains[family_name][]
chain
mapper = MalwareFamilyMapper(client)
ecosystem = mapper.map_actor_ecosystem()
shared = mapper.find_shared_tooling([, , ])
chain = mapper.build_loader_payload_chain()
Step 3: Extract and Compile YARA Rules
def compile_yara_ruleset(client, family_names, output_file="malware_yara_rules.yar"):
"""Compile YARA rules for multiple malware families."""
all_rules = []
for family in family_names:
yara_data = client.get_family_yara(family)
if isinstance(yara_data, dict):
for source, rules in yara_data.items():
if isinstance(rules, list):
for rule in rules:
all_rules.append(f"// Source: {source} - Family: {family}\n{rule}")
elif isinstance(rules, str):
all_rules.append(f"// Source: {source} - Family: {family}\n{rules}")
with open(output_file, "w") as f:
f.write(f"// Malpedia YARA Rules - {len(all_rules)} rules\n")
f.write(f"// Families: {', '.join(family_names)}\n\n")
for rule in all_rules:
f.write(rule + "\n\n")
print(f"[+] Compiled {len(all_rules)} YARA rules to {output_file}")
return all_rules
compile_yara_ruleset(client, [, , ])
Validation Criteria
- Malpedia API queried successfully for malware families
- Family information retrieved with aliases, actors, and references
- Actor-family relationships mapped correctly
- Shared tooling between actors identified
- YARA rules extracted and compiled for detection
- Loader-payload chains documented for threat intelligence
References
