analyzing-malware-family-relationships-with-malpedia

name	analyzing-malware-family-relationships-with-malpedia
description	Query the Malpedia API to look up malware family aliases and naming (platform.family_name), pull community/vendor YARA rules, link families to threat actors, and map family relationships such as loader-payload chains and shared authorship. Use when researching a malware family's aliases, lineage, or actor attribution, or when sourcing YARA rules for detection.
domain	cybersecurity
subdomain	threat-intelligence
tags	["malpedia","malware-family","yara","threat-actor","malware-tracking","threat-intelligence","variant-analysis","malware-intelligence"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]
mitre_attack	["T1587.001","T1027","T1071"]

Analyzing Malware Family Relationships with Malpedia

Overview

Malpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.

When to Use

• When investigating security incidents that require analyzing malware family relationships with malpedia
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with requests, yara-python, stix2 libraries
• Malpedia API key (register at https://malpedia.caad.fkie.fraunhofer.de/)
• Understanding of malware classification and naming conventions
• Familiarity with YARA rule syntax for detection
• Access to malware samples for validation (optional)

Key Concepts

Malpedia Data Model

Malpedia organizes malware into Families (e.g., "win.cobalt_strike"), each containing: aliases (vendor-specific names like "Beacon", "CobaltStrike"), YARA rules (community and vendor-contributed), actor associations (threat groups using the family), reference reports (CTI reports documenting the family), and sample hashes (representative samples for each variant).

Malware Family Naming

Malpedia uses the format platform.family_name (e.g., win.emotet, elf.mirai, apk.flubot). Platforms include win (Windows), elf (Linux), apk (Android), osx (macOS), and py (Python). This standardized naming resolves the "many names" problem where different vendors assign different names to the same malware.

Family Relationships

Malware families have relationships including: parent-child (code reuse, forks), loader-payload (Emotet loads TrickBot loads Ryuk), shared authorship (same threat actor develops multiple tools), and infrastructure sharing (common C2 frameworks).

Workflow

Step 1: Query Malpedia API for Malware Families

 requests
 json
 collections  defaultdict

 :
    BASE_URL = 

     ():
        .headers = {: }

     ():
        
        resp = requests.get(,
                           headers=.headers, timeout=)
         resp.status_code == :
            families = resp.json()
            ()
             families
         {}

     ():
        
        resp = requests.get(,
                           headers=.headers, timeout=)
         resp.status_code == :
            info = resp.json()
            ()
            ()
            ()
            ()
             info
        ()
         

     ():
        
        resp = requests.get(,
                           headers=.headers, timeout=)
         resp.status_code == :
            rules = resp.json()
            rule_count = ((v)  v  rules.values())  (rules, )  
            ()
             rules
         {}

     ():
        
        resp = requests.get(,
                           headers=.headers, timeout=)
         resp.status_code == :
            data = resp.json()
            families = data.get(, {})
            ()
             data
         {}

     ():
        
        all_families = .get_family_list()
        matches = {
            name: info  name, info  all_families.items()
             keyword.lower()  name.lower()
             keyword.lower()  (info.get(, [])).lower()
        }
        ()
         matches

client = MalpediaClient()
families = client.get_family_list()
emotet_info = client.get_family_info()