analyzing-malware-family-relationships-with-malpedia

name	analyzing-malware-family-relationships-with-malpedia
description	Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages. Use when working with analyzing malware family relationships with malpedia.
domain	cybersecurity
subdomain	threat-intelligence
tags	["malpedia","malware-family","yara","threat-actor","malware-tracking","threat-intelligence","variant-analysis","malware-intelligence"]
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Analyzing Malware Family Relationships with Malpedia

Overview

Malpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.

When to Use

Trigger phrases:

• "analyzing malware family relationships with malpedia"

• "Use the Malpedia platform and API to research malware family relationships, trac"

• When investigating security incidents that require analyzing malware family relationships with malpedia

• When building detection rules or threat hunting queries for this domain

• When SOC analysts need structured procedures for this analysis type

• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with requests, yara-python, stix2 libraries
• Malpedia API key (register at https://malpedia.caad.fkie.fraunhofer.de/)
• Understanding of malware classification and naming conventions
• Familiarity with YARA rule syntax for detection
• Access to malware samples for validation (optional)

Key Concepts

This section covers key concepts for analyzing malware family relationships with malpedia.

• Ensure all prerequisites are met before proceeding
• Follow the documented workflow steps in sequence
• Record results and any anomalies encountered during this phase

Malpedia Data Model

Malpedia organizes malware into Families (e.g., "win.cobalt_strike"), each containing: aliases (vendor-specific names like "Beacon", "CobaltStrike"), YARA rules (community and vendor-contributed), actor associations (threat groups using the family), reference reports (CTI reports documenting the family), and sample hashes (representative samples for each variant).

Malware Family Naming

Malpedia uses the format platform.family_name (e.g., win.emotet, elf.mirai, apk.flubot). Platforms include win (Windows), elf (Linux), apk (Android), osx (macOS), and py (Python). This standardized naming resolves the "many names" problem where different vendors assign different names to the same malware.