Search Malware - BlinkOps Documentation

Search ZeroFox’s CTI feed of malware for a specified file hash. To search for a specific file, provide one of MD5, SHA1, SHA256, or SHA512.

External DocumentationTo learn more, visit the ZeroFox documentation.

Basic Parameters

Parameter	Description
Created After	The date and time to return malware found from.
MD5	The MD5 hash of the file to search for.
Return All Pages	Automatically fetch all resources, page by page.
SHA1	The SHA1 hash of the file to search for.
SHA256	The SHA256 hash of the file to search for.
SHA512	The SHA512 hash of the file to search for.

Advanced Parameters

Parameter	Description
Cursor	The cursor of the results page to return. You can get it from the `next` URL of a previous response.

Example Output

{
	"next": null,
	"results": [
		{
			"created_at": "2023-06-30T17:44:35Z",
			"family": null,
			"md5": "e89b43d57a67a3f4d705028cfbd7b6fb",
			"sha1": "332c39d5130752b8c32d3b7275a05c13e874db84",
			"sha256": "****",
			"sha512": "809e3b6e2eb34a7a061bb8de610baef25f91c0dee5fe1d2e42d04a0ac42e43b40b1ee4e42352cc7d59322aa5cf4b2645c85fed7f36906d68e22e400d48e437ef",
			"tags": [
				"evasion",
				"themida",
				"trojan"
			],
			"botnet": [],
			"c2": []
		}
	]
}

Workflow Library Example

Search Malware with Zerofox and Send Results Via Email

Preview this Workflow on desktop