HatchingTriageSandbox_CloudAPI-lab.ipynb

{
 "cells": [
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "# Hatching Triage Cloud Sandbox API lab\n",
    "\n",
    "**https://tria.ge/**\n",
    "\n",
    "Docs: *https://tria.ge/docs/*\n",
    "\n",
    "1. get sample index\n",
    "\n",
    "2. get report by sample\n",
    "\n",
    "    2.1 summary report\n",
    "\n",
    "    2.2 overview report\n",
    "\n",
    "    2.3 behavioural report (onemon)\n",
    "\n",
    "3. get malware config by sample\n",
    "\n",
    "4. search report\n",
    "\n",
    "`WARNING1: SSL cert check is disabled for the case of proxy network use on this notebook's api requester.`\n",
    "\n",
    "Please adjust your network about verify=false|true in *requests.get(url, headers=headers,verify=False)*\n",
    "\n",
    "`WARNING2: This notebook contains some real raw IOC , not defang, about this sample https://tria.ge/230317-1nw93scb6x`\n",
    "\n",
    "Please be careful to an accsidental access to them."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 15,
   "metadata": {},
   "outputs": [],
   "source": [
    "# Set your API Key\n",
    "\n",
    "ak = \"XXXXXXXXXXXXXXX\" # replace to your apikey"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "1. get sample list\n",
    "\n",
    "**Example: the last 10 public samples index from tria.ge**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>status</th>\n",
       "      <th>kind</th>\n",
       "      <th>filename</th>\n",
       "      <th>private</th>\n",
       "      <th>submitted</th>\n",
       "      <th>url</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>230317-1ngjmaab43</td>\n",
       "      <td>static_analysis</td>\n",
       "      <td>file</td>\n",
       "      <td>xiWD7pKGwRtj8hd.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:47:34Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>230317-1mmz1scb6w</td>\n",
       "      <td>running</td>\n",
       "      <td>url</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:46:07Z</td>\n",
       "      <td>https://www.mediafire.com/file/30lxio0kb1v4g98...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>230317-1mfkyaab42</td>\n",
       "      <td>running</td>\n",
       "      <td>file</td>\n",
       "      <td>descargar</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:46Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>230317-1mdrcaab39</td>\n",
       "      <td>running</td>\n",
       "      <td>file</td>\n",
       "      <td>4e7ee394aa40adba71b44efb6b314f8686ba3ffa3f2392...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:40Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>230317-1ma1fscb6v</td>\n",
       "      <td>running</td>\n",
       "      <td>file</td>\n",
       "      <td>JneGIbdsQ29LT92.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:31Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>230317-1mappacb6t</td>\n",
       "      <td>static_analysis</td>\n",
       "      <td>url</td>\n",
       "      <td>NaN</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:30Z</td>\n",
       "      <td>https://autoclicker.uptodown.com/windows/desca...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>230317-1l4ldacb6s</td>\n",
       "      <td>static_analysis</td>\n",
       "      <td>file</td>\n",
       "      <td>SKlauncher 3.0.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:10Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>230317-1l23jscb51</td>\n",
       "      <td>running</td>\n",
       "      <td>file</td>\n",
       "      <td>fee5e40bed151eda0a4ed1fdc35af339bfc579921b4e78...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:05Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>230317-1l1vgsab38</td>\n",
       "      <td>pending</td>\n",
       "      <td>file</td>\n",
       "      <td>GTA San Adreas Full En Español.rar</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:45:01Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>230317-1ltfeacb5z</td>\n",
       "      <td>running</td>\n",
       "      <td>file</td>\n",
       "      <td>PlateUp.Build.22112022-OFME.rar</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:44:40Z</td>\n",
       "      <td>NaN</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                  id           status  kind  \\\n",
       "0  230317-1ngjmaab43  static_analysis  file   \n",
       "1  230317-1mmz1scb6w          running   url   \n",
       "2  230317-1mfkyaab42          running  file   \n",
       "3  230317-1mdrcaab39          running  file   \n",
       "4  230317-1ma1fscb6v          running  file   \n",
       "5  230317-1mappacb6t  static_analysis   url   \n",
       "6  230317-1l4ldacb6s  static_analysis  file   \n",
       "7  230317-1l23jscb51          running  file   \n",
       "8  230317-1l1vgsab38          pending  file   \n",
       "9  230317-1ltfeacb5z          running  file   \n",
       "\n",
       "                                            filename  private  \\\n",
       "0                                xiWD7pKGwRtj8hd.exe    False   \n",
       "1                                                NaN    False   \n",
       "2                                          descargar    False   \n",
       "3  4e7ee394aa40adba71b44efb6b314f8686ba3ffa3f2392...    False   \n",
       "4                                JneGIbdsQ29LT92.exe    False   \n",
       "5                                                NaN    False   \n",
       "6                                 SKlauncher 3.0.exe    False   \n",
       "7  fee5e40bed151eda0a4ed1fdc35af339bfc579921b4e78...    False   \n",
       "8                 GTA San Adreas Full En Español.rar    False   \n",
       "9                    PlateUp.Build.22112022-OFME.rar    False   \n",
       "\n",
       "              submitted                                                url  \n",
       "0  2023-03-17T21:47:34Z                                                NaN  \n",
       "1  2023-03-17T21:46:07Z  https://www.mediafire.com/file/30lxio0kb1v4g98...  \n",
       "2  2023-03-17T21:45:46Z                                                NaN  \n",
       "3  2023-03-17T21:45:40Z                                                NaN  \n",
       "4  2023-03-17T21:45:31Z                                                NaN  \n",
       "5  2023-03-17T21:45:30Z  https://autoclicker.uptodown.com/windows/desca...  \n",
       "6  2023-03-17T21:45:10Z                                                NaN  \n",
       "7  2023-03-17T21:45:05Z                                                NaN  \n",
       "8  2023-03-17T21:45:01Z                                                NaN  \n",
       "9  2023-03-17T21:44:40Z                                                NaN  "
      ]
     },
     "execution_count": 2,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "''' 1. get sample list '''\n",
    "import pandas as pd\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    " \n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"samples?&subset=public&limit=10&offset=0\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "jsonResponse = r.json()\n",
    "df = pd.json_normalize(jsonResponse['data'])\n",
    "df\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>sample</th>\n",
       "      <th>status</th>\n",
       "      <th>custom</th>\n",
       "      <th>owner</th>\n",
       "      <th>org_id</th>\n",
       "      <th>target</th>\n",
       "      <th>created</th>\n",
       "      <th>completed</th>\n",
       "      <th>score</th>\n",
       "      <th>sha256</th>\n",
       "      <th>...</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.target</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.backend</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.resource</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.task_name</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.os</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.timeout</th>\n",
       "      <th>tasks.230317-1nw93scb6x-behavioral1.sigs</th>\n",
       "      <th>tasks.230317-1nw93scb6x-static1.kind</th>\n",
       "      <th>tasks.230317-1nw93scb6x-static1.status</th>\n",
       "      <th>tasks.230317-1nw93scb6x-static1.score</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>230317-1nw93scb6x</td>\n",
       "      <td>reported</td>\n",
       "      <td>frontend:c80ab57d-042a-49f4-8f41-baa40806e6db</td>\n",
       "      <td>shark2.ams5.hatching.dev</td>\n",
       "      <td>64316b18-4eee-4ac7-9bd0-eb033f64073a</td>\n",
       "      <td>7536959004cfaffaa35f87689d5920ff86704128730cf9...</td>\n",
       "      <td>2023-03-17T21:48:19Z</td>\n",
       "      <td>2023-03-17T21:50:55Z</td>\n",
       "      <td>10</td>\n",
       "      <td>7536959004cfaffaa35f87689d5920ff86704128730cf9...</td>\n",
       "      <td>...</td>\n",
       "      <td>7536959004cfaffaa35f87689d5920ff86704128730cf9...</td>\n",
       "      <td>sbx4m18</td>\n",
       "      <td>win10v2004-20230220-en</td>\n",
       "      <td>dridex</td>\n",
       "      <td>windows10-2004-x64</td>\n",
       "      <td>150</td>\n",
       "      <td>17</td>\n",
       "      <td>static</td>\n",
       "      <td>reported</td>\n",
       "      <td>1</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>1 rows × 25 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "              sample    status                                         custom  \\\n",
       "0  230317-1nw93scb6x  reported  frontend:c80ab57d-042a-49f4-8f41-baa40806e6db   \n",
       "\n",
       "                      owner                                org_id  \\\n",
       "0  shark2.ams5.hatching.dev  64316b18-4eee-4ac7-9bd0-eb033f64073a   \n",
       "\n",
       "                                              target               created  \\\n",
       "0  7536959004cfaffaa35f87689d5920ff86704128730cf9...  2023-03-17T21:48:19Z   \n",
       "\n",
       "              completed  score  \\\n",
       "0  2023-03-17T21:50:55Z     10   \n",
       "\n",
       "                                              sha256  ...  \\\n",
       "0  7536959004cfaffaa35f87689d5920ff86704128730cf9...  ...   \n",
       "\n",
       "          tasks.230317-1nw93scb6x-behavioral1.target  \\\n",
       "0  7536959004cfaffaa35f87689d5920ff86704128730cf9...   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-behavioral1.backend  \\\n",
       "0                                     sbx4m18   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-behavioral1.resource  \\\n",
       "0                       win10v2004-20230220-en   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-behavioral1.task_name  \\\n",
       "0                                        dridex   \n",
       "\n",
       "   tasks.230317-1nw93scb6x-behavioral1.os  \\\n",
       "0                      windows10-2004-x64   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-behavioral1.timeout  \\\n",
       "0                                         150   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-behavioral1.sigs  \\\n",
       "0                                       17   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-static1.kind tasks.230317-1nw93scb6x-static1.status  \\\n",
       "0                               static                               reported   \n",
       "\n",
       "  tasks.230317-1nw93scb6x-static1.score  \n",
       "0                                     1  \n",
       "\n",
       "[1 rows x 25 columns]"
      ]
     },
     "execution_count": 3,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "''' 2.1 get summary report by sample '''\n",
    "import pandas as pd\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    " \n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"samples/230317-1nw93scb6x/summary\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "jsonResponse = r.json()\n",
    "df = pd.json_normalize(jsonResponse)\n",
    "df\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "  \"analysis\": {\n",
      "    \"family\": [\n",
      "      \"amadey\",\n",
      "      \"redline\"\n",
      "    ],\n",
      "    \"score\": 10,\n",
      "    \"tags\": [\n",
      "      \"family:amadey\",\n",
      "      \"family:redline\",\n",
      "      \"botnet:laba\",\n",
      "      \"botnet:mango\",\n",
      "      \"discovery\",\n",
      "      \"evasion\",\n",
      "      \"infostealer\",\n",
      "      \"persistence\",\n",
      "      \"spyware\",\n",
      "      \"stealer\",\n",
      "      \"trojan\"\n",
      "    ]\n",
      "  },\n",
      "  \"extracted\": [\n",
      "    {\n",
      "      \"config\": {\n",
      "        \"attr\": {\n",
      "          \"auth_value\": \"ecf79d7f5227d998a3501c972d915d23\"\n",
      "        },\n",
      "        \"botnet\": \"mango\",\n",
      "        \"c2\": [\n",
      "          \"193.233.20.28:4125\"\n",
      "        ],\n",
      "        \"family\": \"redline\",\n",
      "        \"rule\": \"RedLine\"\n",
      "      },\n",
      "      \"dumped_file\": \"memory/4036-218-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "      \"resource\": \"behavioral1/memory/4036-218-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "      \"tasks\": [\n",
      "        \"behavioral1\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"config\": {\n",
      "        \"attr\": {\n",
      "          \"auth_value\": \"2cf01cffff9092a85ca7e106c547190b\"\n",
      "        },\n",
      "        \"botnet\": \"laba\",\n",
      "        \"c2\": [\n",
      "          \"193.233.20.28:4125\"\n",
      "        ],\n",
      "        \"family\": \"redline\",\n",
      "        \"rule\": \"RedLine\"\n",
      "      },\n",
      "      \"dumped_file\": \"files/0x00020000000225be-1144.dat\",\n",
      "      \"resource\": \"behavioral1/files/0x00020000000225be-1144.dat\",\n",
      "      \"tasks\": [\n",
      "        \"behavioral1\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"config\": {\n",
      "        \"c2\": [\n",
      "          \"31.41.244.200/games/category/index.php\"\n",
      "        ],\n",
      "        \"family\": \"amadey\",\n",
      "        \"rule\": \"AmadeyV2\",\n",
      "        \"version\": \"3.68\"\n",
      "      },\n",
      "      \"dumped_file\": \"files/0x000200000001f749-1151.dat\",\n",
      "      \"resource\": \"behavioral1/files/0x000200000001f749-1151.dat\",\n",
      "      \"tasks\": [\n",
      "        \"behavioral1\"\n",
      "      ]\n",
      "    }\n",
      "  ],\n",
      "  \"sample\": {\n",
      "    \"completed\": \"2023-03-17T21:50:55Z\",\n",
      "    \"created\": \"2023-03-17T21:48:19Z\",\n",
      "    \"id\": \"230317-1nw93scb6x\",\n",
      "    \"md5\": \"bcdb2b4919276dac29908b4cc7e1ae7e\",\n",
      "    \"score\": 10,\n",
      "    \"sha1\": \"b449f2482f4126a437c9ab14294a70189217d9ad\",\n",
      "    \"sha256\": \"7536959004cfaffaa35f87689d5920ff86704128730cf9a113df6cfe84860970\",\n",
      "    \"sha512\": \"85a5cabc275f8129308cd4e93cd866c8dfbdf55028715b9684cc3a3edfd07af16ea425fa0f878e2981a01818a9fb01303ae79806df8d771d0755386fa3458e66\",\n",
      "    \"size\": 1257472,\n",
      "    \"ssdeep\": \"24576:igcL02I4/sr0X8KvEjUS3/XxExcPXxp2eCEpH:igcL02Ix2SPX2+PX8\",\n",
      "    \"target\": \"7536959004cfaffaa35f87689d5920ff86704128730cf9a113df6cfe84860970\"\n",
      "  },\n",
      "  \"signatures\": [\n",
      "    {\n",
      "      \"desc\": \"Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.\",\n",
      "      \"label\": \"amadey\",\n",
      "      \"name\": \"Amadey\",\n",
      "      \"score\": 10,\n",
      "      \"tags\": [\n",
      "        \"trojan\",\n",
      "        \"family:amadey\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"label\": \"modifies_realtime_protection_registry\",\n",
      "      \"name\": \"Modifies Windows Defender Real-time Protection settings\",\n",
      "      \"score\": 10,\n",
      "      \"tags\": [\n",
      "        \"evasion\",\n",
      "        \"trojan\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1112\",\n",
      "        \"T1031\",\n",
      "        \"T1089\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"RedLine Stealer is a malware family written in C#, first appearing in early 2020.\",\n",
      "      \"label\": \"redline\",\n",
      "      \"name\": \"RedLine\",\n",
      "      \"score\": 10,\n",
      "      \"tags\": [\n",
      "        \"infostealer\",\n",
      "        \"family:redline\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"indicators\": [\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-218-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-219-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-221-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-223-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-225-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-227-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-229-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-231-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-233-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-235-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-237-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-239-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-241-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-243-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-245-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-249-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        },\n",
      "        {\n",
      "          \"resource\": \"behavioral1/memory/4036-247-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "          \"yara_rule\": \"family_redline\"\n",
      "        }\n",
      "      ],\n",
      "      \"name\": \"RedLine payload\",\n",
      "      \"score\": 10\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"Looks up country code configured in the registry, likely geofence.\",\n",
      "      \"label\": \"reg_checks_country_code\",\n",
      "      \"name\": \"Checks computer location settings\",\n",
      "      \"score\": 7,\n",
      "      \"ttp\": [\n",
      "        \"T1012\",\n",
      "        \"T1082\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"name\": \"Executes dropped EXE\",\n",
      "      \"score\": 7\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"Infostealers often target stored browser data, which can include saved credentials etc.\",\n",
      "      \"label\": \"browser_user_data_harvesting\",\n",
      "      \"name\": \"Reads user/profile data of web browsers\",\n",
      "      \"score\": 7,\n",
      "      \"tags\": [\n",
      "        \"spyware\",\n",
      "        \"stealer\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1005\",\n",
      "        \"T1081\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"label\": \"modifies_windows_security_registry\",\n",
      "      \"name\": \"Windows security modification\",\n",
      "      \"score\": 7,\n",
      "      \"tags\": [\n",
      "        \"evasion\",\n",
      "        \"trojan\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1089\",\n",
      "        \"T1112\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"label\": \"sig_crypto_wallet\",\n",
      "      \"name\": \"Accesses cryptocurrency files/wallets, possible credential harvesting\",\n",
      "      \"score\": 6,\n",
      "      \"tags\": [\n",
      "        \"spyware\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1005\",\n",
      "        \"T1081\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"label\": \"creates_runkey_registry\",\n",
      "      \"name\": \"Adds Run key to start application\",\n",
      "      \"score\": 6,\n",
      "      \"tags\": [\n",
      "        \"persistence\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1060\",\n",
      "        \"T1112\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"Looks up Uninstall key entries in the registry to enumerate software on the system.\",\n",
      "      \"label\": \"checks_uninstall_regkeys\",\n",
      "      \"name\": \"Checks installed software on the system\",\n",
      "      \"score\": 6,\n",
      "      \"tags\": [\n",
      "        \"discovery\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1012\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.\",\n",
      "      \"label\": \"file_antivm_ide_drive\",\n",
      "      \"name\": \"Enumerates physical storage devices\",\n",
      "      \"score\": 3,\n",
      "      \"ttp\": [\n",
      "        \"T1082\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"label\": \"program_crash\",\n",
      "      \"name\": \"Program crash\",\n",
      "      \"score\": 3\n",
      "    },\n",
      "    {\n",
      "      \"desc\": \"Schtasks is often used by malware for persistence or to perform post-infection execution.\",\n",
      "      \"label\": \"schtasks_persist\",\n",
      "      \"name\": \"Creates scheduled task(s)\",\n",
      "      \"tags\": [\n",
      "        \"persistence\"\n",
      "      ],\n",
      "      \"ttp\": [\n",
      "        \"T1053\"\n",
      "      ]\n",
      "    },\n",
      "    {\n",
      "      \"name\": \"Suspicious behavior: EnumeratesProcesses\"\n",
      "    },\n",
      "    {\n",
      "      \"name\": \"Suspicious use of AdjustPrivilegeToken\"\n",
      "    },\n",
      "    {\n",
      "      \"name\": \"Suspicious use of WriteProcessMemory\"\n",
      "    }\n",
      "  ],\n",
      "  \"targets\": [\n",
      "    {\n",
      "      \"family\": [\n",
      "        \"amadey\",\n",
      "        \"redline\"\n",
      "      ],\n",
      "      \"iocs\": {\n",
      "        \"domains\": [\n",
      "          \"58.55.71.13.in-addr.arpa\",\n",
      "          \"76.38.195.152.in-addr.arpa\",\n",
      "          \"38.146.190.20.in-addr.arpa\",\n",
      "          \"210.81.184.52.in-addr.arpa\",\n",
      "          \"97.17.167.52.in-addr.arpa\",\n",
      "          \"28.20.233.193.in-addr.arpa\",\n",
      "          \"44.8.109.52.in-addr.arpa\",\n",
      "          \"200.244.41.31.in-addr.arpa\",\n",
      "          \"199.176.139.52.in-addr.arpa\",\n",
      "          \"97.238.32.23.in-addr.arpa\"\n",
      "        ],\n",
      "        \"ips\": [\n",
      "          \"8.8.8.8\",\n",
      "          \"193.233.20.28\",\n",
      "          \"13.69.239.73\",\n",
      "          \"8.238.178.254\",\n",
      "          \"173.223.113.164\",\n",
      "          \"173.223.113.131\",\n",
      "          \"131.253.33.203\",\n",
      "          \"31.41.244.200\",\n",
      "          \"93.184.221.240\"\n",
      "        ],\n",
      "        \"urls\": [\n",
      "          \"http://31.41.244.200/games/category/index.php\"\n",
      "        ]\n",
      "      },\n",
      "      \"md5\": \"bcdb2b4919276dac29908b4cc7e1ae7e\",\n",
      "      \"score\": 10,\n",
      "      \"sha1\": \"b449f2482f4126a437c9ab14294a70189217d9ad\",\n",
      "      \"sha256\": \"7536959004cfaffaa35f87689d5920ff86704128730cf9a113df6cfe84860970\",\n",
      "      \"sha512\": \"85a5cabc275f8129308cd4e93cd866c8dfbdf55028715b9684cc3a3edfd07af16ea425fa0f878e2981a01818a9fb01303ae79806df8d771d0755386fa3458e66\",\n",
      "      \"signatures\": [\n",
      "        {\n",
      "          \"desc\": \"Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.\",\n",
      "          \"label\": \"amadey\",\n",
      "          \"name\": \"Amadey\",\n",
      "          \"score\": 10,\n",
      "          \"tags\": [\n",
      "            \"trojan\",\n",
      "            \"family:amadey\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"label\": \"modifies_realtime_protection_registry\",\n",
      "          \"name\": \"Modifies Windows Defender Real-time Protection settings\",\n",
      "          \"score\": 10,\n",
      "          \"tags\": [\n",
      "            \"evasion\",\n",
      "            \"trojan\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1112\",\n",
      "            \"T1031\",\n",
      "            \"T1089\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"RedLine Stealer is a malware family written in C#, first appearing in early 2020.\",\n",
      "          \"label\": \"redline\",\n",
      "          \"name\": \"RedLine\",\n",
      "          \"score\": 10,\n",
      "          \"tags\": [\n",
      "            \"infostealer\",\n",
      "            \"family:redline\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"indicators\": [\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-218-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-219-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-221-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-223-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-225-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-227-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-229-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-231-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-233-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-235-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-237-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-239-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-241-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-243-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-245-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-249-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            },\n",
      "            {\n",
      "              \"resource\": \"behavioral1/memory/4036-247-0x00000000076A0000-0x00000000076DE000-memory.dmp\",\n",
      "              \"yara_rule\": \"family_redline\"\n",
      "            }\n",
      "          ],\n",
      "          \"name\": \"RedLine payload\",\n",
      "          \"score\": 10\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"Looks up country code configured in the registry, likely geofence.\",\n",
      "          \"label\": \"reg_checks_country_code\",\n",
      "          \"name\": \"Checks computer location settings\",\n",
      "          \"score\": 7,\n",
      "          \"ttp\": [\n",
      "            \"T1012\",\n",
      "            \"T1082\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"name\": \"Executes dropped EXE\",\n",
      "          \"score\": 7\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"Infostealers often target stored browser data, which can include saved credentials etc.\",\n",
      "          \"label\": \"browser_user_data_harvesting\",\n",
      "          \"name\": \"Reads user/profile data of web browsers\",\n",
      "          \"score\": 7,\n",
      "          \"tags\": [\n",
      "            \"spyware\",\n",
      "            \"stealer\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1005\",\n",
      "            \"T1081\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"label\": \"modifies_windows_security_registry\",\n",
      "          \"name\": \"Windows security modification\",\n",
      "          \"score\": 7,\n",
      "          \"tags\": [\n",
      "            \"evasion\",\n",
      "            \"trojan\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1089\",\n",
      "            \"T1112\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"label\": \"sig_crypto_wallet\",\n",
      "          \"name\": \"Accesses cryptocurrency files/wallets, possible credential harvesting\",\n",
      "          \"score\": 6,\n",
      "          \"tags\": [\n",
      "            \"spyware\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1005\",\n",
      "            \"T1081\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"label\": \"creates_runkey_registry\",\n",
      "          \"name\": \"Adds Run key to start application\",\n",
      "          \"score\": 6,\n",
      "          \"tags\": [\n",
      "            \"persistence\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1060\",\n",
      "            \"T1112\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"Looks up Uninstall key entries in the registry to enumerate software on the system.\",\n",
      "          \"label\": \"checks_uninstall_regkeys\",\n",
      "          \"name\": \"Checks installed software on the system\",\n",
      "          \"score\": 6,\n",
      "          \"tags\": [\n",
      "            \"discovery\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1012\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.\",\n",
      "          \"label\": \"file_antivm_ide_drive\",\n",
      "          \"name\": \"Enumerates physical storage devices\",\n",
      "          \"score\": 3,\n",
      "          \"ttp\": [\n",
      "            \"T1082\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"label\": \"program_crash\",\n",
      "          \"name\": \"Program crash\",\n",
      "          \"score\": 3\n",
      "        },\n",
      "        {\n",
      "          \"desc\": \"Schtasks is often used by malware for persistence or to perform post-infection execution.\",\n",
      "          \"label\": \"schtasks_persist\",\n",
      "          \"name\": \"Creates scheduled task(s)\",\n",
      "          \"tags\": [\n",
      "            \"persistence\"\n",
      "          ],\n",
      "          \"ttp\": [\n",
      "            \"T1053\"\n",
      "          ]\n",
      "        },\n",
      "        {\n",
      "          \"name\": \"Suspicious behavior: EnumeratesProcesses\"\n",
      "        },\n",
      "        {\n",
      "          \"name\": \"Suspicious use of AdjustPrivilegeToken\"\n",
      "        },\n",
      "        {\n",
      "          \"name\": \"Suspicious use of WriteProcessMemory\"\n",
      "        }\n",
      "      ],\n",
      "      \"size\": 1257472,\n",
      "      \"ssdeep\": \"24576:igcL02I4/sr0X8KvEjUS3/XxExcPXxp2eCEpH:igcL02Ix2SPX2+PX8\",\n",
      "      \"tags\": [\n",
      "        \"family:amadey\",\n",
      "        \"family:redline\",\n",
      "        \"botnet:laba\",\n",
      "        \"botnet:mango\",\n",
      "        \"discovery\",\n",
      "        \"evasion\",\n",
      "        \"infostealer\",\n",
      "        \"persistence\",\n",
      "        \"spyware\",\n",
      "        \"stealer\",\n",
      "        \"trojan\"\n",
      "      ],\n",
      "      \"target\": \"7536959004cfaffaa35f87689d5920ff86704128730cf9a113df6cfe84860970\",\n",
      "      \"tasks\": [\n",
      "        \"behavioral1\"\n",
      "      ]\n",
      "    }\n",
      "  ],\n",
      "  \"tasks\": {\n",
      "    \"230317-1nw93scb6x-behavioral1\": {\n",
      "      \"backend\": \"sbx4m18\",\n",
      "      \"kind\": \"behavioral\",\n",
      "      \"name\": \"behavioral1\",\n",
      "      \"os\": \"windows10-2004-x64\",\n",
      "      \"resource\": \"win10v2004-20230220-en\",\n",
      "      \"score\": 10,\n",
      "      \"sigs\": 17,\n",
      "      \"status\": \"reported\",\n",
      "      \"tags\": [\n",
      "        \"family:amadey\",\n",
      "        \"family:redline\",\n",
      "        \"botnet:laba\",\n",
      "        \"botnet:mango\",\n",
      "        \"discovery\",\n",
      "        \"evasion\",\n",
      "        \"infostealer\",\n",
      "        \"persistence\",\n",
      "        \"spyware\",\n",
      "        \"stealer\",\n",
      "        \"trojan\"\n",
      "      ],\n",
      "      \"target\": \"7536959004cfaffaa35f87689d5920ff86704128730cf9a113df6cfe84860970.exe\",\n",
      "      \"task_name\": \"dridex\",\n",
      "      \"timeout\": 150\n",
      "    },\n",
      "    \"230317-1nw93scb6x-static1\": {\n",
      "      \"kind\": \"static\",\n",
      "      \"name\": \"static1\",\n",
      "      \"score\": 1,\n",
      "      \"status\": \"reported\"\n",
      "    }\n",
      "  },\n",
      "  \"version\": \"0.2.3\"\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "''' 2.2 get overview report by sample (json) '''\n",
    "import json\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    " \n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"samples/230317-1nw93scb6x/overview.json\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "jsonResponse = r.json()\n",
    "print(json.dumps(jsonResponse, indent=2))\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "2. get report by sample (onemon json array -> ndjson)\n",
    "\n",
    "Points!.\n",
    "**onemon json is a ndjson array, so choose pd.read_json(r.text,lines=True)**"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>kind</th>\n",
       "      <th>event</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>onemon.Whois</td>\n",
       "      <td>{'arch': 'x86', 'author': 'Hatching B.V.', 'bu...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': 'C:\\Windows\\system32\\lsass.exe', '...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': 'C:\\Windows\\system32\\services.exe'...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': '\"fontdrvhost.exe\"', 'exitStatus':...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': 'C:\\Windows\\system32\\svchost.exe -...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>...</th>\n",
       "      <td>...</td>\n",
       "      <td>...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4548</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': '\"BackgroundTransferHost.exe\" -Ser...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4549</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': '\"BackgroundTransferHost.exe\" -Ser...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4550</th>\n",
       "      <td>onemon.SyscallI</td>\n",
       "      <td>{'arg0': 30000, 'kind': 'Sleep', 'pid': 2848, ...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4551</th>\n",
       "      <td>onemon.Process</td>\n",
       "      <td>{'command': '\"C:\\Windows\\system32\\backgroundTa...</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4552</th>\n",
       "      <td>onemon.SyscallI</td>\n",
       "      <td>{'arg0': 30000, 'kind': 'Sleep', 'pid': 2848, ...</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "<p>4553 rows × 2 columns</p>\n",
       "</div>"
      ],
      "text/plain": [
       "                 kind                                              event\n",
       "0        onemon.Whois  {'arch': 'x86', 'author': 'Hatching B.V.', 'bu...\n",
       "1      onemon.Process  {'command': 'C:\\Windows\\system32\\lsass.exe', '...\n",
       "2      onemon.Process  {'command': 'C:\\Windows\\system32\\services.exe'...\n",
       "3      onemon.Process  {'command': '\"fontdrvhost.exe\"', 'exitStatus':...\n",
       "4      onemon.Process  {'command': 'C:\\Windows\\system32\\svchost.exe -...\n",
       "...               ...                                                ...\n",
       "4548   onemon.Process  {'command': '\"BackgroundTransferHost.exe\" -Ser...\n",
       "4549   onemon.Process  {'command': '\"BackgroundTransferHost.exe\" -Ser...\n",
       "4550  onemon.SyscallI  {'arg0': 30000, 'kind': 'Sleep', 'pid': 2848, ...\n",
       "4551   onemon.Process  {'command': '\"C:\\Windows\\system32\\backgroundTa...\n",
       "4552  onemon.SyscallI  {'arg0': 30000, 'kind': 'Sleep', 'pid': 2848, ...\n",
       "\n",
       "[4553 rows x 2 columns]"
      ]
     },
     "execution_count": 11,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "''' 2.3 get behaviour report by sample (onemon json array -> ndjson) '''\n",
    "\n",
    "import json\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    "\n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"samples/230317-1nw93scb6x/behavioral1/logs/onemon.json\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "df = pd.read_json(r.text,lines=True)\n",
    "df\n"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "3. get config by sample\n",
    "\n",
    "\n",
    "\"dropper\" and \"config\" keys are stored under extracted key which value is json array.\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 13,
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\n",
      "  \"attr\": {\n",
      "    \"auth_value\": \"ecf79d7f5227d998a3501c972d915d23\"\n",
      "  },\n",
      "  \"botnet\": \"mango\",\n",
      "  \"c2\": [\n",
      "    \"193.233.20.28:4125\"\n",
      "  ],\n",
      "  \"family\": \"redline\",\n",
      "  \"rule\": \"RedLine\"\n",
      "}\n",
      "{\n",
      "  \"attr\": {\n",
      "    \"auth_value\": \"2cf01cffff9092a85ca7e106c547190b\"\n",
      "  },\n",
      "  \"botnet\": \"laba\",\n",
      "  \"c2\": [\n",
      "    \"193.233.20.28:4125\"\n",
      "  ],\n",
      "  \"family\": \"redline\",\n",
      "  \"rule\": \"RedLine\"\n",
      "}\n",
      "{\n",
      "  \"c2\": [\n",
      "    \"31.41.244.200/games/category/index.php\"\n",
      "  ],\n",
      "  \"family\": \"amadey\",\n",
      "  \"rule\": \"AmadeyV2\",\n",
      "  \"version\": \"3.68\"\n",
      "}\n"
     ]
    }
   ],
   "source": [
    "''' 3. get config by sample '''\n",
    "\n",
    "import json\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    " \n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"samples/230317-1nw93scb6x/overview.json\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "jsonResponse = r.json()\n",
    "for extracted in jsonResponse[\"extracted\"]:\n",
    "    if \"config\" in extracted: \n",
    "        config = extracted[\"config\"]\n",
    "        print(json.dumps(config, indent=2))"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 14,
   "metadata": {},
   "outputs": [
    {
     "data": {
      "text/html": [
       "<div>\n",
       "<style scoped>\n",
       "    .dataframe tbody tr th:only-of-type {\n",
       "        vertical-align: middle;\n",
       "    }\n",
       "\n",
       "    .dataframe tbody tr th {\n",
       "        vertical-align: top;\n",
       "    }\n",
       "\n",
       "    .dataframe thead th {\n",
       "        text-align: right;\n",
       "    }\n",
       "</style>\n",
       "<table border=\"1\" class=\"dataframe\">\n",
       "  <thead>\n",
       "    <tr style=\"text-align: right;\">\n",
       "      <th></th>\n",
       "      <th>id</th>\n",
       "      <th>status</th>\n",
       "      <th>kind</th>\n",
       "      <th>filename</th>\n",
       "      <th>private</th>\n",
       "      <th>submitted</th>\n",
       "      <th>completed</th>\n",
       "    </tr>\n",
       "  </thead>\n",
       "  <tbody>\n",
       "    <tr>\n",
       "      <th>0</th>\n",
       "      <td>230317-zyx4paca7s</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>854.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T21:08:10Z</td>\n",
       "      <td>2023-03-17T21:11:24Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>1</th>\n",
       "      <td>230317-s7hl2aba2x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T15:45:52Z</td>\n",
       "      <td>2023-03-17T15:48:26Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>2</th>\n",
       "      <td>230317-s3b9fsah9s</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>fZN9gvHb7VJVfCCBKHxE4f2Hhq.dll</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T15:38:35Z</td>\n",
       "      <td>2023-03-17T15:50:35Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>3</th>\n",
       "      <td>230317-s2b73agh64</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Lexplore Analytics.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T15:36:50Z</td>\n",
       "      <td>2023-03-17T15:39:30Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>4</th>\n",
       "      <td>230317-smaexsag9x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>malicious.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T15:14:01Z</td>\n",
       "      <td>2023-03-17T15:17:12Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>5</th>\n",
       "      <td>230317-sclefagg57</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>emotet</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T14:58:50Z</td>\n",
       "      <td>2023-03-17T15:07:15Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>6</th>\n",
       "      <td>230317-rp3c2sgf68</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>info_9316876362.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T14:22:57Z</td>\n",
       "      <td>2023-03-17T14:25:42Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>7</th>\n",
       "      <td>230317-rgb6wsgf28</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>1.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T14:09:27Z</td>\n",
       "      <td>2023-03-17T14:13:33Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>8</th>\n",
       "      <td>230317-qww9yaad7z</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Axz27OQTzBDhTh4u8Z4.dll</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T13:37:14Z</td>\n",
       "      <td>2023-03-17T13:39:55Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>9</th>\n",
       "      <td>230317-qd9gjsgc82</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>PgVHGAqpaF.dll</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T13:09:53Z</td>\n",
       "      <td>2023-03-17T13:12:31Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>10</th>\n",
       "      <td>230317-qd3n1aac7x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>invio.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T13:09:34Z</td>\n",
       "      <td>2023-03-17T13:13:03Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>11</th>\n",
       "      <td>230317-p8dspagc62</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T12:59:38Z</td>\n",
       "      <td>2023-03-17T13:02:19Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>12</th>\n",
       "      <td>230317-pqcgxagb92</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>PACK_17032023.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T12:31:36Z</td>\n",
       "      <td>2023-03-17T12:34:50Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>13</th>\n",
       "      <td>230317-pne51sgb86</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>NA-1703.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T12:28:15Z</td>\n",
       "      <td>2023-03-17T12:31:28Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>14</th>\n",
       "      <td>230317-pkjc9sgb69</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>NA-1703.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T12:23:11Z</td>\n",
       "      <td>2023-03-17T12:26:20Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>15</th>\n",
       "      <td>230317-mqkgeahg8x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>malware.malware</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T10:40:08Z</td>\n",
       "      <td>2023-03-17T10:44:15Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>16</th>\n",
       "      <td>230317-l5jyrahf6x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>YQq.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T10:06:54Z</td>\n",
       "      <td>2023-03-17T10:13:01Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>17</th>\n",
       "      <td>230317-lba4rafd38</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>d1f5ebebd31e925a518722d9e76f74884b6aa101d52b79...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T09:21:02Z</td>\n",
       "      <td>2023-03-17T09:25:37Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>18</th>\n",
       "      <td>230317-kya7lafc68</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>c901c8089c5e017f8e9b4b15c8ef154f.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T09:00:04Z</td>\n",
       "      <td>2023-03-17T09:02:42Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>19</th>\n",
       "      <td>230317-kt7d8sfc56</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>MAIL_1703.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T08:54:37Z</td>\n",
       "      <td>2023-03-17T08:57:57Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>20</th>\n",
       "      <td>230317-kn6krafb98</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>message-38389.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T08:45:50Z</td>\n",
       "      <td>2023-03-17T08:49:07Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>21</th>\n",
       "      <td>230317-kgrs1shb9t</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T08:34:39Z</td>\n",
       "      <td>2023-03-17T08:37:14Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>22</th>\n",
       "      <td>230317-jrj1gsfa29</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>OMICS Online.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:54:05Z</td>\n",
       "      <td>2023-03-17T07:57:23Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>23</th>\n",
       "      <td>230317-jrj1gsfa28</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>bg-6552479.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:54:05Z</td>\n",
       "      <td>2023-03-17T07:57:22Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>24</th>\n",
       "      <td>230317-jrjpqafa27</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>842-2039340.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:54:04Z</td>\n",
       "      <td>2023-03-17T07:57:27Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>25</th>\n",
       "      <td>230317-jcmstseh26</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>6f262e779fc26d8dd89c942c744eecba.bin</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:31:31Z</td>\n",
       "      <td>2023-03-17T07:34:16Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>26</th>\n",
       "      <td>230317-h2ggnsgg7w</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>file_420879755724033592074.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:13:45Z</td>\n",
       "      <td>2023-03-17T07:16:36Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>27</th>\n",
       "      <td>230317-h1zlvseg42</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>18362df602705729dd7827b834576c57.bin</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T07:12:53Z</td>\n",
       "      <td>2023-03-17T07:15:28Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>28</th>\n",
       "      <td>230317-grmehage6v</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Mail 3.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T06:02:22Z</td>\n",
       "      <td>2023-03-17T06:05:56Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>29</th>\n",
       "      <td>230317-d362haea92</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>G-1048.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T03:33:02Z</td>\n",
       "      <td>2023-03-17T03:36:26Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>30</th>\n",
       "      <td>230317-ca1tcafh3y</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Onyx.ocn.ne_U41800235350284UV.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T01:53:08Z</td>\n",
       "      <td>2023-03-17T02:03:32Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>31</th>\n",
       "      <td>230317-brndxafg6x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>click.wsf</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T01:22:48Z</td>\n",
       "      <td>2023-03-17T01:23:29Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>32</th>\n",
       "      <td>230317-bf2r6afg3x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>click.wsf</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T01:06:00Z</td>\n",
       "      <td>2023-03-17T01:06:35Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>33</th>\n",
       "      <td>230317-bbhtgsfg2w</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>click.wsf</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-17T00:58:05Z</td>\n",
       "      <td>2023-03-17T00:58:41Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>34</th>\n",
       "      <td>230316-31zl3sdd75</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>click.wsf</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T23:59:31Z</td>\n",
       "      <td>2023-03-17T00:00:06Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>35</th>\n",
       "      <td>230316-3nzfjsdd36</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Scan 17032023.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T23:40:17Z</td>\n",
       "      <td>2023-03-16T23:43:42Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>36</th>\n",
       "      <td>230316-2tqj6afd6w</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>899257.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T22:52:40Z</td>\n",
       "      <td>2023-03-16T22:55:27Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>37</th>\n",
       "      <td>230316-2lv5nsfd4z</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>iMedPub LTD.one.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T22:40:41Z</td>\n",
       "      <td>2023-03-16T22:43:37Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>38</th>\n",
       "      <td>230316-16cndsda94</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>Message_1703.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T22:15:19Z</td>\n",
       "      <td>2023-03-16T22:18:42Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>39</th>\n",
       "      <td>230316-1srv6afb8v</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>6f262e779fc26d8dd89c942c744eecba.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T21:55:04Z</td>\n",
       "      <td>2023-03-16T21:57:41Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>40</th>\n",
       "      <td>230316-1j9plsch97</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>0b8682fe1ee1d9a8ad485452179e9c8651c68266059107...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T21:41:57Z</td>\n",
       "      <td>2023-03-16T21:44:32Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>41</th>\n",
       "      <td>230316-zw6caafa6x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>18362df602705729dd7827b834576c57.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T21:05:04Z</td>\n",
       "      <td>2023-03-16T21:07:39Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>42</th>\n",
       "      <td>230316-zk1yesfa4s</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>64e9430f749b369ebf70dcb956184ceef2a4485a8a52db...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T20:47:21Z</td>\n",
       "      <td>2023-03-16T20:51:04Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>43</th>\n",
       "      <td>230316-zef13aeh9z</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>b6dac05e61ee711e5e56ab6dea94ae3d400897ecc76544...</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T20:37:38Z</td>\n",
       "      <td>2023-03-16T20:40:12Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>44</th>\n",
       "      <td>230316-xeag6scd28</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>IwQmRH.dll</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T18:45:29Z</td>\n",
       "      <td>2023-03-16T18:48:10Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>45</th>\n",
       "      <td>230316-wdtc8aed6z</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>DOCUMENT 8.zip</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T17:48:43Z</td>\n",
       "      <td>2023-03-16T17:51:09Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>46</th>\n",
       "      <td>230316-vf5zcsec2x</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>click.wsf</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T16:56:53Z</td>\n",
       "      <td>2023-03-16T16:59:32Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>47</th>\n",
       "      <td>230316-t3p1zsbh28</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>task1.exe</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T16:35:09Z</td>\n",
       "      <td>2023-03-16T16:37:55Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>48</th>\n",
       "      <td>230316-thkkrsdh9w</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>City Manager.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T16:03:27Z</td>\n",
       "      <td>2023-03-16T16:06:08Z</td>\n",
       "    </tr>\n",
       "    <tr>\n",
       "      <th>49</th>\n",
       "      <td>230316-tbp7nsbf25</td>\n",
       "      <td>reported</td>\n",
       "      <td>file</td>\n",
       "      <td>County Contract - 2023-03-16_1136 Bnsf.one</td>\n",
       "      <td>False</td>\n",
       "      <td>2023-03-16T15:53:13Z</td>\n",
       "      <td>2023-03-16T15:55:53Z</td>\n",
       "    </tr>\n",
       "  </tbody>\n",
       "</table>\n",
       "</div>"
      ],
      "text/plain": [
       "                   id    status  kind  \\\n",
       "0   230317-zyx4paca7s  reported  file   \n",
       "1   230317-s7hl2aba2x  reported  file   \n",
       "2   230317-s3b9fsah9s  reported  file   \n",
       "3   230317-s2b73agh64  reported  file   \n",
       "4   230317-smaexsag9x  reported  file   \n",
       "5   230317-sclefagg57  reported  file   \n",
       "6   230317-rp3c2sgf68  reported  file   \n",
       "7   230317-rgb6wsgf28  reported  file   \n",
       "8   230317-qww9yaad7z  reported  file   \n",
       "9   230317-qd9gjsgc82  reported  file   \n",
       "10  230317-qd3n1aac7x  reported  file   \n",
       "11  230317-p8dspagc62  reported  file   \n",
       "12  230317-pqcgxagb92  reported  file   \n",
       "13  230317-pne51sgb86  reported  file   \n",
       "14  230317-pkjc9sgb69  reported  file   \n",
       "15  230317-mqkgeahg8x  reported  file   \n",
       "16  230317-l5jyrahf6x  reported  file   \n",
       "17  230317-lba4rafd38  reported  file   \n",
       "18  230317-kya7lafc68  reported  file   \n",
       "19  230317-kt7d8sfc56  reported  file   \n",
       "20  230317-kn6krafb98  reported  file   \n",
       "21  230317-kgrs1shb9t  reported  file   \n",
       "22  230317-jrj1gsfa29  reported  file   \n",
       "23  230317-jrj1gsfa28  reported  file   \n",
       "24  230317-jrjpqafa27  reported  file   \n",
       "25  230317-jcmstseh26  reported  file   \n",
       "26  230317-h2ggnsgg7w  reported  file   \n",
       "27  230317-h1zlvseg42  reported  file   \n",
       "28  230317-grmehage6v  reported  file   \n",
       "29  230317-d362haea92  reported  file   \n",
       "30  230317-ca1tcafh3y  reported  file   \n",
       "31  230317-brndxafg6x  reported  file   \n",
       "32  230317-bf2r6afg3x  reported  file   \n",
       "33  230317-bbhtgsfg2w  reported  file   \n",
       "34  230316-31zl3sdd75  reported  file   \n",
       "35  230316-3nzfjsdd36  reported  file   \n",
       "36  230316-2tqj6afd6w  reported  file   \n",
       "37  230316-2lv5nsfd4z  reported  file   \n",
       "38  230316-16cndsda94  reported  file   \n",
       "39  230316-1srv6afb8v  reported  file   \n",
       "40  230316-1j9plsch97  reported  file   \n",
       "41  230316-zw6caafa6x  reported  file   \n",
       "42  230316-zk1yesfa4s  reported  file   \n",
       "43  230316-zef13aeh9z  reported  file   \n",
       "44  230316-xeag6scd28  reported  file   \n",
       "45  230316-wdtc8aed6z  reported  file   \n",
       "46  230316-vf5zcsec2x  reported  file   \n",
       "47  230316-t3p1zsbh28  reported  file   \n",
       "48  230316-thkkrsdh9w  reported  file   \n",
       "49  230316-tbp7nsbf25  reported  file   \n",
       "\n",
       "                                             filename  private  \\\n",
       "0                                             854.zip    False   \n",
       "1   fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...    False   \n",
       "2                      fZN9gvHb7VJVfCCBKHxE4f2Hhq.dll    False   \n",
       "3                              Lexplore Analytics.one    False   \n",
       "4                                       malicious.one    False   \n",
       "5                                              emotet    False   \n",
       "6                                 info_9316876362.one    False   \n",
       "7                                               1.zip    False   \n",
       "8                             Axz27OQTzBDhTh4u8Z4.dll    False   \n",
       "9                                      PgVHGAqpaF.dll    False   \n",
       "10                                          invio.zip    False   \n",
       "11  fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...    False   \n",
       "12                                  PACK_17032023.zip    False   \n",
       "13                                        NA-1703.zip    False   \n",
       "14                                        NA-1703.zip    False   \n",
       "15                                    malware.malware    False   \n",
       "16                                            YQq.zip    False   \n",
       "17  d1f5ebebd31e925a518722d9e76f74884b6aa101d52b79...    False   \n",
       "18               c901c8089c5e017f8e9b4b15c8ef154f.exe    False   \n",
       "19                                      MAIL_1703.zip    False   \n",
       "20                                  message-38389.zip    False   \n",
       "21  fd79e8fa5e3801101a1305b6aba7a5e7fdc852ed9036d6...    False   \n",
       "22                                   OMICS Online.zip    False   \n",
       "23                                     bg-6552479.zip    False   \n",
       "24                                    842-2039340.zip    False   \n",
       "25               6f262e779fc26d8dd89c942c744eecba.bin    False   \n",
       "26                     file_420879755724033592074.one    False   \n",
       "27               18362df602705729dd7827b834576c57.bin    False   \n",
       "28                                         Mail 3.zip    False   \n",
       "29                                         G-1048.zip    False   \n",
       "30                  Onyx.ocn.ne_U41800235350284UV.one    False   \n",
       "31                                          click.wsf    False   \n",
       "32                                          click.wsf    False   \n",
       "33                                          click.wsf    False   \n",
       "34                                          click.wsf    False   \n",
       "35                                  Scan 17032023.zip    False   \n",
       "36                                         899257.one    False   \n",
       "37                                iMedPub LTD.one.zip    False   \n",
       "38                                   Message_1703.zip    False   \n",
       "39               6f262e779fc26d8dd89c942c744eecba.exe    False   \n",
       "40  0b8682fe1ee1d9a8ad485452179e9c8651c68266059107...    False   \n",
       "41               18362df602705729dd7827b834576c57.exe    False   \n",
       "42  64e9430f749b369ebf70dcb956184ceef2a4485a8a52db...    False   \n",
       "43  b6dac05e61ee711e5e56ab6dea94ae3d400897ecc76544...    False   \n",
       "44                                         IwQmRH.dll    False   \n",
       "45                                     DOCUMENT 8.zip    False   \n",
       "46                                          click.wsf    False   \n",
       "47                                          task1.exe    False   \n",
       "48                                   City Manager.one    False   \n",
       "49         County Contract - 2023-03-16_1136 Bnsf.one    False   \n",
       "\n",
       "               submitted             completed  \n",
       "0   2023-03-17T21:08:10Z  2023-03-17T21:11:24Z  \n",
       "1   2023-03-17T15:45:52Z  2023-03-17T15:48:26Z  \n",
       "2   2023-03-17T15:38:35Z  2023-03-17T15:50:35Z  \n",
       "3   2023-03-17T15:36:50Z  2023-03-17T15:39:30Z  \n",
       "4   2023-03-17T15:14:01Z  2023-03-17T15:17:12Z  \n",
       "5   2023-03-17T14:58:50Z  2023-03-17T15:07:15Z  \n",
       "6   2023-03-17T14:22:57Z  2023-03-17T14:25:42Z  \n",
       "7   2023-03-17T14:09:27Z  2023-03-17T14:13:33Z  \n",
       "8   2023-03-17T13:37:14Z  2023-03-17T13:39:55Z  \n",
       "9   2023-03-17T13:09:53Z  2023-03-17T13:12:31Z  \n",
       "10  2023-03-17T13:09:34Z  2023-03-17T13:13:03Z  \n",
       "11  2023-03-17T12:59:38Z  2023-03-17T13:02:19Z  \n",
       "12  2023-03-17T12:31:36Z  2023-03-17T12:34:50Z  \n",
       "13  2023-03-17T12:28:15Z  2023-03-17T12:31:28Z  \n",
       "14  2023-03-17T12:23:11Z  2023-03-17T12:26:20Z  \n",
       "15  2023-03-17T10:40:08Z  2023-03-17T10:44:15Z  \n",
       "16  2023-03-17T10:06:54Z  2023-03-17T10:13:01Z  \n",
       "17  2023-03-17T09:21:02Z  2023-03-17T09:25:37Z  \n",
       "18  2023-03-17T09:00:04Z  2023-03-17T09:02:42Z  \n",
       "19  2023-03-17T08:54:37Z  2023-03-17T08:57:57Z  \n",
       "20  2023-03-17T08:45:50Z  2023-03-17T08:49:07Z  \n",
       "21  2023-03-17T08:34:39Z  2023-03-17T08:37:14Z  \n",
       "22  2023-03-17T07:54:05Z  2023-03-17T07:57:23Z  \n",
       "23  2023-03-17T07:54:05Z  2023-03-17T07:57:22Z  \n",
       "24  2023-03-17T07:54:04Z  2023-03-17T07:57:27Z  \n",
       "25  2023-03-17T07:31:31Z  2023-03-17T07:34:16Z  \n",
       "26  2023-03-17T07:13:45Z  2023-03-17T07:16:36Z  \n",
       "27  2023-03-17T07:12:53Z  2023-03-17T07:15:28Z  \n",
       "28  2023-03-17T06:02:22Z  2023-03-17T06:05:56Z  \n",
       "29  2023-03-17T03:33:02Z  2023-03-17T03:36:26Z  \n",
       "30  2023-03-17T01:53:08Z  2023-03-17T02:03:32Z  \n",
       "31  2023-03-17T01:22:48Z  2023-03-17T01:23:29Z  \n",
       "32  2023-03-17T01:06:00Z  2023-03-17T01:06:35Z  \n",
       "33  2023-03-17T00:58:05Z  2023-03-17T00:58:41Z  \n",
       "34  2023-03-16T23:59:31Z  2023-03-17T00:00:06Z  \n",
       "35  2023-03-16T23:40:17Z  2023-03-16T23:43:42Z  \n",
       "36  2023-03-16T22:52:40Z  2023-03-16T22:55:27Z  \n",
       "37  2023-03-16T22:40:41Z  2023-03-16T22:43:37Z  \n",
       "38  2023-03-16T22:15:19Z  2023-03-16T22:18:42Z  \n",
       "39  2023-03-16T21:55:04Z  2023-03-16T21:57:41Z  \n",
       "40  2023-03-16T21:41:57Z  2023-03-16T21:44:32Z  \n",
       "41  2023-03-16T21:05:04Z  2023-03-16T21:07:39Z  \n",
       "42  2023-03-16T20:47:21Z  2023-03-16T20:51:04Z  \n",
       "43  2023-03-16T20:37:38Z  2023-03-16T20:40:12Z  \n",
       "44  2023-03-16T18:45:29Z  2023-03-16T18:48:10Z  \n",
       "45  2023-03-16T17:48:43Z  2023-03-16T17:51:09Z  \n",
       "46  2023-03-16T16:56:53Z  2023-03-16T16:59:32Z  \n",
       "47  2023-03-16T16:35:09Z  2023-03-16T16:37:55Z  \n",
       "48  2023-03-16T16:03:27Z  2023-03-16T16:06:08Z  \n",
       "49  2023-03-16T15:53:13Z  2023-03-16T15:55:53Z  "
      ]
     },
     "execution_count": 14,
     "metadata": {},
     "output_type": "execute_result"
    }
   ],
   "source": [
    "''' 4. search report (family:emotet)'''\n",
    "\n",
    "import pandas as pd\n",
    "import requests\n",
    "from requests.packages.urllib3.exceptions import InsecureRequestWarning\n",
    "requests.packages.urllib3.disable_warnings(InsecureRequestWarning)\n",
    " \n",
    "\n",
    "baseUrl = \"https://tria.ge/api/v0/\"\n",
    "url = baseUrl + \"search?query=family:emotet\"\n",
    "\n",
    "headers = { \n",
    "    'Authorization' : \"Bearer \" + ak\n",
    "}\n",
    "\n",
    "r = requests.get(url, headers=headers,verify=False)\n",
    "jsonResponse = r.json()\n",
    "df = pd.json_normalize(jsonResponse['data'])\n",
    "df"
   ]
  },
  {
   "attachments": {},
   "cell_type": "markdown",
   "metadata": {},
   "source": [
    "Enjoy!"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "base",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.8"
  },
  "vscode": {
   "interpreter": {
    "hash": "1c485971a046bf47b7eaa5d3fbb444ee5ee855d2112b6af5c47deb8ebe530bc4"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 4
}