ANY.RUN TI Lookup

# API query — hash lookup
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"query": "sha256:\"<HASH>\""}' | python3 -m json.tool

# API query — domain lookup
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"query": "domainName:\"<DOMAIN>\""}' | python3 -m json.tool

# API query — IP lookup
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -H "Content-Type: application/json" \
  -d '{"query": "destinationIP:\"<IP>\""}' | python3 -m json.tool

# Web interface
# https://intelligence.any.run/ — paste IOC into search bar

# Hash lookups (exact match)
sha256:"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
sha1:"da39a3ee5e6b4b0d3255bfef95601890afd80709"
md5:"d41d8cd98f00b204e9800998ecf8427e"

# Network indicators
domainName:"evil-c2.example.com"
destinationIP:"198.51.100.42"
url:"http://evil-c2.example.com/gate.php"

# File paths (use double backslash to escape)
filePath:"C:\\Users\\Public\\payload.exe"
filePath:"*\\AppData\\Roaming\\*.exe"

# Process command lines
commandLine:"powershell.exe -enc*"
commandLine:"cmd.exe /c whoami"
commandLine:"*certutil*-urlcache*"

# Registry modifications
registryKey:"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
registryName:"Debugger"
registryValue:"*cmd.exe*"

# Detection names and Suricata signatures
detectionName:"Trojan.GenericKD*"
suricataMessage:"ET MALWARE*"
suricataSID:"2024001"

# MITRE ATT&CK technique search
mitreTechnique:"T1059.001"

# Threat tags
threatName:"AgentTesla"
threatName:"Emotet"

# AND — both conditions must match
domainName:"evil.com" AND destinationIP:"198.51.100.42"

# OR — either condition matches
sha256:"<HASH1>" OR sha256:"<HASH2>"

# NOT — exclude results
commandLine:"powershell*" NOT filePath:"*\\System32\\*"

# Grouping with parentheses
(domainName:"evil.com" OR domainName:"evil2.com") AND threatName:"Emotet"

# Complex query example — find samples that contact a C2 AND run PowerShell
domainName:"suspect-c2.example.com" AND commandLine:"powershell*"

# Files dropped in any user's Temp folder
filePath:"C:\\Users\\*\\AppData\\Local\\Temp\\*"

# Domains matching a pattern
domainName:"*.evil-infrastructure.com"

# Commands starting with specific binary
commandLine:"^reg.exe*"

# Files ending with specific extension
fileName:"*.hta$"

# Maximize 20 requests: batch related IOCs with OR
sha256:"<HASH1>" OR sha256:"<HASH2>" OR sha256:"<HASH3>"

# Use basic fields that don't consume premium quota
# Free unlimited: file hashes, URLs, domains, IPs, MITRE techniques, Suricata IDs

# Prioritize lookups — check the most suspicious IOC first
# If a hash returns sandbox sessions, explore those sessions for related IOCs
# (exploring linked sessions in the web UI is free browsing, not a query)

# Match a hash to known malware family
sha256:"<HASH>" 

# If result includes threatName, pivot on it:
threatName:"AgentTesla"

# Find all samples of a family that contacted specific infrastructure
threatName:"QakBot" AND domainName:"*.example.com"

# Living-off-the-land binary abuse
commandLine:"*mshta*http*"
commandLine:"*certutil*-urlcache*-split*"
commandLine:"*bitsadmin*/transfer*"
commandLine:"*regsvr32*/s*/n*/u*/i:http*"

# Persistence mechanisms
registryKey:"*\\CurrentVersion\\Run\\*" AND commandLine:"powershell*"

# Credential access patterns
commandLine:"*sekurlsa*" OR commandLine:"*mimikatz*"
filePath:"*\\lsass*.dmp"

# Discovery commands
commandLine:"*net user*/domain*" AND commandLine:"*nltest*"

# Find all samples contacting an IP
destinationIP:"<IP>"

# Find domains resolved to an IP
domainName:"*" AND destinationIP:"<IP>"

# Suricata-flagged traffic to engagement infrastructure
suricataMessage:"*<KEYWORD>*" AND destinationIP:"<IP>"

# Port-based filtering
destinationPort:"4444" AND destinationIP:"<IP>"

# Step 1: Look up the hash in TI Lookup
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -d '{"query": "sha256:\"<HASH>\""}' > /workspace/ti/hash_result.json

# Step 2: Extract key fields from result
python3 << 'PYEOF'
import json

with open('/workspace/ti/hash_result.json') as f:
    data = json.load(f)

for task in data.get('data', {}).get('tasks', []):
    print(f"Task ID:     {task.get('uuid')}")
    print(f"Verdict:     {task.get('verdict')}")
    print(f"Threat:      {task.get('threatName', 'Unknown')}")
    print(f"Tags:        {', '.join(task.get('tags', []))}")
    print(f"Created:     {task.get('date')}")
    print(f"Sandbox URL: https://app.any.run/tasks/{task.get('uuid')}")
    print("---")
PYEOF

# Step 3: If match found, open sandbox session in browser for:
#   - Full process tree
#   - Network connections (C2 IPs/domains)
#   - Dropped files (additional IOCs)
#   - Registry modifications
#   - MITRE ATT&CK mapping

# Step 1: Query domain
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -d '{"query": "domainName:\"<DOMAIN>\""}' > /workspace/ti/domain_result.json

# Step 2: Cross-reference with engagement timeline
python3 << 'PYEOF'
import json

with open('/workspace/ti/domain_result.json') as f:
    ti_data = json.load(f)

# Extract all hashes that contacted this domain
related_hashes = set()
for task in ti_data.get('data', {}).get('tasks', []):
    for ioc in task.get('iocs', {}).get('sha256', []):
        related_hashes.add(ioc)
    print(f"Malware family: {task.get('threatName', 'N/A')}")
    print(f"  Contacted domain at: {task.get('date')}")

if related_hashes:
    print(f"\nRelated file hashes ({len(related_hashes)}):")
    for h in sorted(related_hashes):
        print(f"  {h}")
    # Check these hashes against host forensic images
PYEOF

# Step 1: Find all sandbox sessions that connected to the IP
curl -s "https://api.any.run/v1/intelligence/lookup" \
  -H "Authorization: API-Key <ANYRUN_API_KEY>" \
  -d '{"query": "destinationIP:\"<IP>\""}' > /workspace/ti/ip_result.json

# Step 2: Build IOC cluster
python3 << 'PYEOF'
import json

with open('/workspace/ti/ip_result.json') as f:
    data = json.load(f)

domains = set()
hashes = set()
families = set()

for task in data.get('data', {}).get('tasks', []):
    families.add(task.get('threatName', 'Unknown'))
    # Collect all associated IOCs for the engagement report

print(f"Malware families using this IP: {families}")
print(f"Use sandbox session URLs to extract dropped file hashes and additional C2 domains")
PYEOF

# Web submission: https://app.any.run/
# 1. Upload file or paste URL
# 2. Select OS (Windows 7/10/11, Linux)
# 3. Set analysis time (60-660 seconds)
# 4. Choose network simulation (residential proxy, Tor, custom)
# 5. Enable/disable: fake net, MITM proxy, HTTPS traffic capture
# 6. Run → watch in real-time → collect IOCs from results

# Free tier sandbox limits:
# - Windows 7 only (paid: Win 10/11, Linux)
# - 60-second timeout
# - Public submissions only (visible to community)
# - Limited to 3 concurrent tasks

# After sandbox analysis, correlate network IOCs with engagement logs
python3 << 'PYEOF'
import json

# Load sandbox IOCs (exported from ANY.RUN session)
with open('/workspace/ti/sandbox_iocs.json') as f:
    sandbox_iocs = json.load(f)

# Load engagement network logs
with open('/workspace/engagement/network_iocs.txt') as f:
    engagement_ips = set(line.strip() for line in f)

# Find overlap
sandbox_ips = set(sandbox_iocs.get('destinationIPs', []))
overlap = sandbox_ips & engagement_ips

if overlap:
    print(f"MATCH: {len(overlap)} IPs seen in both sandbox and engagement")
    for ip in sorted(overlap):
        print(f"  {ip}")
    print("\nThese IPs confirm the malware sample matches engagement activity")
else:
    print("No IP overlap — sample may be different variant or unrelated")
PYEOF

IF you have a file hash from a compromised host
  → Query sha256:"<HASH>" first — fastest path to malware family identification
IF you have a suspicious domain from DNS logs
  → Query domainName:"<DOMAIN>" — reveals which malware families use it
IF you have a C2 IP from network monitoring
  → Query destinationIP:"<IP>" — find all sandbox sessions that contacted it
IF TI Lookup returns 0 results
  → Submit the sample to ANY.RUN sandbox, then re-query after analysis
IF you need behavioral correlation (LOLBins, persistence)
  → Use commandLine/registryKey/filePath fields with wildcards
IF free tier quota exhausted
  → Fall back to VirusTotal, MalwareBazaar, or manual sandbox analysis
IF results need to go into engagement report
  → Export sandbox session as PDF; include session URL as evidence link