<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Analyzing Ransomware Variants — API Reference

## VirusTotal API v3

```bash
# File report by hash
curl -s "https://www.virustotal.com/api/v3/files/$SHA256" \
  -H "x-apikey: $VT_API_KEY"

# Submit file for analysis
curl -s "https://www.virustotal.com/api/v3/files" \
  -H "x-apikey: $VT_API_KEY" \
  -F "file=@sample.exe"

# Get behavior report
curl -s "https://www.virustotal.com/api/v3/files/$SHA256/behaviours" \
  -H "x-apikey: $VT_API_KEY"
```

## MalwareBazaar API

```bash
# Query by hash
curl -s "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_info&hash=$SHA256"

# Query by tag (ransomware family)
curl -s "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_taginfo&tag=LockBit"

# Download sample (requires API key)
curl -s "https://mb-api.abuse.ch/api/v1/" \
  -d "query=get_file&sha256_hash=$SHA256"
```

## YARA Scanning

```bash
# Scan file against rules
yara -s rules/ransomware.yar /evidence/sample.exe

# Scan directory recursively
yara -r rules/ /evidence/ransomware/

# Compile rules for performance
yarac rules/ransomware.yar compiled.yarc
yara compiled.yarc /evidence/sample.exe
```

## Capa Analysis

```bash
# Full analysis
capa sample.exe --json

# Filter ransomware capabilities
capa sample.exe --tag ransomware

# Verbose output
capa sample.exe -vv
```

## Decryptor Resources

| Source | URL | Notes |
|--------|-----|-------|
| No More Ransom | https://nomoreransom.org | 160+ family decryptors |
| Emsisoft | https://emsisoft.com/ransomware-decryption | Free decryptors |
| Kaspersky | https://noransom.kaspersky.com | RakhniDecryptor etc. |
| ID Ransomware | https://id-ransomware.malwarehunterteam.com | Identification service |
| MalwareBazaar | https://bazaar.abuse.ch | Sample database |

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `sha256` | Sample hash for lookups | `a1b2c3...` |
| `family` | Ransomware family name | `LockBit 3.0` |
| `extension` | Encrypted file extension | `.lockbit` |
| `note_path` | Path to ransom note | `/evidence/README.txt` |
