ReversingLabs TitaniumCloud v2
This Integration is part of the ReversingLabs TitaniumCloud Pack.#
Supported versions
Supported Cortex XSOAR versions: 5.5.0 and later.
ReversingLabs TitaniumCloud provides threat analysis data from various ReversingLabs cloud services.
Configure ReversingLabs TitaniumCloud v2 on Cortex XSOAR#
Navigate to Settings > Integrations > Servers & Services.
Search for ReversingLabs TitaniumCloud v2.
Click Add instance to create and configure a new integration instance.
Parameter Required ReversingLabs TitaniumCloud URL True Credentials True Password True Reliability False Verify certificates False HTTP proxy address with the protocol and port number. False HTTP proxy username False HTTP proxy password False HTTPS proxy address with the protocol and port number. False HTTPS proxy username False HTTPS proxy password False Click Test to validate the URLs, token, and connection.
Commands#
You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.
reversinglabs-titaniumcloud-file-reputation#
Retrieve File Reputation data from TitaniumCloud
Base Command#
reversinglabs-titaniumcloud-file-reputation
Input#
Argument Name | Description | Required |
---|---|---|
hash | File hash. | Required |
Context Output#
Path | Type | Description |
---|---|---|
File.MD5 | Unknown | Bad hash found |
File.SHA1 | Unknown | Bad hash SHA1 |
File.SHA256 | Unknown | Bad hash SHA256 |
DBotScore.Score | Number | The actual score. |
DBotScore.Type | String | The indicator type. |
DBotScore.Indicator | String | The indicator that was tested. |
DBotScore.Vendor | String | The vendor used to calculate the score. |
ReversingLabs.file_reputation | Unknown |
Command example#
!reversinglabs-titaniumcloud-file-reputation hash="21841b32c6165b27dddbd4d6eb3a672defe54271"
Context Example#
Human Readable Output#
ReversingLabs File Reputation for hash 21841b32c6165b27dddbd4d6eb3a672defe54271#
Classification: MALICIOUS Classification reason: antivirus First seen: 2015-05-30T22:04:00 Last seen: 2023-06-06T16:16:58 AV scanner hits / total number of scanners: 32 / 34 AV scanner hit percentage: 94.11764526367188% MD5 hash: 3133c2231fcee5d6b0b4c988a5201da1 SHA-1 hash: 21841b32c6165b27dddbd4d6eb3a672defe54271 SHA-256 hash: 2f6edf41016e97c58f9de01aa4cc66c9c7fe7dae23fe72e50a69cbd221f55346 Threat name: Win32.Ransomware.Tox Threat level: 5
reversinglabs-titaniumcloud-av-scanners#
Retrieve AV Scanner data from TitaniumCloud.
Base Command#
reversinglabs-titaniumcloud-av-scanners
Input#
Argument Name | Description | Required |
---|---|---|
hash | File hash. | Required |
Context Output#
Path | Type | Description |
---|---|---|
File.MD5 | Unknown | Bad hash found |
File.SHA1 | Unknown | Bad hash SHA1 |
File.SHA256 | Unknown | Bad hash SHA256 |
ReversingLabs.av_scanners | Unknown |
Command example#
!reversinglabs-titaniumcloud-av-scanners hash="21841b32c6165b27dddbd4d6eb3a672defe54271"
Context Example#
Human Readable Output#
ReversingLabs AV Scan results for hash 21841b32c6165b27dddbd4d6eb3a672defe54271#
First scanned on: 2015-05-30T22:04:00 First seen on: 2015-05-30T22:04:00 Last scanned on: 2023-06-06T16:15:00 Last seen on: 2023-06-06T16:15:00 Sample size: 636416 bytes Sample type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed MD5 hash: 3133c2231fcee5d6b0b4c988a5201da1 SHA-1 hash: 21841b32c6165b27dddbd4d6eb3a672defe54271 SHA-256 hash: 2f6edf41016e97c58f9de01aa4cc66c9c7fe7dae23fe72e50a69cbd221f55346 SHA-512 hash: 205ece960784bff6fdbd0d5a1ebad4fddeab6751728d5be2e0b5d91742d520df0c5d04fd3b9e67372c35cb0859d794b7d22ea78786669a4bd5725e814548143f SHA-384 hash: e0b7bf0ad928500ee1dc06f8cbe035e663eaf546bb4b5217706706ba12c50ab6a24e1e858dae9a5ce0f7673bdb5621be RIPEMD-160 hash: d26f686b6af13b9073f77a1ba5a7b610934dc625 Scanner count: 37 Scanner match: 32
Latest scan results#
result scanner [TROJAN] Trojan/Win32.Toxic.R150440 scanner1 detected scanner2 Win32:Malware-gen scanner3 DeepScan:Generic.Ransom.WCryG.5BC9065C scanner4 trojan scanner5 PUA.Win.Packer.UpxProtector-1 scanner6 win/malicious_confidence_100 scanner7 malware.confidence_100 scanner8 Trojan.Encoder.1155 scanner9 malicious (moderate confidence) scanner10 Detected scanner11 W32/ToxKrypt.A!tr scanner12 DeepScan:Generic.Ransom.WCryG.5BC9065C scanner13 Trojan.Win32.Filecoder scanner14 Trojan (0055e3ef1) scanner15 Generic.Malware/Suspicious scanner16 Ransom-Tox!11B48E409D96 (trojan) scanner17 Ransom-Tox!11B48E409D96 (trojan) scanner18 Artemis!3133C2231FCE (trojan) scanner19 Ransom:Win32/Tocrypt.B scanner20 Ransom:Win32/Tocrypt.B scanner21 Trj/Genetic.gen scanner22 Trj/Genetic.gen scanner23 scanner24 Ransom.Tocrypt!8.53B6 scanner25 Malware.Undefined!8.C scanner26 DFI - Suspicious PE scanner27 scanner28 Mal/Generic-R scanner29 Trojan.Gen.2 scanner30 Trojan.Gen.2 scanner31 TROJ_CRYPTOX.T scanner32 TROJ_CRYPTOX.T scanner33 SScope.Malware-Cryptor.Toxic scanner34
reversinglabs-titaniumcloud-file-analysis#
Retrieve File Analysis by hash data from TitaniumCloud.
Base Command#
reversinglabs-titaniumcloud-file-analysis
Input#
Argument Name | Description | Required |
---|---|---|
hash | File hash. | Required |
Context Output#
Path | Type | Description |
---|---|---|
File.MD5 | Unknown | Bad hash found |
File.SHA1 | Unknown | Bad hash SHA1 |
File.SHA256 | Unknown | Bad hash SHA256 |
ReversingLabs.file_analysis | Unknown |
Command example#
!reversinglabs-titaniumcloud-file-analysis hash="21841b32c6165b27dddbd4d6eb3a672defe54271"