Malquarium is a web based malware repository tool built on modern web technologies with the follwoing goals in mind:
- Easy to install and maintain
- Fast searches over hashes and indicators
- VirusTotal like UI
- Isolated execution of binary analysis for security reasons
See it in action at https://malquarium.org
A Linux system. Tested on Ubuntu 18.04, but should work everywhere.
Malquarium requires Docker to run it's binary analyzer modules. If you decide to run the backend and frontend outside of Docker containers, the user which runs the backend needs to be in the docker group because the backend needs to launch containers on demand.
The Backend Database must be PostgreSQL 9+ which can run in a container or outside of Docker.
Use this setup to run everything in Docker containers, the fastest way to get it up and running. There are 2 docker-compose files, one which includes the database, the other not.
Change at least the following parameters to get your Malquarium up and running
| Parameter | Value | Description |
|---|---|---|
| volumes | /data/malquarium/samples:/data/samples |
Persistend volume of the sample binaries. Change the path if your samples are not at /data/malquarium/samles |
| volumes | /usr/bin/docker:/bin/docker |
Pass the docker binary to the backend. Change to the output of which docker if it's not /usr/bin/docker |
| DJANGO_SECRET_KEY | Your random Django secret key | You can generate one with ```head /dev/urandom |
| OUTER_SAMPLE_STORE | /data/malquarium/samples |
The path where your samples are on the host, not inside the container. Needed for the binary analysis containers. Must be the same as the left part of the corresponding volumes setting |
| Parameter | Value | Description |
|---|---|---|
| volumes | /data/malquarium/db:/var/lib/postgresql/data |
Persistend volume of the database. Change the path if your database files are not at /data/malquarium/db |
Start the containers
docker-compose up
The web frontend will be available on http://localhost:8080
You can use the Django admin GUI to change all settings: http://localhost:8080/admin/