API Documentation | Malware Families Catalog

The Malware Families Catalog exposes a free, public JSON API that lets you query 2,899 malware families programmatically. No authentication required.

Endpoints

Endpoint	Description
`api/families.json`	Full index of all 2,899 families with category and enrichment level.
`api/{family_name}.json`	Detailed profile for a single family including description, MITRE ATT&CK, IOCs, detection guidance, and FAQ.

Python Example

import requests

# Get the full family index
index = requests.get("https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/families.json").json()
print(f"Total families: {index['total']}")
print(f"Curated families: {index['curated']}")

# Look up a specific family
family = requests.get("https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/emotet.json").json()
print(f"Family: {family['family']}")
print(f"Category: {family['category']}")
print(f"Description: {family['description'][:100]}...")
print(f"MITRE techniques: {family.get('mitre_attack', [])}")

JavaScript Example

// Fetch the full family index
fetch("https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/families.json")
  .then(res => res.json())
  .then(data => {
    console.log(`Total families: ${data.total}`);
    data.families.filter(f => f.category === 'ransomware')
      .forEach(f => console.log(f.family));
  });

// Fetch a specific family profile
fetch("https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/emotet.json")
  .then(res => res.json())
  .then(family => {
    console.log(`${family.family}: ${family.description.slice(0,100)}...`);
  });

Sample Response

A per-family JSON response includes the following fields (example: emotet):

{
  "family": "emotet",
  "category": "banking_trojan",
  "sample_count": 1234,
  "description": "Emotet is a modular banking trojan...",
  "aliases": ["Heodo", "Geodo"],
  "mitre_attack": ["T1566.001", "T1059.005"],
  "iocs": { ... },
  "containment_steps": [ ... ],
  "faq": [ ... ]
}

Rate Limits & Usage

This is a static JSON API hosted on GitHub Pages. There are no rate limits, no authentication, and no API keys. Data is updated with each push to the repository. You are free to cache, mirror, or embed responses under the Apache-2.0 license.