Lookup reversinglabs

Skill Liberty91LTD/cti-skills/skills/lookup-reversinglabs

Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples by family). Commonly invoked by /hash-investigation and /malware-analysis. Other agents/skills can chain this for deeper malware enrichment beyond VirusTotal.From its SKILL.md

Install

npx -y skills add Liberty91LTD/cti-skills --skill lookup-reversinglabs

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

8 stars8 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

8.3 KB, ~1.9k tokens by cl100k_base, as published. Nobody here has run it

lookup-reversinglabs

Queries ReversingLabs Spectra Analyze (the A1000 appliance API) for authoritative classification, full enrichment reports, sandbox behaviour, MITRE ATT&CK mappings, and network indicator reputation. Retrieval only — do not interpret, assess, or conclude. The invoking skill or agent reasons about the result.

When to invoke

User asks to check a hash against ReversingLabs / A1000 / Spectra Analyze
VirusTotal returned thin signal on a hash and you need a vendor-validated verdict
Investigation needs MITRE ATT&CK technique coverage from a sample's behaviour
Need parent/child relationships (which container did this drop from? what was unpacked?) for pivoting
Want to find sibling samples by threat name or AV-detection signature (/lookup-reversinglabs search)
Need network reputation on a URL, domain, or IP from RL's malware-analysis corpus
Submitting a sample for fresh static + dynamic analysis (slower; produces a full TitaniumCore + sandbox report)

How to invoke

One CLI: a Python wrapper around the official reversinglabs-sdk-py3. Self-bootstraps a private venv at tools/clis/.venv-reversinglabs/ on first run; no global install. The SDK exchanges your username + password for a session token via /api-token-auth/ automatically.

# Hash classification — fast verdict + AV detection
python3 tools/clis/reversinglabs.py hash <hash> [--av-scanners] [--ticloud]

# Full enrichment report (default detailed; pass --summary for the lighter shape)
python3 tools/clis/reversinglabs.py report <hash> [--summary|--detailed] [--fields F1,F2,...]

# File / URL submission (use --wait to block until analysis completes)
python3 tools/clis/reversinglabs.py submit-file <path> [--wait] [--rl-cloud-sandbox windows10]
python3 tools/clis/reversinglabs.py submit-url <url> [--wait] [--crawler local|tcb|cape|fireeye|vmray]

# Network threat intelligence (no submission — reads existing corpus)
python3 tools/clis/reversinglabs.py url <url>
python3 tools/clis/reversinglabs.py domain <domain>
python3 tools/clis/reversinglabs.py ip <ip> [--pivot files,domains,urls] [--max-results 50]

# Advanced search — pivot by threat name, classification, AV signature
python3 tools/clis/reversinglabs.py search "<query>" [--ticloud] [--max-results 100]

# Parent / child sample relationships
python3 tools/clis/reversinglabs.py containers <hash>
python3 tools/clis/reversinglabs.py extracted <hash> [--max-results 200]

# Read-only: which samples matched a YARA ruleset
python3 tools/clis/reversinglabs.py yara-matches <ruleset_name> [--max-results 200]

All subcommands accept --dry-run to preview the request plan without spending an API call. All exit code 2 if $REVERSINGLABS_USER or $REVERSINGLABS_PASSWORD is unset (when not in dry-run). Report missing credentials; do not fabricate.

Examples

# 1) Fast verdict on a hash, including TitaniumCloud reputation
python3 tools/clis/reversinglabs.py hash 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 \
  --av-scanners --ticloud

# 2) Full enrichment incl. MITRE ATT&CK and network indicators extracted from the sample
python3 tools/clis/reversinglabs.py report 5e884898... --detailed \
  --fields classification,riskscore,classification_result,attack,networkthreatintelligence,tags

# 3) Pivot from a known sample to siblings in the same family
python3 tools/clis/reversinglabs.py search 'threatname:Win32.Ransomware.Lockbit classification:malicious' \
  --max-results 50

# 4) Pivot from an extracted hash to its parent container, then siblings dropped by the same parent
python3 tools/clis/reversinglabs.py containers <child-hash>
python3 tools/clis/reversinglabs.py extracted <parent-hash>

# 5) IP reputation + fan-out to files + domains seen on that IP
python3 tools/clis/reversinglabs.py ip 185.220.101.45 --pivot files,domains,urls --max-results 25

Quota awareness

ReversingLabs does not publicly document per-minute / per-day rate limits for A1000. The API returns HTTP 429 with a Retry-After header when limits are hit. Submission endpoints poll at 2-second intervals up to 10 retries (SDK defaults) before giving up. Each --pivot entry is a separate API call on top of the base IP report. Use --dry-run first when fanning out broadly.

Response format

The CLI emits JSON to stdout. Skills consuming it should treat it as:

source: reversinglabs
operation: hash_classification | report_summary | report_detailed | submit_file | submit_url |
           network_url_report | network_domain_report | network_ip_report |
           advanced_search | containers | extracted_files | yara_matches
indicator: <queried value>
type: hash | url | domain | ip | file | query | ruleset
host: https://a1000.reversinglabs.com
query_time: <ISO8601>
# operation-specific payload — typically the SDK's deserialised JSON body
classification: { ... }   # for `hash`
report: { ... }            # for `report`, `url`, `domain`, `ip`
results: [ ... ]           # for `search`
files | containers: [...]  # for `extracted`, `containers`

Common fields inside a detailed report:

Field	Meaning
`classification`	Verdict: `malicious` / `suspicious` / `goodware` / `unknown`
`riskscore`	Numeric 0–10 risk score
`classification_result`	Threat name string (e.g. `Win32.Ransomware.Lockbit`)
`av_scanners_summary`	`{scanner_count, scanner_match, scanner_percent}`
`av_scanners`	Per-engine scan results
`tags`	Analyst + system-applied tags
`ticore`	Full TitaniumCore static analysis (format, headers, imports, strings)
`attack`	MITRE ATT&CK tactics + techniques mapped from observed behaviour
`rl_cloud_sandbox`	Dynamic analysis output
`networkthreatintelligence`	Network indicators extracted from the sample
`ticloud`	Spectra Intelligence reputation (when `--ticloud`)

Rate limits

No public per-minute/day quota. API returns 429 with Retry-After. SDK polls submissions with wait_time_seconds=2, retries=10. Back off and retry on 429.

Source reliability (Admiralty default)

Default rating for downstream /score-source: A2 (completely reliable, probably true). Vendor-authoritative static + dynamic analysis pipeline; verdicts are well validated against ground truth. A1000 is single-tenant — classification overrides applied by other tenants do not affect this lookup.

Downgrade to B3 if:

classification is unknown or suspicious (analyst should still verify)
Sample is very fresh (<24h since first-seen) — sandbox detonation may have been incomplete
Dynamic analysis was skipped or errored (no rl_cloud_sandbox payload)

Stay at A2 / consider A1 if:

classification is malicious AND av_scanners_summary.scanner_match >= 5 AND sandbox produced behavioural evidence
Threat name maps to a known family with public reporting

Related skills

/lookup-virustotal — community-aggregated detection; complements RL's authoritative verdict
/lookup-otx — community pulse context for the same indicator
/malware-analysis — methodology for interpreting static + dynamic analysis output
/hash-investigation — chains this lookup with VirusTotal and OTX
/score-source — apply Admiralty rating to the result

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.