Koodous

https://docs.koodous.com
Admin
Koodous is a collaborative platform combining online analysis tools with social interaction between...
Tokens:25,835
Snippets:161
Trust Score:9
Update:10 months ago
Show doc for...
Tokens:
Raw
### Koodous API Endpoints

Source: https://docs.koodous.com/api/index

This section details how to interact with the Koodous API. It covers initial setup, authentication, and provides an example of fetching APK data.

```APIDOC
## GET /apks

### Description
This endpoint retrieves a list of APKs from the Koodous platform. It supports pagination and includes various details about each APK.

### Method
GET

### Endpoint
/apks

### Parameters
#### Query Parameters
- **cursor** (string) - Optional - Used for pagination to fetch the next set of results.

#### Request Body
None

### Request Example
```bash
GET /apks
Authorization: Token <YOUR_TOKEN>

```

### Response
#### Success Response (200)
- **next** (string) - URL for the next page of results.
- **previous** (null/string) - URL for the previous page of results.
- **count** (integer) - The total number of APKs available.
- **results** (array) - A list of APK objects.
  - **id** (string) - Unique identifier for the APK.
  - **url** (string) - URL to the specific APK resource.
  - **sha256** (string) - SHA256 hash of the APK.
  - **md5** (string) - MD5 hash of the APK.
  - **sha1** (string) - SHA1 hash of the APK.
  - **app** (string) - The name of the application.
  - **package_name** (string) - The package name of the application.
  - **company** (string) - The company that developed the application.
  - **version** (string) - The version of the application.
  - **image** (null/string) - URL to the application's icon, if available.
  - **size** (integer) - The size of the APK file in bytes.
  - **tags** (array) - A list of tags associated with the APK.
  - **is_trusted** (boolean) - Indicates if the APK is considered trusted.
  - **is_installed** (boolean) - Indicates if the APK is installed.
  - **rating** (integer) - The rating of the application.
  - **is_detected** (boolean) - Indicates if any threats were detected.
  - **is_corrupted** (boolean) - Indicates if the APK file is corrupted.
  - **is_static_analyzed** (boolean) - Indicates if static analysis has been performed.
  - **is_dynamic_analyzed** (boolean) - Indicates if dynamic analysis has been performed.
  - **last_yara_analysis_at** (null/string) - Timestamp of the last Yara analysis.
  - **created_at** (string) - Timestamp when the APK record was created.

#### Response Example
```json
{
  "next": "https://developer.koodous.com/apks/?cursor=cD0yMDIyLTAxLTE0KzA3JTNBNTUlM0E0OS43NjYyODYlMkIwMCUzQTAw",
  "previous": null,
  "count": 86374848,
  "results": [
    {
      "id": "bMo71eaEM2m1xR3g",
      "url": "https://developer.koodous.com/apks/ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429/",
      "sha256": "ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429",
      "md5": "9ec448a9b5826bff5f67deb78a332109",
      "sha1": "47b198defd13935a8cf8a44d66ab752feda5c810",
      "app": "Sticker Center",
      "package_name": "com.samsung.android.stickercenter",
      "company": "Samsung Corporation",
      "version": "2.2.00.16",
      "image": null,
      "size": 8485692,
      "tags": [],
      "is_trusted": false,
      "is_installed": false,
      "rating": 0,
      "is_detected": false,
      "is_corrupted": false,
      "is_static_analyzed": false,
      "is_dynamic_analyzed": false,
      "last_yara_analysis_at": null,
      "created_at": "2022-01-14T09:41:01.648728+01:00"
    }
  ]
}
```
```

--------------------------------

### Koodous API Server Response Example (JSON)

Source: https://docs.koodous.com/api/index

This is an example of a typical JSON response from the Koodous API. It includes pagination details (next, previous, count) and a list of results, with each result representing an APK object containing various details.

```json
{
  "next": "https://developer.koodous.com/apks/?cursor=cD0yMDIyLTAxLTE0KzA3JTNBNTUlM0E0OS43NjYyODYlMkIwMCUzQTAw",
  "previous": null,
  "count": 86374848,
  "results": [
    {
      "id": "bMo71eaEM2m1xR3g",
      "url": "https://developer.koodous.com/apks/ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429/",
      "sha256": "ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429",
      "md5": "9ec448a9b5826bff5f67deb78a332109",
      "sha1": "47b198defd13935a8cf8a44d66ab752feda5c810",
      "app": "Sticker Center",
      "package_name": "com.samsung.android.stickercenter",
      "company": "Samsung Corporation",
      "version": "2.2.00.16",
      "image": null,
      "size": 8485692,
      "tags": [],
      "is_trusted": false,
      "is_installed": false,
      "rating": 0,
      "is_detected": false,
      "is_corrupted": false,
      "is_static_analyzed": false,
      "is_dynamic_analyzed": false,
      "last_yara_analysis_at": null,
      "created_at": "2022-01-14T09:41:01.648728+01:00"
    }
  ]
}

```

--------------------------------

### Koodous API Authentication Example

Source: https://docs.koodous.com/api/index

This code snippet demonstrates how to authenticate with the Koodous API using an Authorization header. Ensure you replace '<TOKEN>' with your actual developer token. This is a standard HTTP request header.

```http
GET /apks
Authorization: Token c080ddd1fab46bc919ca0d62299e9995b1886853

```

--------------------------------

### GET /feed/apks/

Source: https://docs.koodous.com/api/feed

Retrieves the APK feed package for the last 5 minutes.

```APIDOC
## GET /feed/apks/

### Description
Fetches the APK feed package containing data from the last 5 minutes.

### Method
GET

### Endpoint
/feed/apks/

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the feed package.
- **url** (string) - The URL to access the feed package details.
- **package** (string) - The package identifier, often including a datetime.
- **feed_type** (string) - Will be `apks`.
- **package_type** (string) - Will be `5-minutes`.
- **package_datetime** (string) - The datetime the package was generated in ISO 8601 format.
- **download_url** (string) - The URL to download the APK feed package content.

#### Response Example
```json
{
    "id": "ZXpL9BO6BeOQa8ev",
    "url": "https://developer.koodous.com/feed/ZXpL9BO6BeOQa8ev/",
    "package": "20220320T0900",
    "feed_type": "apks",
    "package_type": "5-minutes",
    "package_datetime": "2022-03-20T09:00:00+01:00",
    "download_url": "https://storage.gra.cloud.ovh.net/v1/AUTH_/feed-apk/apk_20220320T0900.zip"
}
```
```

--------------------------------

### GET /feed/detected/

Source: https://docs.koodous.com/api/feed

Retrieves the detected APKs feed package for the last 5 minutes.

```APIDOC
## GET /feed/detected/

### Description
Fetches the feed package containing analyses of detected APKs from the last 5 minutes.

### Method
GET

### Endpoint
/feed/detected/

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the feed package.
- **url** (string) - The URL to access the feed package details.
- **package** (string) - The package identifier, often including a datetime.
- **feed_type** (string) - Will be `detected`.
- **package_type** (string) - Will be `5-minutes`.
- **package_datetime** (string) - The datetime the package was generated in ISO 8601 format.
- **download_url** (string) - The URL to download the detected APKs feed package content.

#### Response Example
```json
{
    "id": "Ro9EPbGXkJ1kW4rg",
    "url": "https://developer.koodous.com/feed/Ro9EPbGXkJ1kW4rg/",
    "package": "20220320T0905",
    "feed_type": "detected",
    "package_type": "5-minutes",
    "package_datetime": "2022-03-20T09:05:00+01:00",
    "download_url": "https://storage.gra.cloud.ovh.net/v1/AUTH_/feed-detected/detected_20220320T0905.zip"
}
```
```

--------------------------------

### GET /feed/analyses/

Source: https://docs.koodous.com/api/feed

Retrieves the analyses feed package for the last 5 minutes.

```APIDOC
## GET /feed/analyses/

### Description
Fetches the analyses feed package containing data from the last 5 minutes.

### Method
GET

### Endpoint
/feed/analyses/

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the feed package.
- **url** (string) - The URL to access the feed package details.
- **package** (string) - The package identifier, often including a datetime.
- **feed_type** (string) - Will be `analyses`.
- **package_type** (string) - Will be `5-minutes`.
- **package_datetime** (string) - The datetime the package was generated in ISO 8601 format.
- **download_url** (string) - The URL to download the analyses feed package content.

#### Response Example
```json
{
    "id": "QoVqKZ1P3qdv3y0B",
    "url": "https://developer.koodous.com/feed/QoVqKZ1P3qdv3y0B/",
    "package": "20220320T0905",
    "feed_type": "analyses",
    "package_type": "5-minutes",
    "package_datetime": "2022-03-20T09:05:00+01:00",
    "download_url": "https://storage.gra.cloud.ovh.net/v1/AUTH_/feed-analysis/analysis_20220320T0905.zip"
}
```
```

--------------------------------

### GET /notifications/{hashid}/

Source: https://docs.koodous.com/api/notifications

Retrieves the details of a specific notification using its unique hash ID.

```APIDOC
## GET /notifications/{hashid}/

### Description
Details of a specific notification.

### Method
GET

### Endpoint
/notifications/{hashid}/

### Parameters
#### Path Parameters
- **hashid** (string) - Required - The unique identifier of the notification.

### Response
#### Success Response (200)
- **notification** (object) - The notification object with detailed information.
  - **hashid** (string) - The unique identifier for the notification.
  - **type** (string) - The type of the notification.
  - **is_read** (boolean) - Indicates if the notification has been read.

#### Response Example
{
  "hashid": "some_hash_id",
  "type": "ruleset_matched",
  "is_read": false
}
```

--------------------------------

### GET /apks/

Source: https://docs.koodous.com/api/apks

Retrieves a list of available applications (APKs). Sorting is done by creation date in descending order. This endpoint has a specific request limit.

```APIDOC
## GET /apks/

### Description
Retrieves a list of applications (apks). Sorting is done by creation date in descending order. This method has a specific request limit.

### Method
GET

### Endpoint
/apks/

### Parameters
#### Query Parameters
- **search** (string) - Optional - Allow advanced search.

### Response
#### Success Response (200)
- **apks** (array) - A list of APK objects.
- **apk** (object) - Details of an APK.
  - **sha256** (string) - SHA256 hash of the APK.
  - **app** (string) - Application name.
  - **package_name** (string) - Package name of the application.
  - **company** (string) - Company that developed the application.
  - **version** (string) - Version of the application.
  - **created_at** (string) - Timestamp when the APK was created.

#### Response Example
{
  "apks": [
    {
      "sha256": "ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429",
      "app": "Sticker Center",
      "package_name": "com.samsung.android.stickercenter",
      "company": "Samsung Corporation",
      "version": "2.2.00.16",
      "created_at": "2022-01-14T09:41:01.648728+01:00"
    }
  ]
}
```

--------------------------------

### GET /feed/

Source: https://docs.koodous.com/api/feed

Retrieves a list of available feed packages. Supports filtering by feed type and package type, and searching for specific packages by datetime.

```APIDOC
## GET /feed/

### Description
Lists all available feed packages. You can filter the results based on `feed_type` and `package_type`, or search for a specific package using `package_datetime`.

### Method
GET

### Endpoint
/feed/

### Parameters
#### Query Parameters
- **feed_type** (string) - Optional - Allows filtering by feed type. Accepted values: `apks`, `analyses`, `detected`.
- **package_type** (string) - Optional - Allows filtering by package type. Accepted values: `5-minutes`, `1-hour`.
- **package_datetime** (string) - Optional - Filters for a specific package in ISO 8601 format.
```

--------------------------------

### GET /account/

Source: https://docs.koodous.com/api/account

Retrieves authenticated account information, including user details, profile, and settings.

```APIDOC
## GET /account/

### Description
Retrieves authenticated account information, including user details, profile, and settings.

### Method
GET

### Endpoint
/account/

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
- **id** (string) - The user's unique identifier.
- **url** (string) - The URL to the user's profile.
- **username** (string) - The username of the account.
- **first_name** (string) - The user's first name.
- **last_name** (string) - The user's last name.
- **last_login** (string) - The timestamp of the last login.
- **profile** (object) - User profile information.
  - **avatar** (string) - URL to the user's avatar.
  - **occupation** (string) - User's occupation.
  - **biography** (string) - User's biography.
  - **twitter** (string) - User's Twitter handle.
  - **is_expert** (boolean) - Indicates if the user is an expert.
- **settings** (object) - User's notification and email settings.
  - **notify_analysis_completed** (boolean) - Notify internally when an analysis is completed.
  - **notify_ruleset_matched** (boolean) - Notify internally when a rule produces a match.
  - **notify_new_profile_comment** (boolean) - Notify internally when a new profile comment is received.
  - **notify_new_ruleset_comment** (boolean) - Notify internally when a new ruleset comment is received.
  - **notify_new_follower** (boolean) - Notify internally when a new follower is received.
  - **notify_new_mention** (boolean) - Notify internally when a mention is received.
  - **email_analysis_completed** (boolean) - Notify by email when an analysis is completed.
  - **email_ruleset_matched** (boolean) - Notify by email when a rule produces a match.
  - **email_new_follower** (boolean) - Notify by email when a new follower is received.
- **api_group** (string) - The API group the user belongs to.
- **can_get_apks_feed** (boolean) - Indicates if the user can access the APKs feed.
- **can_get_analyses_feed** (boolean) - Indicates if the user can access the analyses feed.
- **can_get_detected_feed** (boolean) - Indicates if the user can access the detected feed.
- **followers_count** (integer) - The number of followers.
- **followed_count** (integer) - The number of users being followed.
- **rulesets_count** (integer) - The number of rulesets owned by the user.
- **created_at** (string) - The timestamp when the account was created.

#### Response Example
```json
{
  "id": "user_username",
  "url": "https://developer.koodous.com/analysts/user_username/",
  "username": "user_username",
  "first_name": "User first name",
  "last_name": "User last name",
  "last_login": "2022-01-14T09:21:46.431468+01:00",
  "profile": {
    "avatar": "",
    "occupation": "",
    "biography": "",
    "twitter": "",
    "is_expert": false
  },
  "settings": {
    "notify_analysis_completed": true,
    "notify_ruleset_matched": true,
    "notify_new_profile_comment": true,
    "notify_new_ruleset_comment": true,
    "notify_new_follower": true,
    "notify_new_mention": true,
    "email_analysis_completed": false,
    "email_ruleset_matched": false,
    "email_new_follower": false
  },
  "api_group": "api_corporate",
  "can_get_apks_feed": true,
  "can_get_analyses_feed": true,
  "can_get_detected_feed": true,
  "followers_count": 1,
  "followed_count": 1,
  "rulesets_count": 11,
  "created_at": "2020-01-01T00:00:00+02:00"
}
```
```

--------------------------------

### Filter by Number of Android Permissions

Source: https://docs.koodous.com/yara/androguard

This shows how to use `androguard.permissions_number` to identify applications with a large number of permissions, which can be an indicator of malware. The `videogames` rule example flags applications having more than 5 permissions.

```yara
rule videogames
{
    condition:
        androguard.permissions_number > 5
}

```

--------------------------------

### GET /notifications/

Source: https://docs.koodous.com/api/notifications

Retrieves a list of analyst notifications. This endpoint supports filtering by notification type and read status.

```APIDOC
## GET /notifications/

### Description
List of analyst notifications. Allows filtering by notification type and read status.

### Method
GET

### Endpoint
/notifications/

### Parameters
#### Query Parameters
- **type** (string) - Optional - Filter by notification type. Possible values: `ruleset_matched`, `ruleset_commented`, `analysis_completed`, `user_new_follower`, `ruleset_social_accepted`, `ruleset_social_rejected`, `mention_comment_sample`, `mention_comment_ruleset`.
- **is_read** (boolean) - Optional - Filter whether notifications have been marked as read or unread.

### Response
#### Success Response (200)
- **notifications** (array) - A list of notification objects.
- **notification** (object) - An individual notification object.
  - **hashid** (string) - The unique identifier for the notification.
  - **type** (string) - The type of the notification.
  - **is_read** (boolean) - Indicates if the notification has been read.

#### Response Example
{
  "notifications": [
    {
      "hashid": "some_hash_id",
      "type": "ruleset_matched",
      "is_read": false
    }
  ]
}
```

--------------------------------

### Match Android Package Name

Source: https://docs.koodous.com/yara/androguard

This section explains how to use the `androguard.package_name` condition to filter Android applications based on their package name. It supports matching against regular expressions or exact strings. The example rule `videogames` demonstrates matching package names that contain the string 'videogame'.

```yara
androguard.package_name(regex)

```

```yara
androguard.package_name(string)

```

```yara
rule videogames
{
    meta:
        description = "Rule to catch APKs with package name match with videogame"
    condition:
        androguard.package_name(/videogame/)
}

```

--------------------------------

### Match Android Services

Source: https://docs.koodous.com/yara/androguard

The `androguard.service` condition is used to detect applications that utilize specific background services. It supports matching against exact strings or regular expressions. The `videogames` rule example demonstrates finding applications with services named `com.example.SendData` or matching `/receivetoken/`.

```yara
androguard.service(regex)

```

```yara
androguard.service(string)

```

```yara
rule videogames
{
    condition:
        androguard.service("com.example.SendData") or
        androguard.service(/receivetoken/)
}

```

--------------------------------

### Match Android App Name

Source: https://docs.koodous.com/yara/androguard

This demonstrates using `androguard.app_name` to filter applications by their displayed app name. Similar to package names, it accepts both regular expressions and exact strings for matching. The `videogames` rule example shows how to find APKs where the app name matches '/cars/'.

```yara
androguard.app_name(regex)

```

```yara
androguard.app_name(string)

```

```yara
rule videogames
{
    meta:
        description = "Rule to catch APKs with app name match with cars"
    condition:
        androguard.app_name(/cars/)
}

```

--------------------------------

### GET /apks/{sha256}/download/

Source: https://docs.koodous.com/api/apks

Requests a download link for a specific APK. The link is valid for 3 minutes. This endpoint has a specific request limit.

```APIDOC
## GET /apks/{sha256}/download/

### Description
Request the download link for an APK. The link will be available for 3 minutes, after which it will expire and become invalid. This method has a specific request limit.

### Method
GET

### Endpoint
/apks/{sha256}/download/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK.

### Response
#### Success Response (200)
- **download_url** (string) - The URL to download the APK.
- **expires_at** (string) - Timestamp when the download link will expire.
```

--------------------------------

### Perform Dynamic Analysis - Koodous API

Source: https://docs.koodous.com/api/apks

Starts a dynamic analysis (Droidbox) for an APK specified by its SHA256 hash. The analysis process may require several minutes, and notifications will be sent to users who have enabled them. Subject to API request limits.

```HTTP
GET /apks/<sha256_hash>/analyze_dynamic/
```

--------------------------------

### Match Android Permissions

Source: https://docs.koodous.com/yara/androguard

The `androguard.permission` condition allows filtering applications based on the permissions they require. It checks if any of the application's permissions match the provided regular expression. The `videogames` rule example demonstrates detecting applications that require the `RESTART_PACKAGES` permission.

```yara
androguard.permission(regex)

```

```yara
rule videogames
{
    condition:
        androguard.permission(/RESTART_PACKAGES/)
}

```

--------------------------------

### Match Android Filters

Source: https://docs.koodous.com/yara/androguard

This section explains the `androguard.filter` condition, which is used to identify applications based on their broadcast filters. It accepts both regular expressions and exact strings for matching. The `videogames` rule example shows how to detect applications that filter for `android.provider.Telephony.SMS_DELIVER` or match `/PACKAGE_ADDED/`.

```yara
androguard.filter(regex)

```

```yara
androguard.filter(string)

```

```yara
rule videogames
{
    condition:
        androguard.filter("android.provider.Telephony.SMS_DELIVER")or
        androguard.filter(/PACKAGE_ADDED/)
}

```

--------------------------------

### GET /apks/{sha256}/analyze_static/

Source: https://docs.koodous.com/api/apks

Initiates a static analysis request (Androguard and Cuckoo) for a specific APK. Analysis may take several minutes. Users with notifications enabled will be notified upon completion. This endpoint has a specific request limit.

```APIDOC
## GET /apks/{sha256}/analyze_static/

### Description
Perform a static analysis request (Androguard and Cuckoo) for an APK. Analysis may take several minutes to complete. Users with notifications enabled will receive a notification when it is finished. This method has a specific request limit.

### Method
GET

### Endpoint
/apks/{sha256}/analyze_static/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK.

### Response
#### Success Response (200)
- Indicates that the static analysis has been initiated successfully. Specific response body may vary.
```

--------------------------------

### GET /apks/{sha256}/analyze_dynamic/

Source: https://docs.koodous.com/api/apks

Initiates a dynamic analysis request (Droidbox) for a specific APK. Analysis may take several minutes. Users with notifications enabled will be notified upon completion. This endpoint has a specific request limit.

```APIDOC
## GET /apks/{sha256}/analyze_dynamic/

### Description
Perform a dynamic analysis request (Droidbox) for an APK. Analysis may take several minutes to complete. Users with notifications enabled will receive a notification when it is finished. This method has a specific request limit.

### Method
GET

### Endpoint
/apks/{sha256}/analyze_dynamic/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK.

### Response
#### Success Response (200)
- Indicates that the dynamic analysis has been initiated successfully. Specific response body may vary.
```

--------------------------------

### Match Android Activities

Source: https://docs.koodous.com/yara/androguard

The `androguard.activity` condition allows filtering applications based on their activity names. It supports matching against strings and regular expressions. The `sendSMS` rule example illustrates filtering applications whose activity names match `/.sms./` or the exact string `com.package.name.sendSMS`.

```yara
androguard.activity(string)

```

```yara
androguard.activity(regex)

```

```yara
rule sendSMS
{
    condition:
        androguard.activity(/\.sms\.)/ or
        androguard.activity("com.package.name.sendSMS")
}

```

--------------------------------

### File Module - Introduction

Source: https://docs.koodous.com/yara/file

Import the File module at the header of your ruleset to utilize its functions.

```APIDOC
## File Module - Introduction

### Description
Import the File module to access its hashing functions for application matching.

### Method
Import directive

### Endpoint
N/A

### Parameters
N/A

### Request Example
```
import "file"
```

### Response
N/A
```

--------------------------------

### Match Application by SHA256 Hash using Koodous File Module

Source: https://docs.koodous.com/yara/file

Employs the file.sha256() function from the Koodous 'file' module for matching applications by their SHA256 hash. This is the recommended method for creating whitelists due to SHA256's collision resistance.

```yara
rule my_apk: koodous
{
    condition:
        file.sha256("3350990c4d298cdb4dc94ba886a27147e501bbf8fd504d824be53cad5cb02142")
}
```

--------------------------------

### File Module - MD5 Hashing

Source: https://docs.koodous.com/yara/file

Use the `file.md5(string)` function to match applications by their MD5 hash.

```APIDOC
## File Module - MD5 Hashing

### Description
Matches applications based on their MD5 hash. Note that MD5 collisions may lead to matching multiple applications.

### Method
Function call

### Endpoint
N/A

### Parameters
#### Path Parameters
N/A

#### Query Parameters
N/A

#### Request Body
N/A

### Function Signature
`file.md5(string)`

### Request Example
```json
{
  "rule_name": "my_apk",
  "condition": "file.md5(\"d367fd26b52353c2cce72af2435bd0d5\")"
}
```

### Response
#### Success Response (Boolean)
- **true** (boolean) - Returns true if the file's MD5 hash matches the provided string.

#### Response Example
```json
{
  "match": true
}
```
```

--------------------------------

### Match Application by MD5 Hash using Koodous File Module

Source: https://docs.koodous.com/yara/file

Uses the file.md5() function from the Koodous 'file' module to match an application based on its MD5 hash. This is useful for identifying specific application versions.

```yara
rule my_apk: koodous
{
    condition:
        file.md5("d367fd26b52353c2cce72af2435bd0d5")
}
```

--------------------------------

### GET /feed/{hashid}/

Source: https://docs.koodous.com/api/feed

Retrieves detailed information about a specific feed package using its hash ID.

```APIDOC
## GET /feed/{hashid}/

### Description
Fetches detailed information for a specific feed package identified by its unique hash ID.

### Method
GET

### Endpoint
/feed/{hashid}/

### Parameters
#### Path Parameters
- **hashid** (string) - Required - The unique hash ID of the feed package.

### Response
#### Success Response (200)
- **id** (string) - The unique identifier of the feed package.
- **url** (string) - The URL to access the feed package details.
- **package** (string) - The package identifier, often including a datetime.
- **feed_type** (string) - The type of the feed package (e.g., `apks`, `analyses`, `detected`).
- **package_type** (string) - The type of package (e.g., `5-minutes`, `1-hour`).
- **package_datetime** (string) - The datetime the package was generated in ISO 8601 format.
- **download_url** (string) - The URL to download the feed package content.

#### Response Example
```json
{
    "id": "3q2BolejXejNmGQB",
    "url": "https://developer.koodous.com/feed/4q2VolejRejNmGQB/",
    "package": "20210521T05",
    "feed_type": "apks",
    "package_type": "1-hour",
    "package_datetime": "2022-03-19T22:00:00+01:00",
    "download_url": "https://storage.gra.cloud.ovh.net/v1/AUTH_/feed-apk/apk_20220319T22.zip"
}
```
```

--------------------------------

### File Module - SHA1 Hashing

Source: https://docs.koodous.com/yara/file

Utilize the `file.sha1(string)` function to identify applications by their SHA1 hash.

```APIDOC
## File Module - SHA1 Hashing

### Description
Matches applications based on their SHA1 hash.

### Method
Function call

### Endpoint
N/A

### Parameters
#### Path Parameters
N/A

#### Query Parameters
N/A

#### Request Body
N/A

### Function Signature
`file.sha1(string)`

### Request Example
```json
{
  "rule_name": "my_apk",
  "condition": "file.sha1(\"2031eab6020aab492d31d7b4af3e1758ea1a3e00\")"
}
```

### Response
#### Success Response (Boolean)
- **true** (boolean) - Returns true if the file's SHA1 hash matches the provided string.

#### Response Example
```json
{
  "match": true
}
```
```

--------------------------------

### GET /account/statistics/

Source: https://docs.koodous.com/api/account

Retrieves analyst statistics, including API rate limits and usage.

```APIDOC
## GET /account/statistics/

### Description
Retrieves analyst statistics, including API rate limits and usage. This contains information on the API limits according to the group to which it belongs and how it is used.

### Method
GET

### Endpoint
/account/statistics/

### Parameters
#### Path Parameters
None

#### Query Parameters
None

#### Request Body
None

### Request Example
None

### Response
#### Success Response (200)
- **rate_limits** (object) - An object containing rate limit details for various API endpoints.
  - **apk-search** (object) - Rate limit for APK search.
    - **limit** (string) - The limit, e.g., "15/day".
    - **used** (integer) - The number of requests used.
  - **apk-detail** (object) - Rate limit for APK details.
    - **limit** (string) - The limit, e.g., "4/min".
    - **used** (integer) - The number of requests used.
  - **apk-download** (object) - Rate limit for APK downloads.
    - **limit** (string) - The limit, e.g., "5/day".
    - **used** (integer) - The number of requests used.
  - **apk-analyze** (object) - Rate limit for APK analysis.
    - **limit** (string) - The limit, e.g., "0/day".
    - **used** (integer) - The number of requests used.
  - **apk-analysis** (object) - Rate limit for APK analysis results.
    - **limit** (string) - The limit, e.g., "5/day".
    - **used** (integer) - The number of requests used.
  - **api-usage** (object) - Rate limit for general API usage.
    - **limit** (string) - The limit, e.g., "150/min".
    - **used** (integer) - The number of requests used.

#### Response Example
```json
{
    "rate_limits": {
        "apk-search": {
            "limit": "15/day",
            "used": 0
        },
        "apk-detail": {
            "limit": "4/min",
            "used": 0
        },
        "apk-download": {
            "limit": "5/day",
            "used": 0
        },
        "apk-analyze": {
            "limit": "0/day",
            "used": 0
        },
        "apk-analysis": {
            "limit": "5/day",
            "used": 0
        },
        "api-usage": {
            "limit": "150/min",
            "used": 0
        }
    }
}
```
```

--------------------------------

### Match Application by SHA1 Hash using Koodous File Module

Source: https://docs.koodous.com/yara/file

Utilizes the file.sha1() function from the Koodous 'file' module to match an application based on its SHA1 hash. This function allows for identification by a specific SHA1 checksum.

```yara
rule my_apk: koodous
{
    condition:
        file.sha1("2031eab6020aab492d31d7b4af3e1758ea1a3e00")
}
```

--------------------------------

### Create YARA Ruleset

Source: https://docs.koodous.com/api/rulesets

Creates a new YARA ruleset with specified name, status, and visibility.

```APIDOC
## POST /rulesets/

### Description
Creating a YARA ruleset.

### Method
POST

### Endpoint
/rulesets/

### Parameters
#### Form Parameters
- **name** (string) - Required - Ruleset name.
- **status** (string) - Required - Ruleset status. Options: `enabled`, `disabled`.
- **is_public** (boolean) - Required - Indicates whether it is public or private. There is a limit to the number of private rules depending on the subscription type that the user has.
- **is_notifier** (boolean) - Optional - Indicates whether the YARA ruleset will create notifications when matching against apks.

### Request Example
```json
{
  "example": "POST /rulesets/\nContent-Type: application/x-www-form-urlencoded\n\nname=NewMalwareRules&status=enabled&is_public=True&is_notifier=False"
}
```

### Response
#### Success Response (201 Created)
- **id** (integer) - Unique identifier for the newly created ruleset.
- **name** (string) - Name of the ruleset.
- **status** (string) - Status of the ruleset (`enabled` or `disabled`).
- **is_public** (boolean) - Indicates if the ruleset is public.
- **is_notifier** (boolean) - Indicates if the ruleset triggers notifications.
- **author** (object) - Information about the author.
- **created_at** (string) - Timestamp when the ruleset was created.

#### Response Example
```json
{
  "example": "{\"id\": 2, \"name\": \"NewMalwareRules\", \"status\": \"enabled\", \"is_public\": true, \"is_notifier\": false, \"author\": {\"username\": \"koodous_user\"}, \"created_at\": \"2023-10-27T11:00:00Z\"}"
}
```
```

--------------------------------

### GET /apks/{sha256}/

Source: https://docs.koodous.com/api/apks

Retrieves detailed information about a specific APK using its SHA256 hash. This endpoint has a specific request limit.

```APIDOC
## GET /apks/{sha256}/

### Description
Detailed information about an apk. This method has a specific request limit.

### Method
GET

### Endpoint
/apks/{sha256}/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK.

### Response
#### Success Response (200)
- **id** (string) - Unique identifier for the APK.
- **url** (string) - URL to the APK.
- **sha256** (string) - SHA256 hash of the APK.
- **md5** (string) - MD5 hash of the APK.
- **sha1** (string) - SHA1 hash of the APK.
- **app** (string) - Application name.
- **package_name** (string) - Package name of the application.
- **company** (string) - Company that developed the application.
- **version** (string) - Version of the application.
- **image** (string/null) - URL to the application's icon.
- **size** (integer) - Size of the APK in bytes.
- **tags** (array) - List of tags associated with the APK.
- **is_trusted** (boolean) - Indicates if the APK is trusted.
- **is_installed** (boolean) - Indicates if the APK is installed.
- **rating** (integer) - User rating for the APK.
- **is_detected** (boolean) - Indicates if the APK has been detected as malicious.
- **is_corrupted** (boolean) - Indicates if the APK is corrupted.
- **is_static_analyzed** (boolean) - Indicates if static analysis has been performed.
- **is_dynamic_analyzed** (boolean) - Indicates if dynamic analysis has been performed.
- **last_yara_analysis_at** (string/null) - Timestamp of the last Yara analysis.
- **created_at** (string) - Timestamp when the APK was created.

#### Response Example
```json
{
  "id": "bMo71eaEM2m1xR3g",
  "url": "https://developer.koodous.com/apks/ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429/",
  "sha256": "ca9139a9978f306d07da26d6b299661af67f99e6b1e2f1c19f29b11fb44eb429",
  "md5": "9ec448a9b5826bff5f67deb78a332109",
  "sha1": "47b198defd13935a8cf8a44d66ab752feda5c810",
  "app": "Sticker Center",
  "package_name": "com.samsung.android.stickercenter",
  "company": "Samsung Corporation",
  "version": "2.2.00.16",
  "image": null,
  "size": 8485692,
  "tags": [],
  "is_trusted": false,
  "is_installed": false,
  "rating": 0,
  "is_detected": false,
  "is_corrupted": false,
  "is_static_analyzed": false,
  "is_dynamic_analyzed": false,
  "last_yara_analysis_at": null,
  "created_at": "2022-01-14T09:41:01.648728+01:00"
}
```
```

--------------------------------

### File Module - SHA256 Hashing

Source: https://docs.koodous.com/yara/file

Employ the `file.sha256(string)` function for matching applications with their SHA256 hash. This is the recommended method for whitelisting.

```APIDOC
## File Module - SHA256 Hashing

### Description
Matches applications based on their SHA256 hash. This is the recommended hash for creating whitelists due to its robustness.

### Method
Function call

### Endpoint
N/A

### Parameters
#### Path Parameters
N/A

#### Query Parameters
N/A

#### Request Body
N/A

### Function Signature
`file.sha256(string)`

### Request Example
```json
{
  "rule_name": "my_apk",
  "condition": "file.sha256(\"3350990c4d298cdb4dc94ba886a27147e501bbf8fd504d824be53cad5cb02142\")"
}
```

### Response
#### Success Response (Boolean)
- **true** (boolean) - Returns true if the file's SHA256 hash matches the provided string.

#### Response Example
```json
{
  "match": true
}
```
```

--------------------------------

### GET /apks/{sha256}/vote_positive/

Source: https://docs.koodous.com/api/apks

Places a positive vote for a specific APK. Only one vote per user is allowed and it cannot be changed.

```APIDOC
## GET /apks/{sha256}/vote_positive/

### Description
Place a positive vote for an APK. Only one vote per user is allowed for an APK and it cannot be changed once submitted.

### Method
GET

### Endpoint
/apks/{sha256}/vote_positive/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK to vote positive on.

### Response
#### Success Response (200)
- Indicates that the positive vote was successfully placed. Specific response body may vary.
```

--------------------------------

### Import Koodous File Module

Source: https://docs.koodous.com/yara/file

Imports the 'file' module, which is necessary to use its file matching functionalities within Koodous rulesets. This directive should be placed at the header of your ruleset.

```yara
import "file"
```

--------------------------------

### GET /apks/{sha256}/vote_negative/

Source: https://docs.koodous.com/api/apks

Places a negative vote for a specific APK. Only one vote per user is allowed and it cannot be changed.

```APIDOC
## GET /apks/{sha256}/vote_negative/

### Description
Place a negative vote for an APK. Only one vote per user is allowed for an APK and it cannot be changed once submitted.

### Method
GET

### Endpoint
/apks/{sha256}/vote_negative/

### Parameters
#### Path Parameters
- **sha256** (string) - Required - The SHA256 hash of the APK to vote negative on.

### Response
#### Success Response (200)
- Indicates that the negative vote was successfully placed. Specific response body may vary.
```
Tokens:
Raw