{"uid":"cap_9t_B-jviyByy7JuB4Eu23","slug":"telesint-malware-family-intelligence-2f785720","name":"TeleSint Malware Family Intelligence","description":"Malware family intelligence from Telegram: new sample drops, behavior analysis, loader/stealer/RAT/backdoor writeups. Filters: severity, min_confidence, since, tag(stealer|loader|rat|backdoor), limit, offset.","url":"https://telesint-api.onrender.com/malware","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","properties":{"tag":{"type":"string","description":"Malware type tag: stealer | loader | rat | backdoor | botnet | worm | dropper | rootkit"},"ttp":{"type":"string","description":"MITRE ATT&CK technique ID prefix, e.g. T1059, T1071"},"limit":{"type":"number","description":"Page size, default 20, max 100"},"since":{"type":"string","description":"ISO 8601 timestamp filter, e.g. 2026-05-01T00:00:00Z"},"offset":{"type":"number","description":"Pagination offset, default 0"},"severity":{"type":"string","description":"Minimum severity: critical | high | medium | low | info"},"min_confidence":{"type":"number","description":"Minimum AI confidence score 0-100"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"items":[{"id":"m1a2l3w4-a5r6-7890-abcd-malware78901","ts":"2026-05-27T11:00:00Z","tlp":"WHITE","iocs":[{"type":"sha256","value":"a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2","context":"Lumma Stealer sample"},{"type":"domain","value":"lumma-panel[.]xyz","context":"C2 panel domain"}],"tags":["lumma","stealer","maas","infostealer","chrome"],"ttps":[{"id":"T1555.003","name":"Credentials from Web Browsers","tactic":"Credential Access"},{"id":"T1071.001","name":"Application Layer Protocol: Web Protocols","tactic":"Command and Control"}],"channel":"https://t[.]me/vxunderground","summary":"New Lumma Stealer v4.1 released with browser cookie bypass targeting Chrome 124+ — sold as MaaS on underground forums","category":"malware","severity":"high","confidence":85}],"limit":20,"total":19,"offset":0,"source":"TeleSint","endpoint":"malware"}},"example":null,"exampleRequest":null,"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_dQ_NT0KJzJrE6UUxQMQ8V","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns AI-enriched malware family intelligence sourced from public Telegram CTI channels, with IOCs, MITRE ATT&CK TTPs, confidence scores, and TLP classifications","exampleAgentPrompt":"Pull the latest high-severity stealer malware intelligence from TeleSint — show me up to 20 records with at least 80 confidence, tagged as stealer type, and include any T1555 technique matches from the past week.","exampleUseCases":null,"resultDescription":"A JSON object containing a paginated list of malware intelligence records, each with a unique ID, timestamp, TLP classification (WHITE/GREEN/AMBER/RED), IOCs (SHA256 hashes, domains, IPs), MITRE ATT&CK TTP mappings with tactic and technique names, malware tags (family name, type, distribution model), AI-generated summary, severity rating, confidence score (0-100), source Telegram channel URL, and endpoint/category metadata. Includes total count, limit, and offset for pagination.","failureModes":["Payment not included or invalid USDC micropayment on Base — returns 402 Payment Required","Invalid tag enum value (not one of stealer/loader/rat/backdoor/botnet/worm/dropper/rootkit) — returns 400 Bad Request","min_confidence outside 0-100 range — returns 400 validation error","Invalid since timestamp format (not ISO 8601) — returns 400 Bad Request","limit exceeds 100 — returns 400 Bad Request","No matching records for given filters — returns empty items array with total 0","Service temporarily unavailable on Render free tier — returns 503 or timeout"],"whenToPreferThis":"Choose this endpoint when you need structured, AI-enriched malware family intelligence with MITRE ATT&CK tagging sourced from active Telegram CTI communities, especially when you want to filter by malware type (stealer, RAT, botnet, etc.), TTP technique, severity, or confidence threshold. Prefer this over generic threat feeds when you need fresh intelligence from underground and grey-hat Telegram channels with DeepSeek-enriched context, IOC extraction, and pay-per-call micropayment access without API key management.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T12:53:40.351Z","isFirstParty":false}