# Lookup Reversinglabs

> Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples b…

- **Type:** Skill
- **Install:** `agentstack add skill-liberty91ltd-cti-skills-lookup-reversinglabs`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Liberty91LTD](https://agentstack.voostack.com/s/liberty91ltd)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** https://github.com/Liberty91LTD/cti-skills/tree/main/skills/lookup-reversinglabs
- **Website:** https://liberty91.com/cti-skills

## Install

```sh
agentstack add skill-liberty91ltd-cti-skills-lookup-reversinglabs
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# lookup-reversinglabs

Queries ReversingLabs Spectra Analyze (the A1000 appliance API) for authoritative classification, full enrichment reports, sandbox behaviour, MITRE ATT&CK mappings, and network indicator reputation. Retrieval only — do not interpret, assess, or conclude. The invoking skill or agent reasons about the result.

## When to invoke

- User asks to check a hash against ReversingLabs / A1000 / Spectra Analyze
- VirusTotal returned thin signal on a hash and you need a vendor-validated verdict
- Investigation needs MITRE ATT&CK technique coverage from a sample's behaviour
- Need parent/child relationships (which container did this drop from? what was unpacked?) for pivoting
- Want to find sibling samples by threat name or AV-detection signature (`/lookup-reversinglabs search`)
- Need network reputation on a URL, domain, or IP from RL's malware-analysis corpus
- Submitting a sample for fresh static + dynamic analysis (slower; produces a full TitaniumCore + sandbox report)

## How to invoke

One CLI: a Python wrapper around the official `reversinglabs-sdk-py3`. Self-bootstraps a private venv at `tools/clis/.venv-reversinglabs/` on first run; no global install. The SDK exchanges your username + password for a session token via `/api-token-auth/` automatically.

```bash
# Hash classification — fast verdict + AV detection
python3 tools/clis/reversinglabs.py hash  [--av-scanners] [--ticloud]

# Full enrichment report (default detailed; pass --summary for the lighter shape)
python3 tools/clis/reversinglabs.py report  [--summary|--detailed] [--fields F1,F2,...]

# File / URL submission (use --wait to block until analysis completes)
python3 tools/clis/reversinglabs.py submit-file  [--wait] [--rl-cloud-sandbox windows10]
python3 tools/clis/reversinglabs.py submit-url  [--wait] [--crawler local|tcb|cape|fireeye|vmray]

# Network threat intelligence (no submission — reads existing corpus)
python3 tools/clis/reversinglabs.py url 
python3 tools/clis/reversinglabs.py domain 
python3 tools/clis/reversinglabs.py ip  [--pivot files,domains,urls] [--max-results 50]

# Advanced search — pivot by threat name, classification, AV signature
python3 tools/clis/reversinglabs.py search "" [--ticloud] [--max-results 100]

# Parent / child sample relationships
python3 tools/clis/reversinglabs.py containers 
python3 tools/clis/reversinglabs.py extracted  [--max-results 200]

# Read-only: which samples matched a YARA ruleset
python3 tools/clis/reversinglabs.py yara-matches  [--max-results 200]
```

All subcommands accept `--dry-run` to preview the request plan without spending an API call. All exit code 2 if `$REVERSINGLABS_USER` or `$REVERSINGLABS_PASSWORD` is unset (when not in dry-run). Report missing credentials; do not fabricate.

### Examples

```bash
# 1) Fast verdict on a hash, including TitaniumCloud reputation
python3 tools/clis/reversinglabs.py hash 5e884898da28047151d0e56f8dc6292773603d0d6aabbdd62a11ef721d1542d8 \
  --av-scanners --ticloud

# 2) Full enrichment incl. MITRE ATT&CK and network indicators extracted from the sample
python3 tools/clis/reversinglabs.py report 5e884898... --detailed \
  --fields classification,riskscore,classification_result,attack,networkthreatintelligence,tags

# 3) Pivot from a known sample to siblings in the same family
python3 tools/clis/reversinglabs.py search 'threatname:Win32.Ransomware.Lockbit classification:malicious' \
  --max-results 50

# 4) Pivot from an extracted hash to its parent container, then siblings dropped by the same parent
python3 tools/clis/reversinglabs.py containers 
python3 tools/clis/reversinglabs.py extracted 

# 5) IP reputation + fan-out to files + domains seen on that IP
python3 tools/clis/reversinglabs.py ip 185.220.101.45 --pivot files,domains,urls --max-results 25
```

### Quota awareness

ReversingLabs does not publicly document per-minute / per-day rate limits for A1000. The API returns **HTTP 429** with a `Retry-After` header when limits are hit. Submission endpoints poll at 2-second intervals up to 10 retries (SDK defaults) before giving up. Each `--pivot` entry is a *separate* API call on top of the base IP report. Use `--dry-run` first when fanning out broadly.

## Response format

The CLI emits JSON to stdout. Skills consuming it should treat it as:

```yaml
source: reversinglabs
operation: hash_classification | report_summary | report_detailed | submit_file | submit_url |
           network_url_report | network_domain_report | network_ip_report |
           advanced_search | containers | extracted_files | yara_matches
indicator: 
type: hash | url | domain | ip | file | query | ruleset
host: https://a1000.reversinglabs.com
query_time: 
# operation-specific payload — typically the SDK's deserialised JSON body
classification: { ... }   # for `hash`
report: { ... }            # for `report`, `url`, `domain`, `ip`
results: [ ... ]           # for `search`
files | containers: [...]  # for `extracted`, `containers`
```

Common fields inside a detailed `report`:

| Field | Meaning |
|---|---|
| `classification` | Verdict: `malicious` / `suspicious` / `goodware` / `unknown` |
| `riskscore` | Numeric 0–10 risk score |
| `classification_result` | Threat name string (e.g. `Win32.Ransomware.Lockbit`) |
| `av_scanners_summary` | `{scanner_count, scanner_match, scanner_percent}` |
| `av_scanners` | Per-engine scan results |
| `tags` | Analyst + system-applied tags |
| `ticore` | Full TitaniumCore static analysis (format, headers, imports, strings) |
| `attack` | MITRE ATT&CK tactics + techniques mapped from observed behaviour |
| `rl_cloud_sandbox` | Dynamic analysis output |
| `networkthreatintelligence` | Network indicators extracted from the sample |
| `ticloud` | Spectra Intelligence reputation (when `--ticloud`) |

## Rate limits

No public per-minute/day quota. API returns 429 with `Retry-After`. SDK polls submissions with `wait_time_seconds=2`, `retries=10`. Back off and retry on 429.

## Source reliability (Admiralty default)

Default rating for downstream `/score-source`: **A2** (completely reliable, probably true). Vendor-authoritative static + dynamic analysis pipeline; verdicts are well validated against ground truth. A1000 is single-tenant — classification overrides applied by other tenants do not affect this lookup.

**Downgrade to B3** if:
- `classification` is `unknown` or `suspicious` (analyst should still verify)
- Sample is very fresh (= 5` AND sandbox produced behavioural evidence
- Threat name maps to a known family with public reporting

## Related skills

- `/lookup-virustotal` — community-aggregated detection; complements RL's authoritative verdict
- `/lookup-otx` — community pulse context for the same indicator
- `/malware-analysis` — methodology for interpreting static + dynamic analysis output
- `/hash-investigation` — chains this lookup with VirusTotal and OTX
- `/score-source` — apply Admiralty rating to the result

## See also

- Integration setup: `tools/integrations/reversinglabs.md`
- Python CLI source: `tools/clis/reversinglabs.py`
- Companion API reference (non-invokable): `skills/reversinglabs-api/SKILL.md`
- Official product docs: https://docs.reversinglabs.com/SpectraAnalyze/
- SDK source: https://github.com/reversinglabs/reversinglabs-sdk-py3

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-liberty91ltd-cti-skills-lookup-reversinglabs
- Seller: https://agentstack.voostack.com/s/liberty91ltd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.