// the take
Munin is a command-line and web-service tool that takes a list of file hashes (or IOCs) and queries VirusTotal plus eight other malware intel sources (Hybrid Analysis, Any.Run, MISP, CAPE, URLhaus, Malshare, Valhalla, Hashlookup) to pull AV detection data, PE metadata, and sandbox reports. It's built for SOC analysts and incident responders triaging hash lists from retrohunts or IOC feeds, not for general developers.
Aggregating nine different intel sources into one output (CSV or JSON) saves real time versus pasting hashes into nine browser tabs one at a time. The JSON cache means a hash seen twice in a batch, or across multiple runs, doesn't re-burn API quota. Three distinct run modes (batch file, CLI paste, web service) cover both scripted pipelines and ad-hoc analyst lookups without forcing one workflow. The companion `hugin.py` script bypasses VT's 15-second per-request cooldown entirely by pulling the full retrohunt JSON via the v3 API, which is a meaningfully better retrohunt workflow than munin.py's hash-by-hash querying.
Most of the real value (Valhalla, MISP, CAPE, Hybrid Analysis) sits behind API keys that require registration or, for Valhalla, an invite — so out of the box you're mostly just a VirusTotal wrapper until you collect several accounts. There's no test directory in the tree at all, which is a real gap for a tool that parses hash lists and IOC strings from potentially hostile input. pycurl is a hard dependency and the README itself documents a multi-step OpenSSL workaround just to install it on macOS, which is a bad sign for a 2026-dated project. The VT cooldown is a hardcoded 15 seconds rather than reading your API tier's actual rate limit, so premium VT users are stuck throttled at the free-tier pace unless they patch the source.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →