new_contents: import logging
  from datetime import timedelta
  
  from core.feed import Feed
  from core.errors import ObservableValidationError
  from core.observables import Hostname, Hash, Ip, Url
  
  
  def strip(str):
      return str.strip()
  
  
  class MalwareConfig(Feed):
  
      default_values = {
          "frequency": timedelta(minutes=60),
          "name": "MalwareConfig",
          "source": "https://malwareconfig.com/static/C2_24.csv",
          "description": "MalwareConfig offers list of submitted files along extracted c2 servers and malware family.",
      }
  
      def update(self):
          # When used for the first time, get all data
          if self.last_run is None:
              self.source = "https://malwareconfig.com/static/C2_All.csv"
  
          for line in self.update_csv(delimiter=',', quotechar='"'):
              self.analyze(line)
  
          self.source = self.default_values['source']
  
      def analyze(self, line):
          if not line or line[0].startswith("#"):
              return
  
          try:
              ip, domain, family, md5, link, date = tuple(map(strip, line))
              context = {
                  "first_seen": date,
                  "family": family,
                  "report": link,
                  "source": self.name
              }
  
              try:
                  if domain:
                      if '/' in domain:
                          c2 = Url.get_or_create(value=domain)
                      else:
                          c2 = Hostname.get_or_create(value=domain)
                  elif ip:
                      c2 = Ip.get_or_create(value=ip)
                  else:
                      return
  
                  c2.add_context(context)
                  c2.tag(['c2', family.lower()])
  
                  sample = Hash.get_or_create(value=md5)
                  sample.add_context(context)
                  sample.tag(family.lower())
  
                  sample.active_link_to(c2, 'c2', self.name)
              except ObservableValidationError as e:
                  logging.error("Invalid line: {}\nLine: {}".format(e, line))
  
          except ValueError:
              logging.error("Error unpacking line: {}".format(line))
  
subject: add malwareconfig feed