🛡️ VTScan — VirusTotal for the Terminal

⚠️ This project is still in beta

go install github.com/ibnaleem/vtscan@latest

vtscan is a command-line tool for scanning files, URLs, and IPs against VirusTotal's malware detection. It makes it easier for developers, sercurity researchers, and TUI users to get a verdict of a file, IP, URL, hash and more. It was developed after I grew tired of trying to find a file via the GUI to upload to VirusTotal. Sometimes its on the desktop, often times its in some obscure path that takes us forever to traverse.

After you've ran the install command above, you should obtain an API key from VirusTotal and specify it in your environmental variables as VT_API_KEY. API keys are usually free, unless you're subscribed. Please look up how to setup an environmental variable for your OS.

vtscan will automatically calculate a SHA256 hash of your file to search VirusTotal's API. You can specify as many files or hashes as you need, and vtscan will do the rest for you:

$ vtscan file malware.exe cryptominer.bat b2660178b77e43b65d9e991332f0c9d59bd555aee9e8879e39a55e7db8d472d0

Here, vtscan will search for the following:

1. malware.exe via SHA256 hash
2. cryptominer.bat via SHA256 hash
3. b266017... via hash

The hash specified in the argument does not have to be SHA256: it could be either SHA1 or MD5 as well.

$ vtscan ip <ip address 1> <ip address 2> <ip address 3>...

$ vtscan ip comments <ip address 1>

$ vtscan ip votes <ip address 1>

$ vtscan ip relationships <ip address> <relationship>

Where <relationship> is one of: communicating_files, downloaded_files, graphs, historical_ssl_certificates, historical_whois, referrer_files, related_comments, related_references, related_threat_actors, resolutions, urls.

$ vtscan domain <domain 1> <domain 2> <domain 3>...

$ vtscan domain comments <domain 1>

$ vtscan domain votes <domain 1> <domain 2> <domain 3>...

Every vote is listed with its date, verdict, weight and vote ID, alongside a harmless/malicious summary. Up to 400 votes are fetched per domain; vtscan tells you when a domain has more.

These are the following API endpoints that are planned for implementation

1. Request an IP address (re)scan POST
2. Add a comment to an IP address POST
3. Get object descriptors related to an IP address GET
4. Add a vote to an IP address POST

1. Request an domain (re)scan POST
2. Add a comment to a domain POST
3. Get objects related to a domain GET
4. Get object descriptors related to a domain GET
5. Get a DNS resolution object GET
6. Add a vote to a domain POST