skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-malware-hash-enrichment-with-virustotal

Enrich malware file hashes with VirusTotal detection stats, sandbox behavior, and network IOCs.

954|172|Updated Mar 13, 2026
Search Tags:#api#incident response#threat intelligence#ioc#virustotal#malware analysis#hash enrichment
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-malware-hash-enrichment-with-virustotal
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-malware-hash-enrichment-with-virustotal
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-malware-hash-enrichment-with-virustotal
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-malware-hash-enrichment-with-virustotal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires vt-py, requests.

What problem does it solve?

Security analysts receive file hashes from alerts and EDR tools but lack context to triage them quickly. This Skill automates querying the VirusTotal API v3 to turn a bare MD5, SHA-1, or SHA-256 hash into detection verdicts, behavioral indicators, and C2 infrastructure for incident response decisions.

Core Features & Use Cases

  • Hash Enrichment: Query VirusTotal for detection ratios, threat classifications, file metadata, and a computed threat level from critical to clean.
  • Batch Processing with Rate Limiting: Enrich lists of hashes from a file while respecting free-tier API quotas, exporting results to CSV.
  • IOC Pivoting and Reporting: Extract contacted IPs, domains, and URLs for C2 identification, match crowdsourced YARA rules for malware classification, and generate JSON enrichment reports with actionable recommendations.
  • Use Case: A SOC analyst receives 50 suspicious SHA-256 hashes from an EDR alert batch, enriches them all against VirusTotal, and immediately identifies which samples contacted known C2 infrastructure and warrant blocking.

Quick Start

Enrich this SHA-256 hash with VirusTotal and give me the detection ratio, threat level, and any contacted C2 domains.

Frequently Asked Questions about performing-malware-hash-enrichment-with-virustotal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I enrich a file hash with the VirusTotal API in Python?▼

Use the vt-py client to call GET /files/{hash} on VirusTotal API v3, which returns last_analysis_stats with malicious, suspicious, and undetected counts. Parse the detection ratio and popular_threat_classification to determine the verdict.

How to batch enrich multiple hashes without hitting VirusTotal rate limits?▼

The free tier allows 4 requests per minute and 500 per day, so pause 60 seconds after every 4 lookups. Verify each hash returned an actual report rather than a quota error to avoid under-counting detections.

Does a 0/70 VirusTotal detection ratio mean a file is safe?▼

No, zero detections can mean the sample is brand-new, freshly packed, or never uploaded. Check which engines flagged it, review crowdsourced YARA results, and pivot on imphash or ssdeep similarity instead of trusting the raw count.

Can I extract C2 domains and IPs from a VirusTotal hash report?▼

Yes, query the /files/{hash}/contacted_ips, contacted_domains, and contacted_urls endpoints to retrieve network indicators from sandbox executions. These include ASN, country, and registrar details useful for identifying C2 infrastructure.

What are the limitations of hash-based malware lookup?▼

Hashes are brittle since any repack or appended byte changes the MD5 or SHA-256, so a not-found result says nothing about the malware family. Use durable signals like imphash, vhash, ssdeep, and YARA matches to find related samples.

Related Skills

Explore More Software Engineering Skills→
DevelopersCoffeeDevelopersCoffee
3

cwe-327-weak-cryptography

Replace weak cryptographic algorithms with secure alternatives in Java code.

Official
Intermediate
Liberty91LTDLiberty91LTD
15

ioc-export

Export IOC collections to CSV, STIX 2.1, OpenIOC, and MISP bundles.

Official
Intermediate
ComposioHQComposioHQ
74.2k

virustotal-automation

Automate security analysis and threat intelligence lookups using the Virustotal API via Rube MCP.

Official
Intermediate
AxxxxxxaaannAxxxxxxaaann

analyzing-malware-behavior-with-cuckoo-sandbox

Execute malware samples in Cuckoo Sandbox and capture runtime activity reports.

Community
Advanced