VT Hash Intel — VirusTotal Threat Intelligence

---

name: vt-hash-intel

description: >

Instantly check if a file, URL, domain, or IP is malicious using VirusTotal.

Paste any MD5/SHA1/SHA256 hash, URL, domain name, or IP address into the chat

and get a full threat report — detection ratio across 70+ security engines,

malware family, YARA matches, sandbox verdicts, DNS records, WHOIS info, and

a direct link to the VirusTotal report. Supports single and batch lookups of

mixed IOC types. Also handles defanged IOCs (hxxp, [.] notation).

Perfect for incident response, threat hunting, IOC enrichment, SOC triage,

and daily security operations. Use this skill whenever the user has a suspicious

hash, URL, domain, or IP they want to investigate.

Also triggers on: VirusTotal, VT, hash lookup, malware check, file reputation,

threat intel, IOC, URL scan, domain reputation, IP reputation,

查hash, 查IP, 查域名, 查URL, 威胁情报, 病毒查询, 恶意软件分析.

version: 2.0.0

metadata:

openclaw:

requires:

env:

- VT_API_KEY

---

# VT Hash Intel — VirusTotal Threat Intelligence

Check any IOC (Indicator of Compromise) against VirusTotal's 70+ security engines. Supports four IOC types:

| Type | Example | VT Endpoint |

|---|---|---|

| **Hash** (MD5/SHA1/SHA256) | `44d88612fea8a8f36de82e1278abb02f` | `/files/{hash}` |

| **URL** | `https://malicious-site.com/payload` | `/urls/{id}` |

| **Domain** | `evil-domain.com` | `/domains/{domain}` |

| **IP Address** | `1.2.3.4` | `/ip_addresses/{ip}` |

Prerequisites

`VT_API_KEY` environment variable must be set. Free key: https://www.virustotal.com/gui/my-apikey

Instructions

Step 1: Identify IOCs from user input

The script auto-detects IOC type:

The script also handles **defanged IOCs** automatically:

Step 2: Run the lookup

SKILL_DIR="$(dirname "$(find /root/.openclaw -name 'SKILL.md' -path '*/vt-hash-intel/*' 2>/dev/null | head -1)")"

# Single IOC (auto-detect type)
python3 "$SKILL_DIR/scripts/vt_lookup.py" <ioc>

# Mixed batch (hashes + URLs + domains + IPs together)
python3 "$SKILL_DIR/scripts/vt_lookup.py" <hash> <url> <domain> <ip>

# Force type if auto-detection is wrong
python3 "$SKILL_DIR/scripts/vt_lookup.py" --type domain example.com

Step 3: Parse and present results

The JSON output always contains these common fields:

**Hash-specific fields**: `sha256`, `md5`, `sha1`, `file_name`, `file_type`, `file_size_human`, `threat_label`, `popular_threat_name`, `crowdsourced_yara`, `sandbox_verdicts`, `sigma_rules`

**URL-specific fields**: `url`, `final_url`, `title`, `categories`

**Domain-specific fields**: `registrar`, `creation_date`, `dns_records`, `categories`, `popularity_ranks`

**IP-specific fields**: `asn`, `as_owner`, `country`, `network`

Step 4: Format the response

IMPORTANT: Always present full contextual analysis regardless of threat level. Even when an IOC is "clean" (0 detections), the contextual information is extremely valuable for security analysis. A clean VT result does NOT mean an IOC is safe — it may be too new, targeted, or simply not yet submitted.

**For hashes** — present:

**For URLs** — present:

**For domains** — always present these even if clean:

**For IPs** — always present these even if clean:

Threat level classification (same for all types):

| Malicious Detections | Level | Emoji |

|---|---|---|

| 0 | clean | ✅ |

| 1–5 | low | ⚠️ |

| 6–15 | medium | 🟠 |

| 16+ | high | 🔴 |

Step 5: Recommendations

Always provide actionable recommendations based on threat level AND context:

For batch results with mixed types, present a summary table first (IOC | type | verdict | detection ratio | key finding), then detailed reports for each item.

Error Handling

| Error | Cause | Response |

|---|---|---|

| `NotFoundError` | IOC not in VT DB | "Not found in VT. This does NOT mean it's safe." |

| `AuthenticationError` | Bad/missing API key | "Check VT_API_KEY in your .env file." |

| `QuotaExceededError` | Rate limit hit | "Rate limited. Wait and retry." |

| `UnrecognizedIOC` | Cannot detect type | "Cannot identify this IOC type. Try --type flag." |

| `ConnectionError` | Network issue | "Cannot reach VT API. Check network." |

Examples

**User**: 帮我查一下这个hash 44d88612fea8a8f36de82e1278abb02f

**Agent**: Detects MD5 hash → runs lookup → presents file threat report.

**User**: Check this URL: https://suspicious-site.com/download.exe

**Agent**: Detects URL → runs lookup → presents URL analysis with categories and detections.

**User**: 这个域名安全吗？evil-domain.com

**Agent**: Detects domain → runs lookup → presents domain report with DNS, WHOIS, and detections.

**User**: 查一下这些IOC:

44d88612fea8a8f36de82e1278abb02f

hxxps://bad-site[.]com/malware

evil.com

1.2.3.4

**Agent**: Detects mixed types → runs batch lookup → presents summary table then individual reports sorted by severity.