![](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh27FcrIAv582_CBijU05M_OOJtIMiIIWoUKsRVqqYJp9cR4US3P0yigf6HGEkjWXJ6-NjZkvtX9SilZ5A-Gp0ohM6tMxztUjr5tpIg8K6EWdzFt0qEJl42I2QxDsUnCqA0yhPAX1D0fC_Y/s400/vthunting.png) Virus Total Hunting is a tiny tool based on the VT api version 3 to run daily, weekly or monthly report about malware hunting. The report can be send via email, Slack channel or Telegram. The tool can also be used in cli to get a report anytime. The default number of result is 10 but it can be increase or decrease in the config part. This tool is only working with a Virus Total Intelligence API. **Report Example** The below extract is an example of generated report. __ _______ _ _ _ _ \ \ / /_ _| | | | |_ _ _ __ | |_(_)_ __ __ _ \ \ / / | | | |_| | | | | '_ \| __| | '_ \ / _` | \ V / | | | _ | |_| | | | | |_| | | | | (_| | \_/ |_| |_| |_|\__,_|_| |_|\__|_|_| |_|\__, | |___/ McAfee ATR | Thomas Roccia | @fr0gger_ Get latest hunting notification from VirusTotal Latest report from 2018-12-24 10:20:30.158831 ------------------------------------------------------------------------------------- Rule name: FancyBear_ComputraceAgent Match date: 2018-12-24 17:38:17 SHA256: f5157e5b8afe1f79f29c947449477d13ede3d7341699256e62966474a7ee1eb5 Tags: [apt28, fancybear_computraceagent] ------------------------------------------------------------------------------------- Rule name: Winexe_RemoteExecution Match date : 2018-12-24 15:01:15 SHA256: 1e194647c05b0068c31cd443b5bcacc2dd41799e5d21a40e0c58adbad01c28c6 Tags: [winexe_remoteexecution, apt28] ------------------------------------------------------------------------------------- Rule name: hatman_compiled_python: hatman Match date: 2018-12-24 00:28:21 SHA256: 14c64fc93ae68f01989db992bf8ee47ffd33edf66223b84f3fae52f9a843a03f Tags: [triton, hatman, hatman_compiled_python] ------------------------------------------------------------------------------------- Rule name: Stuxnet_unpacked Match date: 2018-12-24 15:00:00 SHA256: 86b05279bf4930ffc0c00e4fd22c8ab9e964e8d45d39bfca42e129b95dc33481 Tags: [stuxnet, stuxnet_unpacked] ------------------------------------------------------------------------------------- Rule name: Stuxnet Match date: 2018-12-24 14:59:59 SHA256: 86b05279bf4930ffc0c00e4fd22c8ab9e964e8d45d39bfca42e129b95dc33481 Tags: [stuxnet] --------------------------------- ---------------------------------------------------- [truncated] **Getting Started** Just download the script: git clone https://github.com/fr0gger/vthunting Then configure the config part with your API keys and info: # Virus Total API VTAPI = "" number_of_result = "" # 10 by default # Email configuration smtp_serv = "" smtp_port = "" gmail_login = "" gmail_pass = "" # pass from APP gmail_dest = "" # Slack Bot config SLACK_BOT_TOKEN = "" SLACK_CHANNEL = "" # Telegram Bot config TOKEN = "" chat_id = "" Once the config is ready you can run the file with: python vthunting.py --help usage: vthunting.py [OPTION] -h, --help Print this help -r, --report Print the VT hunting report -s, --slack_report Send the report to a Slack channel -e, --email_report Send the report by email -t, --telegram_report Send the report to Telegram **Prerequisites** **Requirements** You first need to install the requirement: * requests * slackclient pip install -r requirements.txt **VT API** Get your API key from Virus Total. https://developers.virustotal.com/v3.0/reference **Email Configuration (gmail)** To create an app you can find the documentation here: https://support.google.com/accounts/answer/185833 **Slack Bot Configuration** To generate a token you need to go here and follow the step: https://api.slack.com/custom-integrations/legacy-tokens **Telegram Bot Configuration** To get a token you need to create a Telegram bot by talking to @BotFather, it will help you to configure your bot and get your token. Once you get your token visit https://api.telegram.org/bot/getUpdates to get the channel id. **Install in your system** If you want to access to this script anywhere you can copy it without the extension into: cp vthunting.py /usr/local/bin/vthunting **Configure the task scheduler with crontab** You can use crontab to run the script and receive report periodically. crontab -e Below is an example to receive the report every day at 10:15am. # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user command to be executed 15 10 * * * /usr/local/bin/vthunting -r -t -e -s >> vthunt.log **Download Vthunting**

Vthunting - A Tiny Script Used To Generate Report About VirusTotal Hunting And Send It By Email, Slack Or Telegram