vt-cli

vt-cli or VirusTotal Command-Line is a utility for desktop use that enables command-line scans, URL checkups, IP verifications, including accessing VirtusTotal collection of live reports,  and more sophisticated processes, such as calling the VirusTotal API for various checkups.

The VirusTotal binaries come in two formats, for 32-bit and 64-bit system architectures.

The tools require no installation and their portability makes them suitable for system administrators or network configuration specialists, and not only. Because the tools can be accessed via a CLI, their system compatibility is increased.

For opening the vt-cli, you must open a command-line tool in admin mode, on Windows. For seeing the available options, you can use the 'help' command, followed after having typed 'vt.exe.' For some commands, there are different sub-commands or arguments you can add to customize your search or the default command.

For example, you can use and configure a proxy, get report analysis and manage outputs in local files, and even configure auto-completion for numerous typing commands and their passed arguments. For that purpose, try using Cygwin instead of the Windows console that does not support auto-completion.

VirusTotal is a service that offers security checks by aggregating multiple online sources and scanning engines, including Yara's signatures, a proprietary VirusTotal product.

With a free user account and public API calls, you have restricted, limited access, such as no more than 4 lookups per minute, 500 lookups per day, or a monthly quota of 15.5 K searches.

With VirusTotal's APIv3, you can use REST principles, get predictable outputs, execute more processes faster, and manage requests, responses, and any given errors in JSON.

The VirusTotal API configuration starts in the vt-cli window, with the 'init' command, followed by an API key authentication request (that you can obtain online, from your VirusTotal account).

What these VT calls can help you with are observing and analyzing files, hashes, domains, IPs, and SSL certificates.

Also, they are suitable for telemetry alert creating, Yara rule integrating for custom threat and indicator of compromise identifications, workflow implementing, and so much more.

For more on VirusTotal's capabilities and public vs. premium API options, read this manual.