Batch file downloads

VirusTotal Intelligence's web interface allows you to download packages of files matching the first 25, 50 or 100 results of a given query. If you wish to download any other custom number, including more than 100 files, you should use one of the examples of vt-py the official Python client library for VirusTotal.

This library requires Python 3.6.0+, Python 2.x is not supported. This is because vt-py makes use of the new async/await syntax for implementing asynchronous coroutines.

The easiest and recommended way of installing vt-py is using pip:

$ pip install vt-py

Alternatively, you can get the source code directly from the GitHub and run setup.py. For getting the code you can either clone the public repository:

$ git clone git://github.com/VirusTotal/vt-py.git
$ cd vt-py

Or, download the tarball for the latest release and uncompress it:

$ tar -zxvf vt-py-X.Y.Z.tar.gz
$ cd vt-py-X.Y.Z

Once you have the code you can install it with:

$ sudo python3 setup.py install

After installing the library, you can use the search_and_download_topn_files.py script:

user@machine:~/$ python3 search_and_download_topn_files.py --help
usage: usage: prog [options] <intelligence_query/local_file_with_hashes>

Allows you to download the top-n files returned by a givenVirusTotal
Intelligence search. Example: python %prog type:"peexe" positives:5+ -n 10
--apikey=<your api key>

positional arguments:
  query a VirusTotal Intelligence search query.

optional arguments:
  -h, --help show this help message and exit
  -n NUMFILES, --numfiles NUMFILES
                        Number of files to download
  --apikey APIKEY Your VirusTotal API key
  -o OUTPUT_PATH, --output-path OUTPUT_PATH
                        The path where you want to put the files in
  -w WORKERS, --workers WORKERS
                        Concurrent workers for downloading files

Hence, if you wish to download the top 500 files matching the query type:"peexe" you would just have to type:

python3 search_and_download_topn_files.py -n 500 'type:"peexe"' --apikey $VT_API_KEY