VirusTotal Intelligence's web interface allows you to download packages of files matching the first 25, 50 or 100 results of a given query. If you wish to download any other custom number, including more than 100 files, you should use the VirusTotal Intelligence downloader.
VirusTotal Intelligence downloader is a simple python script that makes use of Intelligence's programmatic interface in order to download the top-n results of an Intelligence search to the client-side disk. You can download VirusTotal Intelligence downloader now:
Please do not share your personal copy of the downloader with third parties, it embeds your own API key. Each VirusTotal Intelligence user should download his own copy via his own personal account.
Using VirusTotal Intelligence downloader is very simple, you just need to have Python 2.7 installed, the rest is a piece of cake:
user@machine:~/$ python vt_intelligence_downloader.py -h Usage: vt_intelligence_downloader.py [options] Allows you to download the top-n files returned by a givenVirusTotal Intelligence search. Example: python vt_intelligence_downloader.py -n 10 type:"peexe" positives:5+ Options: -h, --help show this help message and exit -n NUMFILES, --numfiles=NUMFILES number of files to download
Hence, if you wish to download the top 500 files matching the query type:"peexe" you would just have to type:
python vt_intelligence_downloader.py -n 500 'type:"peexe"'
Similarly, if you had a file with 200 hashes which you would like to query for and download you would just need to issue the following command:
python vt_intelligence_downloader.py -n 200 /path/to/my_file_with_hashes.txt
The hashes can be either md5, sha1 or sha256 hashes and they can be mixed up, the script will know what to do.