vt-hash-intel: Скилл анализа вредоносных объектов

--- name: vt-hash-intel description: "Instantly check if a file, URL, domain, or IP is malicious using VirusTotal. Paste any MD5/SHA1/SHA256 hash, URL, domain name, or IP address into the chat and get a full threat report — detection ratio across 70+ security engines, malware family, YARA matches, sandbox verdicts, DNS records, WHOIS info, and a direct link to the VirusTotal report. Supports single and batch lookups of mixed IOC types. Also handles defanged IOCs (hxxp, [.] notation). Perfect for incident response, threat hunting, IOC enrichment, SOC triage, and daily security operations. Use this skill whenever the user has a suspicious hash, URL, domain, or IP they want to investigate. Also triggers on: VirusTotal, VT, hash lookup, malware check, file reputation, threat intel, IOC, URL scan, domain reputation, IP reputation, 查hash, 查IP, 查域名, 查URL, 威胁情报, 病毒查询, 恶意软件分析." --- # VT Hash Intel — VirusTotal Threat Intelligence Check any IOC (Indicator of Compromise) against VirusTotal's 70+ security engines. Supports four IOC types: | Type | Example | VT Endpoint | |---|---|---| | **Hash** (MD5/SHA1/SHA256) | `44d88612fea8a8f36de82e1278abb02f` | `/files/{hash}` | | **URL** | `https://malicious-site.com/payload` | `/urls/{id}` | | **Domain** | `evil-domain.com` | `/domains/{domain}` | | **IP Address** | `1.2.3.4` | `/ip_addresses/{ip}` | ## Prerequisites `VT_API_KEY` environment variable must be set. Free key: https://www.virustotal.com/gui/my-apikey ## Instructions ### Step 1: Identify IOCs from user input The script auto-detects IOC type: - **Hash**: 32 hex chars (MD5), 40 hex chars (SHA1), 64 hex chars (SHA256) - **URL**: starts with `http://` or `https://` - **IP**: IPv4 format like `1.2.3.4` - **Domain**: everything else with dots and valid TLD (e.g. `evil.com`) The script also handles **defanged IOCs** automatically: - `hxxp://` → `http://` - `hXXp://` → `http://` - `evil[.]com` → `evil.com` - `1[.]2[.]3[.]4` → `1.2.3.4` ### Step 2: Run the lookup ```bash SKILL_DIR="$(dirname "$(find /root/.openclaw -name 'SKILL.md' -path '*/vt-hash-intel/*' 2>/dev/null | head -1)")" # Single IOC (auto-detect type) python3 "$SKILL_DIR/scripts/vt_lookup.py" <ioc> # Mixed batch (hashes + URLs + domains + IPs together) python3 "$SKILL_DIR/scripts/vt_lookup.py" <hash> <url> <domain> <ip> # Force type if auto-detection is wrong python3 "$SKILL_DIR/scripts/vt_lookup.py" --type domain example.com ``` ### Step 3: Parse and present results The JSON output always contains these common fields: - `ioc`: the queried value - `ioc_type`: "hash" | "url" | "domain" | "ip" - `detection_ratio`: e.g. "45/72" - `threat_level`: "clean" | "low" | "medium" | "high" - `threat_emoji`: ✅ | ⚠️ | 🟠 | 🔴 - `detections`: array of engines that flagged it - `reputation`: VT community reputation score - `vt_link`: direct link to the VT report - `error`: non-null if something went wrong **Hash-specific fields**: `sha256`, `md5`, `sha1`, `file_name`, `file_type`, `file_size_human`, `threat_label`, `popular_threat_name`, `crowdsourced_yara`, `sandbox_verdicts`, `sigma_rules` **URL-specific fields**: `url`, `final_url`, `title`, `categories` **Domain-specific fields**: `registrar`, `creation_date`, `dns_records`, `categories`, `popularity_ranks` **IP-specific fields**: `asn`, `as_owner`, `country`, `network` ### Step 4: Format the response IMPORTANT: Always present full contextual analysis regardless of threat level. Even when an IOC is "clean" (0 detections), the contextual information is extremely valuable for security analysis. A clean VT result does NOT mean an IOC is safe — it may be too new, targeted, or simply not yet submitted. **For hashes** — present: - Verdict line (emoji + level + detection ratio) - File info: name, type, size, first seen date - Threat classification (if malicious): family name, threat label - Top engine detections (if any) - YARA rules, sandbox verdicts, Sigma rules (if any) - VT link - Contextual analysis + recommendations **For URLs** — present: - Verdict line - URL + final redirected URL (flag if different — could indicate redirect chain) - Page title - Categories assigned by security vendors - Top detections (if any) - VT link - Contextual analysis: analyze whether the URL pattern looks suspicious (random strings, suspicious TLD, known bad path patterns like /wp-content/uploads/*.exe) - Recommendations **For domains** — always present these even if clean: - Verdict line - Registrar + creation date (flag if newly registered within last 30 days — common for phishing/malware) - DNS records (A, AAAA, MX, NS, TXT records — helps identify hosting and infrastructure) - Categories from security vendors - Popularity ranking (low/no ranking on a queried domain can be suspicious) - Reputation score - VT link - Contextual analysis: note if domain is very new, uses suspicious TLD, has low popularity, or uses known bulletproof hosting - Recommendations **For IPs** — always present these even if clean: - Verdict line - ASN number + AS owner (helps identify hosting provider — flag known bulletproof hosters) - Country (geographic context) - Network CIDR range - Reputation score - VT link - Contextual analysis: note if IP belongs to a cloud provider, VPS, residential proxy, or known hosting provider. Flag countries commonly associated with malicious infrastructure if relevant. - Recommendations Threat level classification (same for all types): | Malicious Detections | Level | Emoji | |---|---|---| | 0 | clean | ✅ | | 1–5 | low | ⚠️ | | 6–15 | medium | 🟠 | | 16+ | high | 🔴 | ### Step 5: Recommendations Always provide actionable recommendations based on threat level AND context: - **🔴 high**: Block immediately in firewall/EDR/proxy, sweep environment for related IOCs, investigate affected hosts, collect lateral IOCs (related hashes/domains/IPs from VT) - **🟠 medium**: Likely malicious — isolate and investigate, submit to sandbox, check network IOCs - **⚠️ low**: Possible false positive — verify with sandbox, check file/URL context and origin, monitor - **✅ clean**: Present all available context (ASN, country, registrar, DNS, categories, reputation). Remind user: "Clean on VT does not guarantee safety — the IOC may be too new, too targeted, or not yet submitted. Consider checking other threat intel sources (AbuseIPDB, Shodan, URLhaus, etc.)." - **❓ not found**: Never submitted to VT — does NOT mean safe. Suggest uploading file to VT, or checking AlienVault OTX, AbuseIPDB, URLhaus for additional coverage. For batch results with mixed types, present a summary table first (IOC | type | verdict | detection ratio | key finding), then detailed reports for each item. ## Error Handling | Error | Cause | Response | |---|---|---| | `NotFoundError` | IOC not in VT DB | "Not found in VT. This does NOT mean it's safe." | | `AuthenticationError` | Bad/missing API key | "Check VT_API_KEY in your .env file." | | `QuotaExceededError` | Rate limit hit | "Rate limited. Wait and retry." | | `UnrecognizedIOC` | Cannot detect type | "Cannot identify this IOC type. Try --type flag." | | `ConnectionError` | Network issue | "Cannot reach VT API. Check network." | ## Examples **User**: 帮我查一下这个hash 44d88612fea8a8f36de82e1278abb02f **Agent**: Detects MD5 hash → runs lookup → presents file threat report. **User**: Check this URL: https://suspicious-site.com/download.exe **Agent**: Detects URL → runs lookup → presents URL analysis with categories and detections. **User**: 这个域名安全吗？evil-domain.com **Agent**: Detects domain → runs lookup → presents domain report with DNS, WHOIS, and detections. **User**: 查一下这些IOC: 44d88612fea8a8f36de82e1278abb02f hxxps://bad-site[.]com/malware evil.com 1.2.3.4 **Agent**: Detects mixed types → runs batch lookup → presents summary table then individual reports sorted by severity.