VirusTotal
Named by 73 kept items in this workspace.
59 items name it under tools, 12 under classification.technologies, 1 under affected products and 1 under technologies.
Search every workspace for VirusTotal. It matches the name as written, so it can find other things that share it.
The items that name it 73
Hosted a copy of the malicious JavaScript file that BleepingComputer analyzed.
Source of metadata from which CAIRN extracts cognitive artifacts.
Where an early CROSSROAD dropper was submitted on May 20, showing forged 2024 compile timestamps
seven vendors flagged the lure domain and two flagged the collector as of October 8
Public malware repository/scanning service where FRUITSHELL was originally submitted and where the AI-evasion comment's reuse was tracked over 15 months.
Used by researchers to look up the hash of the malicious svchost.exe
Used by Unit 42 to discover campaign samples via file submissions (from Iraq and Israel) that revealed the career portal, coding challenge archive, and Blackwood samples.
Used to pull malware samples and timeline/IP correlation data for SLAPSHOT and Pitboss samples.
Where the two Python credential validation scripts were found.
Public malware repository where related samples were observed appearing two days after a lure was used
Used to identify seven domains serving the .pif file in the wild and to map adversary infrastructure via VirusTotal Graph
Source of metadata (PE static analysis URL/domain objects, content-search hex-dump snippets, AV detection labels, sandbox execution behavior) used by CAIRN's acquisition filters and semantic discovery pipeline
Used to check whether the three encrypted payloads had previously been observed/uploaded; also impersonated via a fake leaf certificate
Used by Talos to hunt for similar WebDAV/ordinal-execution patterns and identify the "pf.ch" loader chain
malware association / hash intelligence; free tier limited to 4 requests/minute
Used by Huntress to attribute the C2 IP address to a known threat-actor-controlled domain (tele-sync.opik[.]net).
Used to inspect IP 104.37.188.94 (revealing ~25 web domains with .vu TLD hosting phishing sites) and to identify 14 additional related phishing emails linked via sender IP 154.127.53.78
Malware scanning service; all 65 engines missed the omnicogg skill
Used to check detection rates of the malicious MSI (0 of 76 engines detected it) and to find related builder outputs (ton435.msi, two setup1.msi files, an unnamed 210,894,848-byte package), all at zero detections
Cortex analyzer for IOC scoring
Collection of 27 N4D artifacts (21 ELF, five shell scripts, one unknown) used for sample tracking and relationships
Traffic redirected via rogue CA and forged certificate for www.virustotal.com to a local proxy
Referenced in discussion of hash-based binary malware handling on the SecOps side
Used to visualize relationships between URLs, hosting IP addresses, and payloads (Figure 8)
Threat intelligence API used by TRONSEC via server-side proxy, likely for phishing/URL checks
Free online analysis of malware samples and URLs
Data source used via API key (FR_VT_KEY) for reconnaissance data fetching in FinalRecon
Optional threat intelligence integration (via VIRUSTOTAL_API_KEY)
Checks IP, domain, URL, or file hash against 70+ engines; requires VIRUSTOTAL_API_KEY
domain/IP/file analysis
Used to submit one of the downloaded binaries, which antivirus vendors flagged as malicious.
Malware scanning service; ClawHub malware evolved to circumvent its scans via fake websites.
Hash/file/URL/IP/domain reputation lookups, sample submission, YARA-based Retrohunt and Livehunt rule hunting (API v3)
Platform where the sample was uploaded (May 22) and remained undetected by static engines
used by Huntress to check reputation/history of the threat actor's source IP addresses
Malware signature scanning service partnered with ClawHub to scan skills, using Code Insight scanner
Platform where a modified MINIRAT sample was uploaded on 2026-05-08, indicating continued use
threat reputation via domain/IP reports (API v3)
File/URL/hash reputation and sandbox verdicts
Used to check detections on malicious files/binaries (e.g., MSI, modified Chrome binaries, DLLs)
Used by Huntress researchers to search for similar malware samples and check detection rates
Malware sandbox/repository referenced as the source of inflated EvilQuest/ThiefQuest sample counts due to a sandbox loop
Used to check reputation/analysis of IP addresses and file hashes (agent.exe, 815.exe).
Used to examine 'Execution Parents' of the ScreenConnect binary to identify related lure files
Used by Huntress analysts to search hashes from the quarantined SecurityCheck detection and to confirm malicious flagging in Incident 3
Used by Huntress investigators to search and identify the malicious domain s3.wasabisys.com linked to the malicious MSI package
Hosts the complete malicious update.py file (MD5: 0c1554888ce9ed0da1583dbdf7b31651) referenced for analysis.
Used to map the MD5 hash of the cached {CACAF1F7-CE7C-4CA2-B9E3-ABBC9F6E965D}.exe file to the known filename Erlianaw.exe
Used by the author to find a sample of the malicious HTML file where the attacker's server was still online
Service where multiple AV vendors flagged SimpleLapsGui.exe as malicious
Source where the original cleaner script sample is available
Hosting/reference for the malicious file 41hs1z and the loader script ldr.sh samples
Used to look up and confirm the microsocks binary found on the compromised device
Used to find another uploaded version of the ransom note and the initial upload of the recovery binary
Multi-engine scanning service; generated AsyncRAT sample scored 48 detections.
Used to show additional scanner findings/detections of the malcontent binary itself
Partnered with ClawHub registry for automated malicious skill scanning.
Scanning partner for ClawHub.
All technologies in this workspace.