Fact-checked by Grok 2 weeks ago

VirusTotal

VirusTotal is a free online service that enables users to detect malware in files, URLs, IP addresses, and domains by aggregating scans from over 70 antivirus engines and dozens of URL/domain blocklisting services, providing comprehensive threat intelligence to enhance global IT security.^[1] Launched on June 1, 2004, by Spanish security researchers Julio Canto and Bernardo Quintero under the auspices of the cybersecurity firm Hispasec Sistemas, VirusTotal began as a simple tool to aggregate antivirus detections and has evolved into a cornerstone of collaborative malware analysis.^[2]^[3] In September 2012, Google acquired VirusTotal to bolster its malware research capabilities, integrating it into the company's broader security ecosystem while maintaining its core public accessibility.^[4]^[5] Key features include a web interface for high-priority submissions, desktop uploaders, browser extensions, and a public API for programmatic access, allowing users to receive detailed reports on detections, heuristics, metadata extraction, and community-voted assessments to identify false positives.^[1]^[6] The platform operates on a data-sharing model where analysis results are disseminated to submitters and partner organizations, fostering a global community effort against evolving cyber threats while adhering to strict terms for non-commercial use.^[1]^[7]

History

Founding and Early Years

VirusTotal was launched on June 1, 2004, by Spanish security researchers Julio Canto and Bernardo Quintero under Hispasec Sistemas, a small cybersecurity firm based in Málaga, Spain.^[2] Canto, who wrote the initial lines of code, and Quintero, who conceived the idea, developed it as an internal tool for their laboratory to monitor antivirus engine updates against emerging malware threats.^[8] The service quickly evolved into a free, public online platform designed to scan user-submitted files and URLs simultaneously against multiple antivirus engines, providing aggregated detection results to help users identify potential threats more effectively.^[9] In its founding phase, VirusTotal operated as a bootstrapped side project with limited resources, relying on Hispasec's modest infrastructure to host the service.^[10] Early integrations were voluntary, beginning with just a handful of antivirus vendors who agreed to share their scanning engines in exchange for access to submitted malware samples for improving their own detection capabilities.^[9] This collaborative, crowdsourced model fostered mutual benefits but posed challenges, as the team had to manually negotiate partnerships and manage server loads without significant funding or dedicated staff.^[10] By the late 2000s, VirusTotal had achieved widespread adoption among security professionals, driven by its unique multi-engine scanning approach that addressed the limitations of single-antivirus tools.^[2] Milestones included the 2010 introduction of URL scanning capabilities and initial collaborations with services like Google Safe Browsing, solidifying its role as an essential resource in the cybersecurity community.^[2] Insider accounts of this startup period, including the entrepreneurial hurdles and innovative spirit, are detailed in Bernardo Quintero's 2024 book Infected: From Side Project to Google: The Journey Behind VirusTotal.^[10]

Acquisition and Expansion Under Google

Google announced the acquisition of VirusTotal on September 7, 2012, with the deal completed shortly thereafter to enhance its malware detection capabilities.^[4]^[11]^[12] The move integrated VirusTotal's multi-engine scanning service into Google's ecosystem, allowing for bolstered research tools while preserving its independent operation and community-driven model.^[4]^[13] Post-acquisition, VirusTotal benefited from Google's robust infrastructure, which provided greater stability, expanded server capacity to handle surging submission volumes, and reduced analysis times through optimized computational resources.^[4]^[14] These enhancements ensured reliable availability during peak usage, addressing previous limitations of the standalone service and enabling faster processing of files and URLs against multiple antivirus engines.^[4] From 2012 to 2017, VirusTotal underwent significant expansions under Google, including the launch of a public API in December 2012, which allowed developers and researchers to programmatically submit and query scans, fostering broader integration into security workflows.^[15] The number of integrated antivirus engines grew from over 40 at the time of acquisition to more than 50 by 2014, improving detection coverage through partnerships with additional vendors.^[13]^[16] Around 2015-2016, early enterprise offerings emerged, providing premium API access with higher query limits and dedicated support for organizations requiring elevated scanning volumes.^[17] Google's strategic rationale centered on strengthening security for its core services, such as Chrome browser and Search engine, by leveraging VirusTotal's aggregated threat data to proactively identify and block malicious content.^[5]^[18] This acquisition aligned with Google's broader commitment to cybersecurity, enhancing malware insights without restricting VirusTotal's open-access nature for the global community.^[4]^[19]

Recent Developments and 2025 Updates

In January 2018, VirusTotal was transferred to Chronicle, Alphabet's dedicated cybersecurity company, to enhance its focus on enterprise-grade threat intelligence and leverage advanced analytics for malware detection.^[20] This move allowed VirusTotal to integrate more deeply with Chronicle's security data platform, emphasizing scalable threat hunting capabilities for organizations.^[20] In June 2019, Chronicle was absorbed into Google Cloud, positioning VirusTotal as a core component of the broader cloud security ecosystem and enabling seamless integration with Google Cloud's threat detection services.^[21] This integration expanded VirusTotal's access to vast computational resources, improving its role in feeding malware intelligence into Google Cloud offerings for enhanced global cybersecurity.^[22] VirusTotal Enterprise was launched in September 2018, providing 100 times faster searches and advanced querying options tailored for enterprise users, including customizable malware analysis and private graph features for sensitive data handling.^[23] In 2025, VirusTotal introduced simplified pricing tiers to broaden accessibility, including free public access via the Community Tier, a Contributor Tier for active community participants offering enhanced quotas, and paid enterprise tiers starting at approximately $5,000 annually for high-volume API access.^[24] New features rolled out this year include Threat Actor profiles for detailed attribution of malicious campaigns and gti_assessment scores to evaluate indicators of compromise (IoCs) based on Google Threat Intelligence metrics, aiding users in prioritizing threats.^[25] In October 2025, VirusTotal announced a streamlined access model that rewards contributors—such as security vendors submitting samples—with quota exemptions for manual web-based searches, ensuring no consumption limits for qualifying non-API interactions throughout the month.^[24] In early November 2025, VirusTotal launched the "Month of VTSearch" campaign on November 3, providing all customers with uncapped searches via the web interface for the entire month to encourage exploration and sharing of threat intelligence.^[26] On November 10, the platform introduced the VTPRACTITIONERS series, a new initiative featuring collaborative technical research, starting with a post on tracking threats like FileFix, Shadow Vector, and SideWinder in partnership with Acronis.^[27]

Functionality

Core Scanning Capabilities

VirusTotal's core scanning service enables users to upload files up to 650 MB in size, along with URLs, IP addresses, or domains, for analysis against more than 70 antivirus engines and multiple URL/domain blocklisting services.^[28]^[1] This aggregation allows for a comprehensive second opinion on potential threats by leveraging diverse detection methodologies from leading security vendors. Launched in 2004 as a simple aggregator of antivirus results, the service has expanded significantly, growing from initial multi-engine scanning to its current scale of over 70 engines.^[2]^[1] Upon submission, VirusTotal generates detailed reports that include detection ratios, such as the number of engines flagging an item as malicious out of the total scanned (e.g., "40/70 engines detect as malicious"), alongside file hashes like MD5 and SHA-256 for identification and tracking.^[29] These reports also incorporate summaries of behavioral analysis, highlighting runtime activities observed in controlled environments.^[30] For files, scans encompass static analysis, which examines signatures and structural elements without execution, and dynamic analysis, which monitors behavior within sandboxes to detect actions like network connections or file modifications.^[31] URL scans similarly assess for malicious redirects, embedded threats, and blocklist matches.^[1] The free public interface imposes limits, such as a rate of 4 scans per minute and 500 requests per day via the API, to manage resource usage, while premium subscriptions provide unlimited access for higher-volume needs.^[17] This tiered model supports both individual users and enterprises in routine threat verification.

Advanced Tools and Integrations

VirusTotal provides advanced tools that extend beyond basic file and URL analysis, enabling security professionals to perform proactive threat hunting and automate workflows. One key feature is support for YARA rules, a pattern-matching language for identifying and classifying malware samples based on textual or binary patterns. Users can create and apply custom YARA signatures to scan files, URLs, or behaviors detected in core scanning results, facilitating targeted detection of specific threats like ransomware variants or command-and-control infrastructure.^[32]^[33] In 2025, VirusTotal enhanced YARA capabilities with Google Threat Intelligence (GTI)-curated rules focused on high-impact vulnerabilities and malware families observed in incident response engagements.^[34] As of November 2025, additional YARA rules were released for 19 new malware families (such as FIREPLUG and BADTILE) and updates to over 40 existing families, along with Agentic AI capabilities for generating YARA-L rules based on detections.^[35]^[36] The platform's API endpoints allow programmatic access for advanced operations, including uploading files or URLs for scanning, retrieving detailed reports, and downloading samples for further analysis. Enterprise users benefit from private scanning endpoints, which enable confidential analysis without sharing data publicly, ensuring compliance in sensitive environments.^[37]^[31] These APIs support automation of rescans, enrichment of indicators of compromise (IoCs), and integration into custom scripts, with rate limits differentiated between public and premium tiers to accommodate high-volume queries.^[17] VirusTotal integrates seamlessly with various security ecosystems to streamline threat detection and response. It connects with Security Information and Event Management (SIEM) systems, such as Google Security Operations, for automated IoC enrichment and alerting on suspicious domains or hashes.^[38] Endpoint Detection and Response (EDR) and Endpoint Protection Platforms (EPP) can leverage VirusTotal data to validate alerts in real-time, while ties to Google Cloud services enable scalable workflows for threat intelligence sharing across cloud-native environments.^[39]^[40] A comprehensive list of certified integrations includes SOAR platforms, XDR tools, and email gateways, allowing organizations to embed VirusTotal's multi-engine verdicts into broader security operations.^[40] In 2025, VirusTotal introduced innovations to bolster its advanced toolkit, including crowdsourced AI engines that augment traditional scanning with machine learning-based analysis. A notable addition is the Exodia Labs engine, specialized in evaluating Chrome extensions (.CRX files) for malicious behaviors like data exfiltration or unauthorized permissions, providing an independent AI verdict alongside existing tools.^[41] Further AI advancements in November 2025 include a new Code Insight endpoint for natural language code analysis and enhanced Agentic AI for documentation queries using retrieval-augmented generation.^[35] The platform also launched generally available Threat Profiles, offering curated reports on threat actors and campaigns, with detailed timelines, associated IoCs, and YARA rules derived from Mandiant investigations and GTI trends.^[42] Dynamic analysis was improved with CAPE sandbox updates for extracting and submitting unpacked payloads, enabling better visibility into nested threats via parent-payload relationships and a new 'tag:payload' search modifier.^[35] Contributor features encourage community participation by allowing users to upload novel samples, enriching the collective dataset for improved global detections. The 2025 Contributor Tier formalizes perks for active participants, such as antivirus providers and researchers, granting higher API quotas, access to advanced YARA hunting interfaces, private scanning privileges, and direct file downloads without consumption limits on manual web searches.^[24]^[43] This tier incentivizes submissions of detection engines, custom rules, and threat intelligence, fostering a collaborative ecosystem while preventing abuse through moderated upload policies.^[43]

Ownership and Operations

Corporate Evolution and Current Structure

VirusTotal's corporate trajectory solidified following its acquisition by Google in 2012, which provided the foundation for long-term stability and integration into broader cybersecurity initiatives. Since 2019, following the merger of Chronicle into Google Cloud, VirusTotal has operated as a core component of the Chronicle security suite within Google Cloud, enhancing enterprise-grade threat detection and intelligence capabilities.^[44]^[45] The platform maintains its operational headquarters in Dublin, Ireland, at Gordon House on Barrow Street, where teams specialize in threat intelligence analysis and platform maintenance to ensure reliable scanning and data processing services.^[46] VirusTotal's internal organization fosters collaboration across engineering groups responsible for developing and updating the scanning infrastructure, research teams dedicated to advancing threat detection methodologies, and liaison units that facilitate integration with external security ecosystems. VirusTotal employs a dual revenue model, offering a free tier accessible to the public and subsidized by Google to support community-driven threat sharing, alongside paid enterprise subscriptions that provide advanced features such as VT Duet for high-volume, large-scale threat analysis and customized intelligence queries.^[47]^[48]^[24] In 2023, VirusTotal experienced a brief data exposure incident when an employee accidentally uploaded a CSV file containing metadata—such as names and email addresses—from approximately 5,600 premium accounts, prompting immediate remediation and the implementation of strengthened privacy protocols to prevent future human-error-related breaches.^[49]^[50]

Partnerships with Antivirus Providers

VirusTotal collaborates with over 70 antivirus vendors to deliver multi-engine scanning, aggregating real-time detection results from engines such as those developed by Kaspersky, McAfee, and Symantec.^[1] This integration allows submitted files, URLs, and other artifacts to be analyzed across a diverse set of proprietary scanning technologies, providing users with a consensus-based view of potential threats without relying on a single provider's perspective.^[51] Vendor participation in VirusTotal operates on a voluntary basis, where antivirus companies contribute their detection signatures and rules to the platform while gaining access to anonymized samples submitted by the global community.^[9] This reciprocal model enables partners to improve their engines by incorporating novel threat intelligence derived from the aggregated dataset, fostering collective advancements in malware detection.^[52] Early contributors like Avast and ESET have played significant roles in establishing this ecosystem, offering robust scanning capabilities that complement the platform's core functionality.^[53] In 2025, VirusTotal expanded its partnerships to include AI-focused engines, such as Exodia Labs' specialized analyzer for Chrome extension files, enhancing detection of emerging threats through crowdsourced machine learning models.^[41] These collaborations provide partners with substantial benefits, including exposure to a vast, real-time global threat corpus for training and refining AI-driven defenses, all while maintaining sample anonymity to protect user privacy.^[54] To further support integrations, VirusTotal offers the Augment OEM program, which allows third-party providers to embed compliant VirusTotal widgets and threat context directly into their products, streamlining response times and enriching end-user security offerings.^[55] Google Cloud's ownership underpins these partnerships by enabling scalable infrastructure for handling high-volume data exchanges and computations.^[56]

Usage and Impact

User Applications and Community Role

VirusTotal serves a diverse user base, including individual users who upload files and URLs for quick verification against multiple antivirus engines, security researchers analyzing potential threats in depth, and IT administrators integrating scans into routine network monitoring workflows.^[45]^[57] Enterprise teams particularly rely on its advanced features for proactive threat hunting, enabling them to query vast datasets for indicators of compromise during security operations.^[58] Users apply VirusTotal in practical scenarios such as pre-execution checks to assess malware risks before running suspicious files, rapid incident response to investigate breaches by scanning artifacts like IPs and domains, and educational contexts where cybersecurity trainees learn to interpret scan results and hunt for threats.^[59]^[60]^[61] The platform's community plays a pivotal role through collective contributions, with users submitting over two million files daily as of 2023 to build shared intelligence on emerging threats and help identify false positives by reporting erroneous detections to antivirus vendors.^[62]^[1]^[63] This collaborative model allows participants to comment on analyses, rate files, and share insights like disinfection steps, enhancing the overall accuracy and utility of the service for all.^[64] In 2025, VirusTotal introduced a Contributor Tier to incentivize active participation, rewarding submitters and partners who provide detection engines or rules with benefits including free access to blindspot feeds, tiered discounts on premium features, priority support, and early previews of new tools, thereby encouraging sustained community involvement.^[24]^[48] In November 2025, the platform further enhanced user access by offering uncapped searches through the web interface for all customers, along with AI-powered Code Insight tools for analyzing never-before-seen binaries, such as Mach-O files for macOS and iOS, improving efficiency for researchers and incident responders.^[26]^[65] Annually, VirusTotal processes hundreds of millions of files through user submissions, contributing to a cumulative dataset exceeding 50 billion files that researchers can access via APIs and intelligence tools for advanced threat studies.^[62]^[66]

Contributions to Global Cybersecurity

VirusTotal has played a pivotal role in early threat detection by enabling the identification of malware samples prior to widespread outbreaks, largely through community-submitted files analyzed by its multi-engine scanning platform. For instance, the first known samples of the WannaCry ransomware were uploaded to VirusTotal in February 2017, several months before the global attack in May that affected over 200,000 systems across 150 countries.^[67] This early visibility allowed security researchers and vendors to study and develop mitigations ahead of the exploit's proliferation via the EternalBlue vulnerability.^[68] The platform significantly contributes to cybersecurity research by providing access to vast, aggregated datasets of file and URL analyses, which support academic studies and enable antivirus vendors to refine their detection algorithms. Researchers frequently leverage VirusTotal's reports to label malware families, analyze evasion techniques, and train machine learning models, fostering improvements in global threat intelligence sharing. This collaborative ecosystem has indirectly reduced malware prevalence by accelerating signature updates and behavioral analysis across the industry, as evidenced by the platform's integration into numerous peer-reviewed studies on ransomware and phishing trends.^[69] The user community serves as a key source of shared intelligence, submitting diverse samples that enrich these datasets without direct attribution.^[66] In the enterprise sector, VirusTotal enhances organizational defenses through seamless integrations with security tools, allowing automated enrichment of indicators of compromise (IoCs) in real-time workflows. Official plugins for platforms like Splunk enable log correlation with VirusTotal's threat data, streamlining incident response and reducing investigation times for security operations centers.^[70] Similarly, Microsoft incorporates VirusTotal reports into its Defender ecosystem and Sentinel for broader threat context, empowering enterprises to bolster endpoint protection and SIEM capabilities against sophisticated attacks.^[71] As of October 2025, VirusTotal introduced enhancements to its IoC assessment scoring, incorporating factors such as threat actor motivations and malware family attributes to provide more nuanced risk evaluations across files, URLs, domains, and IPs.^[42] Additionally, curated campaign reports in the platform's interface facilitate tracking of advanced persistent threats (APTs) by linking related IoCs and activities over time, aiding analysts in dissecting complex operations like those attributed to state-sponsored groups.^[72] Despite these advancements, VirusTotal faces criticisms regarding the potential for false positives, where benign files are flagged due to overzealous engine heuristics, leading to unnecessary alerts in enterprise environments.^[63] Its reliance on consensus from multiple antivirus vendors can also result in detection gaps for novel threats not yet recognized by the majority, underscoring the need for complementary tools in comprehensive security strategies.^[45]

Technical Aspects

Detection Methods and Engines

VirusTotal employs a multi-engine approach to malware detection, aggregating scan results from over 70 third-party antivirus engines and URL/domain blocklisting services to provide a comprehensive assessment of submitted files, URLs, and other artifacts.^[1] These engines utilize diverse techniques, including signature-based detection, which matches files against databases of known malware hashes and patterns updated in real-time; heuristic analysis, which identifies suspicious code structures or behaviors indicative of potential threats; and machine learning models that learn from vast datasets to detect anomalies without relying on exact matches.^[1]^[73] This aggregation leverages partnerships with antivirus providers to ensure broad coverage, though VirusTotal itself does not generate independent verdicts but rather compiles external results.^[74] The analysis pipeline at VirusTotal encompasses static, dynamic, and network-based methods to thoroughly examine submissions. Static analysis begins with hash computation (e.g., MD5, SHA-256) for rapid comparison against a repository of over two billion previously analyzed files, enabling quick identification of known threats without execution.^[75] It further involves file disassembly and extraction of structural features, such as PE headers for executables or metadata in documents, to feed into engine scans for signature and heuristic evaluation.^[1] Dynamic analysis complements this by executing samples in isolated sandbox environments, including in-house Windows, macOS, Android, and Linux sandboxes, to observe runtime behaviors like file modifications, registry changes, and API calls.^[30] Network behavior monitoring during sandbox execution captures outbound connections, DNS queries, and traffic patterns, revealing command-and-control communications or data exfiltration attempts.^[76] External sandboxes from partners, such as Tencent HABO, are also integrated to provide additional behavioral insights across platforms.^[77] Detection outcomes are quantified through metrics that highlight consensus and relatedness among samples. The primary metric is the detection ratio, expressed as the number of engines flagging a sample as malicious divided by the total engines scanned (e.g., 45/72), offering a probabilistic view of threat likelihood based on collective engine agreement.^[1] Certain engines, such as CrowdStrike's machine learning component, append confidence scores to their verdicts, ranging from 0% to 100%, to indicate the model's certainty in its classification.^[78] For grouping related threats, VirusTotal applies similarity clustering using algorithms like ssdeep for fuzzy hashing, imphash for import tables, and custom structural hashes on file types including PE executables, PDFs, and Office documents, enabling the identification of malware families or variants through shared code segments or behaviors.^[79]^[80] Since its inception in 2004 as a basic aggregator of rule-based antivirus scans focused on signature matching, VirusTotal's detection capabilities have evolved significantly, incorporating advanced heuristics by the early 2010s and dynamic sandboxes to address zero-day threats that evade static methods.^[81] By 2017, integration of external behavioral analysis tools expanded dynamic monitoring, while recent developments through 2025 have augmented the platform with AI-driven engines, including crowdsourced machine learning models like those from Exodia Labs for specialized file types such as Chrome extensions.^[76]^[82] These behavioral sandboxes play a crucial role in zero-day detection by simulating real-world execution to uncover evasive malware that mutates signatures or delays activation.^[30] Despite these advancements, VirusTotal's reliance on third-party engines introduces inherent limitations, as no single engine achieves perfect accuracy, leading to potential false positives from overzealous heuristics or false negatives from undetected variants.^[83] The consensus model, derived from detection ratios, mitigates errors by emphasizing majority agreement but cannot eliminate discrepancies arising from engine-specific biases or incomplete coverage, particularly for obfuscated or packed binaries.^[74]^[84]

Data Handling and Privacy Measures

VirusTotal implements robust data retention policies to balance threat intelligence sharing with user privacy. For public file and URL submissions, samples are stored in the shared database indefinitely to support ongoing community-driven malware detection and research, though users can request expedited deletion for files containing sensitive information via support channels. In contrast, private scanning—available to premium and enterprise users—limits retention to configurable periods, typically 24 hours by default but extendable up to 28 days, after which files and reports are automatically and permanently deleted from VirusTotal's systems. These policies ensure that non-shared analyses do not contribute to the public dataset while allowing temporary access for immediate threat assessment.^[31]^[85] To protect user privacy, VirusTotal employs anonymization techniques during data processing and sharing. User IP addresses are collected for service operation and security but are masked or pseudonymized before any aggregation or distribution to partners. Submitted files undergo automated stripping of identifiable personal information, such as metadata containing names or locations, prior to forwarding to antivirus vendors for analysis. This approach prevents the exposure of sensitive details while enabling collaborative scanning across over 70 engines. Private scanning further enhances privacy by isolating submissions entirely, ensuring they are not shared with external parties or added to the public repository.^[31]^[86] In July 2023, VirusTotal encountered an accidental data exposure incident when an employee uploaded a CSV file containing contact details (names, emails, countries, and account IDs) of approximately 5,600 premium customers, which was inadvertently indexed and made searchable to other premium users for a brief period. The file did not include passwords, API keys, or file samples, and the issue stemmed from human error rather than a cyberattack or platform vulnerability. VirusTotal responded swiftly by removing the file, notifying affected customers, and conducting a comprehensive internal audit that led to enhanced encryption protocols, stricter access controls, and the introduction of expanded opt-out mechanisms for submission sharing in both public and private modes. These measures have since been integrated into standard operations to mitigate similar risks.^[49]^[87] VirusTotal maintains compliance with major privacy regulations, including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as outlined in its privacy policy. The platform explicitly states that it does not sell user personal information or submitted samples; instead, it shares only anonymized, aggregated insights derived from collective analyses to advance cybersecurity research and threat detection without compromising individual privacy. Such aggregated data supports broader ecosystem improvements, like identifying emerging malware trends, while prohibiting commercial monetization of raw user submissions.^[86] Security is foundational to VirusTotal's data handling, with all communications enforced over HTTPS to encrypt data in transit and protect against interception. API access, essential for integrations and automated queries, requires unique keys that grant specific privileges and must be safeguarded by users, with rate limiting and monitoring to prevent abuse. As a Google-owned service, VirusTotal benefits from routine vulnerability scanning, penetration testing, and adherence to industry standards like ISO 27001, ensuring proactive identification and remediation of potential weaknesses in its infrastructure.^[88]

References

[1]
How it works
### Summary of How VirusTotal Works
[2]
We Made It, Together: 20 Years of VirusTotal!
May 30, 2024 · VirusTotal is turning 20 on June 1st! As we sit down to write this, we're filled with a mix of pride and gratitude. It's been an incredible journey.
[3]
A deep dive into the evolution of VirusTotal - Devoteam
VirusTotal, launched in 2004, was the brainchild of two visionary Spanish security researchers, Julio Canto and Bernardo Quintero. Their mission was clear: to ...
[4]
An update from VirusTotal
Sep 7, 2012 · VirusTotal was acquired by Google, which will improve malware research tools and ensure they are always ready.Missing: history | Show results with:history<|separator|>
[5]
Google Acquires VirusTotal - Analyst Blog - Nasdaq
Sep 11, 2012 · Google Inc. ( GOOG ) recently announced that it has acquired an anti-malware start-up company VirusTotal to beef up protection for its Internet ...
[6]
VirusTotal - Home
### Summary of VirusTotal
[7]
Google Cloud Platform Terms Of Service
Legal documentation for Google Cloud Platform.
[8]
Full Disclosure: About VirusTotal/Hispasec - Seclists.org
Sep 3, 2004 · The program were developed as an inner-use tool for our laboratory to keep monitorized update responses of AV engines against new malware, ...Missing: history early voluntary challenges
[9]
Maintaining a healthy community - VirusTotal Blog
May 4, 2016 · VirusTotal was born 12 years ago as a collaborative service to promote the exchange of information and strengthen security on the internet.Missing: history Hispasec voluntary challenges
[10]
Book Review: Infected - A Candid Look at VirusTotal's Birth and ...
Jan 22, 2025 · For security professionals, the real heart of Infected comes in the chapters “VirusTotal: The Origin of the Idea” and “The Birth of VirusTotal.
[11]
Google Acquires Online Virus, Malware and URL Scanner VirusTotal
Sep 7, 2012 · VirusTotal, an online malware and virus scanner, was just acquired by Google. The company already used a number of Google services ahead of the acquisition.
[12]
Google buys cybersecurity startup VirusTotal | Reuters
Sep 7, 2012 · Google buys cybersecurity startup VirusTotal. By Reuters. September 7, 20128:48 PM UTCUpdated September 7, 2012.
[13]
Google Buys VirusTotal - eSecurity Planet
Sep 7, 2012 · VirusTotal today announced that it has been acquired by Google. “VirusTotal was set up in 2007 and uses over 40 different antivirus engines to scan files and ...
[14]
Google and VirusTotal: A win for the security industry - Trend Micro
Sep 7, 2012 · Google's massive infrastructure is much more stable than the existing stand-alone VirusTotal infrastructure and we believe it will be much ...
[15]
Public API request rate limits and tool development - VirusTotal Blog
Dec 13, 2012 · One of the ways we envisioned increased submissions to VirusTotal was through the release of our public API. ... Anonymous January 16, 2013 at 4: ...Missing: launched | Show results with:launched
[16]
VirusTotal releases file-scanning tool powered by 50-plus AV ...
May 27, 2014 · VirusTotal released a new application that allows Mac OS X users to scan suspicious files with more than 50 antivirus engines supported by the service.
[17]
Public vs Premium API - VirusTotal documentation
The only thing you need in order to use the Public API is to sign up to VirusTotal Community and obtain your API key as described in Getting started. ❗️. Public ...
[18]
Why Google bought VirusTotal - Computerworld
Sep 10, 2012 · Google has plenty of reasons to want better URL and download analysis…[like] beefing up Chrome's defenses…making things difficult for ...Missing: rationale | Show results with:rationale
[19]
Why Google Acquired VirusTotal - SecurityWeek
Sep 19, 2012 · The search giant announced that it had acquired VirusTotal, an anti-malware start-up company to beef up protection for its Internet services.<|control11|><|separator|>
[20]
VirusTotal and Chronicle
Jan 24, 2018 · Today we have another update: VirusTotal will moving to become part of Chronicle, a new Alphabet company focused on cyber security. This update, ...
[21]
VirusTotal, Chronicle and Google Cloud
Jun 27, 2019 · It's been more than seven years since Google acquired VirusTotal, and more than one year since we moved to Chronicle.Missing: transfer | Show results with:transfer
[22]
Google Cloud + Chronicle: The security moonshot joins Google Cloud
Jun 27, 2019 · Chronicle's VirusTotal malware intelligence services will be a powerful addition to the pool of threat data informing Google Cloud offerings, ...<|separator|>
[23]
Alphabet's Chronicle launches an enterprise version of VirusTotal
Sep 27, 2018 · VirusTotal says that it plans to “continue to leverage the power of Google infrastructure” and expand this enterprise service over time. Google ...Missing: improvements | Show results with:improvements
[24]
Simpler Access for a Stronger VirusTotal
Oct 8, 2025 · It ensures continuous access to VT feeds, priority support, and early access to new features. This tier recognizes their essential role in ...Missing: challenges limited resources voluntary Hispasec
[25]
Release Notes - Google Threat Intelligence - VirusTotal
This update prioritizes malware families actively observed in Mandiant incident response engagements, SecOps customer environments, and top GTI search trends.
[26]
Get a URL for uploading large files
📘 Notice that although the actual size limit is 650MBs, files larger than 200MBs tend to be bundles of some sort, (compressed files, ISO images, etc.) in these ...
[27]
Reports - VirusTotal documentation
VirusTotal provides reports for URLs, files, domains, and IP addresses. URL reports include summary and details, while file reports have summary and details. ...Missing: capabilities | Show results with:capabilities
[28]
In-house Sandboxes - behavioural analysis products
VirusTotal uses in-house sandboxes to trace file activities, including MacOS, Android, and Windows sandboxes, producing detailed reports.
[29]
Private Scanning - VirusTotal documentation
Private Scanning lets you scan files/URLs with VirusTotal without sharing them beyond your organization, and the analysis is only visible to your group.
[30]
VirusTotal/yara: The pattern matching swiss knife - GitHub
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of ...Releases · Issues 155 · Pull requests 21 · Discussions
[31]
Learning resources - Advanced hunting - VirusTotal
VirusTotal's advanced hunting uses LiveHunt to find new threats, RetroHunt to find early attacks, and YARA rules to monitor suspicious activity.Missing: 2025 | Show results with:2025<|control11|><|separator|>
[32]
March 18th, 2025 - GTI-G YARA rules, track relevant vulnerabilities ...
Mar 18, 2025 · New features include curated YARA rules, vulnerability tracking, categorized threat lists, private URL scanning, and private scanning in UK ...
[33]
VirusTotal API v3 Overview
API version 3 is now the default and encouraged way to programmatically interact with VirusTotal. It greatly improves API version 2, which, ...Public vs Premium API · API responses · List of VT Integrations · Getting started
[34]
Integrate VirusTotal with Google SecOps | Google Security Operations
This document explains how to integrate VirusTotal with Google Security Operations (Google SecOps). Integration version: 39.0.
[35]
Google Threat Intelligence
Integrate checks for malicious behavior and relevant threat information into your security technologies (EDR, SIEM, SOAR, etc.).Missing: endpoint | Show results with:endpoint
[36]
List of Google TI Integrations - Google Threat Intelligence - VirusTotal
List of Google TI Integrations · SOAR Platforms · SIEM/XDR/TDR/Security Analytics Platforms · EDRs / EPPs / Nextgens / AVs / Endpoint Agents · TIP Platorms · Email ...
[37]
Crowdsourced AI += Exodia Labs - VirusTotal Blog
Oct 1, 2025 · We're adding a new specialist to VirusTotal's Crowdsourced AI lineup: Exodia Labs, with an AI engine focused on analyzing Chrome extension ( ...
[38]
October 20th, 2025 Threat Profiles GA, Agentic Public Preview ...
Oct 20, 2025 · YARA Rules are a powerful, pattern-matching tool used by security professionals to identify and classify malware and suspicious files. We are ...
[39]
VirusTotal Updates Platform With Unified Access and Contributor ...
Oct 9, 2025 · The revamped pricing structure comprises Community, Lite, Contributor, and Duet tiers, each tailored to distinct user groups. The Community Tier ...Missing: Actor profiles gti_assessment
[40]
VirusTotal - Wikipedia
VirusTotal is a website created by the Spanish security company Hispasec Sistemas. Launched in June 2004, it was acquired by Google in September 2012.
[41]
Google Cloud Absorbs Chronicle for Backstory, VirusTotal ...
Jun 27, 2019 · Google Cloud will absorb Chronicle, a sister cybersecurity company that develops Chronicle for SIEM & VirusTotal for malware & virus ...
[42]
VirusTotal Overview: How to Conduct Your Own Malware Scans
May 3, 2025 · VirusTotal is a free malware scanning service that checks files, URLs, IP addresses, and domains against dozens of antivirus engines and threat intel feeds.Missing: acquisition 2012-2017
[43]
VirusTotal - 2025 Company Profile, Team & Competitors - Tracxn
Aug 2, 2025 · VirusTotal is an acquired company based in Dublin (Ireland), founded in 2004 by Bernardo Quintero. It operates as a Free online virus, malware and url scanner.Missing: history | Show results with:history
[44]
Services overview - VirusTotal
Enterprise. Get smarter, be safer, outsmart attackers. Our offering provides the information your security team needs to protect your network from threats.Missing: 2015 2016
[45]
VirusTotal Introduces Simplified Platform Access and New ...
Oct 9, 2025 · VirusTotal, the collaborative malware analysis platform, has announced a major update to simplify access and reward contributors.
[46]
Apology and Update on Recent Accidental Data Exposure
Jul 21, 2023 · On June 29, an employee accidentally uploaded a CSV file to the VirusTotal platform. This CSV file contained limited information of our Premium account ...
[47]
VirusTotal Data Leak Exposes Some Registered Customers' Details
Jul 18, 2023 · The security incident, which comprises a database of 5,600 names in a 313KB file, was first disclosed by Der Spiegel and Der Standard yesterday.
[48]
Contributors
This page acknowledges all companies and individuals that have integrated a product, tool or resource with VirusTotal, or who have contributed in other ways.Missing: tier 2025 perks
[49]
Antivirus Partners - VirusTotal documentation
VirusTotal Monitor Partner's aim is to ease false positive handling by antivirus companies. It is designed to provide VirusTotal participating AV scanners ...
[50]
File - List of Engines
The list is subject to changes as new antivirus solutions are integrated in VirusTotal and existing ones change names so do not forget to visit it every once in ...
[51]
[PDF] VIRUSTOTAL: CROWDSOURCED INTELLIGENCE FOR EVERYONE
VirusTotal is a rich, interlinked and close-to-real-time crowdsourced malware corpus. By including security data coming in from over 70 security vendors, ...
[52]
[PDF] VirusTotal Augment OEM Program - Google Chronicle
VirusTotal was acquired by Google in 2012 and now operates under Google Cloud. ... coming from 70+ security vendors, including antivirus solutions, security ...Missing: 2012-2017 engines
[53]
Google Threat Intelligence - know who's targeting you
Focus on the most relevant threats to your organization by understanding the threat actors and their ever changing tactics, techniques, and procedures (TTPs).
[54]
Learning resources - VirusTotal
VirusTotal Intelligence lets you hunt for malware threats that affect your networks. You are probably familiar with VirusTotal as a basic malware research tool.Missing: admins | Show results with:admins
[55]
Chronicle Accelerates Threat Hunting With VirusTotal Enterprise
Alphabet's Chronicle security division announced the launch of VirusTotal Enterprise on Sept. 27, providing security professionals with new tools and ...Missing: growth 2007 2010
[56]
VirusTotal - Home
Not the results you expected? Take a look at all our modifiers. You can also automate your searches. Log in to your account. Sign in. New?Virus TotalFree Online Virus, Malware ...URLVirusTotal API v3 OverviewMobile Apps
[57]
Incident response and Forensic analysis - VirusTotal
Learn how malware analysts use a combination of VirusTotal Graph, VirusTotal ... malware investigation, including Incident Response and Forensic Analysis.Missing: pre- execution checks educational
[58]
Learning resources - VirusTotal
The VirusTotal API lets you upload and scan files or URLs, access finished scan reports and make automatic comments and much more without the need of using the ...
[59]
[PDF] VirusTotal Malware Trends Repo rt: Emerging Formats and Delivery ...
Jul 23, 2023 · Over the last 19 years, we have processed more than two million files per day across 232 territories. VirusTotal also harnesses contributions of ...
[60]
I am experiencing a false positive, my file or site should not be ...
If you are experiencing a false positive issue, you should notify the problem to the company producing the erroneous detection, they are the only ones that can ...Missing: daily | Show results with:daily
[61]
Join Community
VirusTotal community lets you rate and place comments on files and websites. Comments can be of any nature: disinfection instructions, in-the-wild locations, ...Missing: daily | Show results with:daily
[62]
Exploring the VirusTotal Dataset | An Analyst's Guide to Effective ...
Aug 29, 2024 · The VirusTotal platform analyzes files and network-related artifacts (URLs, domains, and IPs) submitted to the platform to detect maliciousness.
[63]
Ransomware as a Predator: Modelling the Systemic Risk to Prey
First WannaCry samples were seen in VirusTotal in February 2017. •. Microsoft release SMB updates for supported OS's (not Windows XP or 2003) in March 2017 ...
[64]
Looking at Big Threats Using Code Similarity – part 1 - Securelist
Jun 9, 2020 · The two samples Neel refers to in the post were: A WannaCry sample from February 2017 which looks like a very early variant; A Lazarus APT group ...
[65]
A Deep Dive into the VirusTotal File Feed - ResearchGate
Aug 7, 2025 · As the most popular online scanner, VirusTotal (VT) is often used for determining if samples are malicious, labeling samples with their family, ...
[66]
VT4Splunk, official VirusTotal app for Splunk
VT4Splunk automatically enriches your Splunk logs with threat intelligence coming from VirusTotal. It allows you to contextualize IoCs.
[67]
VirusTotal Multisandbox += Microsoft Sysinternals
Oct 20, 2021 · Microsoft uses VirusTotal reports as an accurate threat intelligence source, and VirusTotal uses detections from Microsoft Defender Antivirus ...
[68]
Campaigns - Google Threat Intelligence - VirusTotal
In the Campaigns tab, click Follow for any Campaign to monitor changes to the selected Campaigns over time, such as new activity, associations or IoCs. To add ...<|control11|><|separator|>
[69]
CrowdStrike Machine Learning and VirusTotal
Aug 25, 2016 · Traditional AV engines look for signatures or heuristics, i.e. sequences of specific bytes in the file. A malware author can easily change ...
[70]
False Positive Contacts
If the false positive is for a File or a URL try re-scanning first. If the false positive persists please reach out to the vendor that is producing it providing ...
[71]
Files - VirusTotal documentation
Only available for Premium API users. first_submission_date : <integer> date when the file was first seen in VirusTotal. UTC timestamp. last_analysis_date ...<|control11|><|separator|>
[72]
Malware analysis sandbox aggregation: Welcome Tencent HABO!
Nov 9, 2017 · VirusTotal aggregates malware analysis reports, including Tencent HABO, which analyzes static and dynamic behaviors, and has analysis for ...
[73]
External behavioural engines sandboxes - VirusTotal documentation
VirusTotal incorporates various third party behavioural engines sandboxes to give a broad vision of indicators that can come from the different sandboxes in ...
[74]
CrowdStrike's Machine Learning Engine Becomes the First ...
The full machine learning engine is unique as it is also the first engine in VirusTotal to provide a confidence level as a result of its analysis.
[75]
/file/clusters
VirusTotal has built its own in-house file similarity clustering functionality. At present, this clustering works only on PE, PDF, DOC and RTF files.Missing: detection | Show results with:detection
[76]
Intelligence overview - VirusTotal
Dynamic analysis capabilities do not only focus on execution traces but also on running static+dynamic analysis plugins to decode RAT malware configs and ...
[77]
VirusTotal — Latest News, Reports & Analysis | The Hacker News
Launched in 2004, VirusTotal is a popular service that analyzes suspicious files and URLs to detect types of malware and malicious content using antivirus ...
[78]
2025 ~ VirusTotal Blog
We're adding a new specialist to VirusTotal's Crowdsourced AI lineup: Exodia Labs, with an AI engine focused on analyzing Chrome extension (.CRX) files.
[79]
A first shot at false positives - VirusTotal Blog
Feb 10, 2015 · These mistaken detections, commonly known as false positives, have all sorts of undesired effects: Software developers may face strong business ...Missing: limitations consensus model
[80]
[PDF] Limits of Machine Learning Classifiers Based on Static Analysis ...
Feb 23, 2020 · We observed that static machine-learning-based products on VirusTotal produce a high false positive rate on packed binaries, possibly due to the ...
[81]
I accidentally uploaded a file with confidential or sensitive ...
I accidentally uploaded a file with confidential or sensitive information to VirusTotal, can you please delete it?
[82]
Historic Privacy Policy - VirusTotal documentation
We may use aggregated, anonymized data that we derived from your personal information before you delete it, but not in a manner that incorporates any of ...
[83]
VirusTotal apologizes for data leak affecting 5,600 customers
Jul 21, 2023 · VirusTotal apologized on Friday for leaking the information of over 5,600 customers after an employee mistakenly uploaded a CSV file ...
[84]
Authentication
Your API key carries all your privileges, so keep it secure and don't share it with anyone. Always use HTTPS instead of HTTP for making your requests.