Skip to content

Instantly share code, notes, and snippets.

@r00tten
Created January 4, 2022 23:03
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save r00tten/80ae416473416e8efb9dc84b70376465 to your computer and use it in GitHub Desktop.
Save r00tten/80ae416473416e8efb9dc84b70376465 to your computer and use it in GitHub Desktop.
r00tten@vti-cosplay VTI-Cosplay % python3 vti-cosplay.py -h
,(#*
,(#*.
*********(##* ,**********.
.%%#////////*, .,///////(%#,
.%%* *%#,
.%%* *%#,
.%%* *%#/,,,,,,
,(%%/. ,(((((((((.
./#%%%%%%#*
*#%%%%(,
/((((((((*. ,(*.
,,*,*,*#%/. .*(*.
.(%/. ./%/.
.(%/. ./%/.
.(%#///////*. .*/////////#%/.
**////////*. .#%#/////////,.
.##/
.##/
,,.
██╗ ██╗████████╗██╗ ██████╗ ██████╗ ███████╗██████╗ ██╗ █████╗ ██╗ ██╗
██║ ██║╚══██╔══╝██║ ██╔════╝██╔═══██╗██╔════╝██╔══██╗██║ ██╔══██╗╚██╗ ██╔╝
██║ ██║ ██║ ██║ █████╗ ██║ ██║ ██║███████╗██████╔╝██║ ███████║ ╚████╔╝
╚██╗ ██╔╝ ██║ ██║ ╚════╝ ██║ ██║ ██║╚════██║██╔═══╝ ██║ ██╔══██║ ╚██╔╝
╚████╔╝ ██║ ██║ ╚██████╗╚██████╔╝███████║██║ ███████╗██║ ██║ ██║
╚═══╝ ╚═╝ ╚═╝ ╚═════╝ ╚═════╝ ╚══════╝╚═╝ ╚══════╝╚═╝ ╚═╝ ╚═╝
usage: VTI-Cosplay [-h] -y YARA_FILE [-k API_KEY] [-l LIMIT] [-a ACTION]
[--livehunt] [-f] [-v] [-i I_DONT_TRUST_YOU]
optional arguments:
-h, --help show this help message and exit
-y YARA_FILE, --yara-file YARA_FILE
YARA file
-k API_KEY, --api-key API_KEY
Virustotal API key
-l LIMIT, --limit LIMIT
Limit total matched sample count
-a ACTION, --action ACTION
Action module to trigger for matched samples
--livehunt Create scheduled task for the YARA file provided. When
a new sample is out there it prints and stores
-f, --fast Fast scan by reducing the data that is transferred
-v, --verbose Verbose output
-i I_DONT_TRUST_YOU, --i-dont-trust-you I_DONT_TRUST_YOU
At the end, it downloads matched files and does YARA
scan against them
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment