Freedom251 › Malware Analysis Sandboxes
VirusTotal Intelligence
What VirusTotal Intelligence is
VirusTotal Intelligence searches a dataset for files using criteria such as hashes, antivirus detections, metadata, filenames, structural properties, and file size. Its documented tools also cover URL, domain, and IP searches, content search through VTGrep, and file similarity search. Results can be sorted by first seen, last seen, detection ratio, submissions, or size; selected results can be downloaded and hashes copied. Search depth depends on the tier: Standard tiers provide 90 days for advanced searches, Retrohunt, and VTGrep, while Threat Hunter PRO provides one year. Both tiers allow up to 10K Retrohunt matches per job. The private API supports combined property-based queries; public API search is limited to hash queries. Private API data can include integrated-tool file and URL information, sandbox behavioral data, and goodware signals. VirusTotal also documents integrations for security workflows, including VT4Splunk for enriching Splunk events. Pricing depends on usage and requires a quote. Indicators submitted or queried through the web interface are added to the dataset for community access.
Who it suits
The maker describes premium services as tools for qualified customers and antivirus partners seeking harmful file samples for further study. The documented search and integration features may suit security teams working with threat data and workflows.
What it does well
- Searches files using hashes and multiple file properties.
- Includes URL, domain, and IP search modifiers.
- Results can be sorted and selected files downloaded.
- Private API supports combined property-based queries.
- Documents integrations for security workflows.
What to know first
- No free plan is listed.
- Pricing requires a usage-based quote.
- Public API search is limited to hash queries.
- Web indicators are added to the dataset for community access.
Limits
Standard tiers provide 90 days for advanced searches, Retrohunt, and VTGrep, with up to 10,000 Retrohunt matches per job. Threat Hunter PRO extends those search periods to one year while keeping the same Retrohunt match limit.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Standard tiers | Pricing depends on usage; contact VirusTotal for a quote. · Advanced searches: 90 days · Retrohunt: 90 days, up to 10K matches per job · Content search (VTGrep): 90 days | On request |
| Threat Hunter PRO | Pricing depends on usage; contact VirusTotal for a quote. · Advanced searches: 1 year · Retrohunt: 1 year, up to 10K matches per job · Content search (VTGrep): 1 year | On request |
As virustotal.com lists them, read 9 Oct 2026. The maker's own page has the final word.
Getting started
- Open the VirusTotal web interface
- Choose web or API access
- Contact VirusTotal with your use case and usage estimates for a quote
- Select a Standard tier or Threat Hunter PRO
- Run searches through the web interface or API
Verdict
VirusTotal Intelligence offers multiple search methods and tiered historical periods, with API capabilities that differ between public and private access. Review the tier limits and avoid submitting sensitive, confidential, or personally identifiable indicators through the web interface.
Questions
Does VirusTotal Intelligence have a free plan?
No. VirusTotal Intelligence is listed as paid, with pricing available on request.
What platforms are supported?
It is available through web and API access.
How does pricing work?
Pricing depends on usage, and VirusTotal requires a quote based on your use case and usage estimates.
What is the difference between Standard tiers and Threat Hunter PRO?
Standard tiers provide 90-day advanced searches, Retrohunt, and VTGrep. Threat Hunter PRO provides one year for those search types; both allow up to 10,000 Retrohunt matches per job.
Can I use it commercially or for government work?
The private API is described as available for commercial or government use, with usage-based quoted pricing.
Are submitted indicators private?
Indicators submitted or queried through the web interface are scanned and added to the dataset for community access.
Facts from VirusTotal Intelligence's own pages
- API search limit
- The maker says public API search is limited to hash queries, while private API supports combined property-based queries. · docs.virustotal.com, 9 Oct 2026
- Commercial use
- The maker describes the private API as available for commercial or government use and says pricing depends on usage and requires a quote. · docs.virustotal.com, 9 Oct 2026
- Integrations
- VirusTotal documents third-party integrations for security workflows including alert triage, event enrichment, false-positive discarding, detection, and response. · docs.virustotal.com, 9 Oct 2026
- Intended users
- The maker describes premium services as tools for qualified customers and antivirus partners to search for and access harmful file samples for further study. · docs.virustotal.com, 9 Oct 2026
- Premium data
- The private API can include integrated-tool file and URL information, sandbox behavioral data, and goodware signals. · docs.virustotal.com, 9 Oct 2026
- Product
- VirusTotal Intelligence searches its dataset for files matching criteria such as hashes, antivirus detections, metadata, filenames, structural properties, and file size. · docs.virustotal.com, 9 Oct 2026
- Results
- Search results can be sorted by first seen, last seen, detection ratio, submissions, or size, and users can copy hashes or download selected results. · docs.virustotal.com, 9 Oct 2026
- Retrohunt
- The listed Standard tiers allow Retrohunt searches over 90 days and Threat Hunter PRO over one year, with up to 10K matches per job for both. · docs.virustotal.com, 9 Oct 2026
- Search scope
- Its documentation lists file, URL, domain, and IP search modifiers, content search (VTGrep), and file similarity search. · docs.virustotal.com, 9 Oct 2026
- Sensitive indicators
- The Intelligence documentation warns that indicators submitted or queried through the web interface are scanned and added to the dataset for community access, and advises against using sensitive, confidential, or personally identifiable information. · docs.virustotal.com, 9 Oct 2026
- Splunk
- VirusTotal lists VT4Splunk as its official Splunk app for automatically enriching Splunk events with VirusTotal threat intelligence. · docs.virustotal.com, 9 Oct 2026
- Support
- The maker directs users seeking pricing information to contact VirusTotal with their use case and usage estimates for a quote. · docs.virustotal.com, 9 Oct 2026
Where VirusTotal Intelligence stands on Freedom251
- Malware Analysis Sandboxes#19 of 27