WIP: Addition of a timer to virustotal checks

src/mvt/android/cli.py

@@ -31,6 +31,7 @@
     HELP_MSG_HASHES,
     HELP_MSG_CHECK_IOCS,
     HELP_MSG_STIX2,
+    HELP_MSG_DELAY_CHECKS,
 )
 from mvt.common.logo import logo
 from mvt.common.updates import IndicatorsUpdates
@@ -78,13 +79,14 @@ def version():
 @click.option("--serial", "-s", type=str, help=HELP_MSG_SERIAL)
 @click.option("--all-apks", "-a", is_flag=True, help=HELP_MSG_DOWNLOAD_ALL_APKS)
 @click.option("--virustotal", "-V", is_flag=True, help=HELP_MSG_VIRUS_TOTAL)
+@click.option("--delay", "-d", type=int, default=16, help=HELP_MSG_DELAY_CHECKS)
 @click.option("--output", "-o", type=click.Path(exists=False), help=HELP_MSG_APK_OUTPUT)
 @click.option(
     "--from-file", "-f", type=click.Path(exists=True), help=HELP_MSG_APKS_FROM_FILE
 )
 @click.option("--verbose", "-v", is_flag=True, help=HELP_MSG_VERBOSE)
 @click.pass_context
-def download_apks(ctx, all_apks, virustotal, output, from_file, serial, verbose):
+def download_apks(ctx, all_apks, virustotal, output, from_file, serial, verbose, delay):
     set_verbose_logging(verbose)
     try:
         if from_file:
@@ -114,7 +116,11 @@ def download_apks(ctx, all_apks, virustotal, output, from_file, serial, verbose)
 
         if virustotal:
             m = Packages()
-            m.check_virustotal(packages_to_lookup)
+            if delay:
+                m.check_virustotal(packages_to_lookup, delay)
+            else:
+                delay = 0
+                m.check_virustotal(packages_to_lookup, delay)
     except KeyboardInterrupt:
         print("")
         ctx.exit(1)

src/mvt/android/modules/adb/packages.py

@@ -4,6 +4,7 @@
 #   https://license.mvt.re/1.1/
 
 import logging
+import time
 from typing import Optional, Union
 
 from rich.console import Console
@@ -109,7 +110,7 @@ def check_indicators(self) -> None:
                     self.detected.append(result)
 
     @staticmethod
-    def check_virustotal(packages: list) -> None:
+    def check_virustotal(packages: list, delay: int) -> None:
         hashes = []
         for package in packages:
             for file in package.get("files", []):
@@ -132,6 +133,8 @@ def check_virustotal(packages: list) -> None:
             if not results:
                 continue
 
+            time.sleep(delay)
+
             positives = results["attributes"]["last_analysis_stats"]["malicious"]
             total = len(results["attributes"]["last_analysis_results"])
 
@@ -303,7 +306,10 @@ def run(self) -> None:
             )
 
         if not self.module_options.get("fast_mode", None):
-            self.check_virustotal(packages_to_lookup)
+            if "delay" not in locals():
+                delay = 0
+
+            self.check_virustotal(packages_to_lookup, delay)
 
         self.log.info(
             "Extracted at total of %d installed package names", len(self.results)

src/mvt/common/help.py

@@ -40,6 +40,7 @@
     "Extract all packages installed on the phone, including system packages"
 )
 HELP_MSG_VIRUS_TOTAL = "Check packages on VirusTotal"
+HELP_MSG_DELAY_CHECKS = "Throttle virustotal checks to not exhaust the queries limit"
 HELP_MSG_APK_OUTPUT = "Specify a path to a folder where you want to store the APKs"
 HELP_MSG_APKS_FROM_FILE = (
     "Instead of acquiring APKs from a phone, load an existing packages.json file for "