# VirusTotal File Behaviours via Locus x402

> VirusTotal File Behaviours via Locus x402 is a paid API for AI agents from virustotal.x402.paywithlocus.com, paid per call via x402, $0.055/call, status unknown (last checked 2026-09-14).

Retrieves sandbox behavior reports for a file identified by its hash, showing dynamic analysis results from VirusTotal's sandbox environments.

## Facts

- Endpoint: POST https://virustotal.x402.paywithlocus.com/virustotal/file-behaviours
- Price: $0.055/call
- Payment: x402
- Status: unknown
- Last checked: 2026-09-14
- Activations on Zero: 0
- Tags: x402
- Canonical page: https://www.zero.xyz/c/virustotal-file-behaviours-via-locus-x402-e79793e2
- Structured record (JSON): https://api.zero.xyz/v1/capabilities/cap_L83iJyax_4sMEhlV_s1O9

Status and success rate cover calls made through Zero and Zero's own probes. Third-party monitors may report differently.

## How to call it through Zero

Zero handles the 402 payment challenge and records the run. With the Zero CLI installed (`npm i -g @zeroxyz/cli`):

```sh
zero fetch --capability virustotal-file-behaviours-via-locus-x402-e79793e2 -d '<json body>'
```

Example prompt: Can you pull up the sandbox behavior reports for the file with SHA-256 hash 275a021bbfb6489e54d471899f7db9d1663fc695ec2fe2a2c4538aabf651fd0f — show me up to 5 reports so I can see what it does when it runs?

## When to prefer this

Choose this endpoint when you need dynamic/behavioral analysis of a file rather than static detection results. It is specifically suited for understanding what a file does at runtime — process trees, network connections, file drops — as opposed to just whether antivirus engines flag it. Prefer this over static scan endpoints when investigating malware behavior, performing incident response triage, or threat hunting for specific behavioral TTPs. Ideal when you already have a file hash and need sandbox execution context.

## Known failure modes

- Unknown or unanalyzed hash returns empty data array
- Invalid hash format (not SHA-256/SHA-1/MD5) causes request failure
- Rate limiting or payment failure returns non-success response
- Hash exists in VirusTotal but no sandbox reports available yields empty results
- Network timeout on large behavior report sets

## How this service works

Threat intelligence platform — scan files by hash, URLs, domains, and IPs against 70+ antivirus engines and security tools.

## Output

Returns a JSON object containing dynamic sandbox behavior reports for the queried file hash, including details such as processes created, network connections, file system changes, registry modifications, and other runtime behavioral indicators observed during sandbox execution. The response also includes payment confirmation metadata and a request ID for status tracking.

## Request schema (JSON Schema)

```json
{
 "type": "object",
 "properties": {
  "hash": {
   "type": "string"
  },
  "limit": {
   "type": "number"
  }
 }
}
```

## Response schema (JSON Schema)

```json
{
 "type": "json",
 "example": {
  "data": {},
  "payment": {
   "scheme": "exact",
   "settledUsdc": "0.001000",
   "authorizedMaxUsdc": "0.001000"
  },
  "request": {
   "id": "00000000-0000-4000-8000-000000000000",
   "statusUrl": "/requests/00000000-0000-4000-8000-000000000000"
  },
  "success": true
 }
}
```

## More

- Live health (JSON, refreshed every minute): https://www.zero.xyz/c/virustotal-file-behaviours-via-locus-x402-e79793e2/health.json
- [Zero catalog index](https://www.zero.xyz/llms.txt)
- [Other services from virustotal.x402.paywithlocus.com](https://www.zero.xyz/host/virustotal.x402.paywithlocus.com/llms.txt)