malware-analysis
Malware Analysis guides you through identifying unknown binaries, unpacking obfuscated loaders, and safely detonating samples to recover fileless artifacts and in-memory payloads. Extract C2 configurations, detect beacon traffic patterns, and author low-false-positive detection rules from your findings.
Malware Analysis helps you reverse-engineer and unpack malware to recover real payloads, extract C2 configs, and detect threats.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/malware-analysis · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/malware-analysis ~/.claude/skills/malware-analysisnpx skillfed install hypnguyen1209/offensive-claude/malware-analysisFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to reverse engineer malware and unpack obfuscated samples?
Malware Analysis covers systematic reverse-engineering workflows to unpack obfuscated loaders and recover real payloads. Start with static triage—disassemble binaries, identify packing signatures, and apply deobfuscation techniques for .NET and native code. Use debuggers to step through unpacking stubs, then extract the decrypted payload. Malware Analysis guides you through each phase, from recognizing obfuscation patterns to safely isolating the true malware capabilities.
What is the malware analysis workflow for static triage?
Malware Analysis outlines a static triage workflow that begins with binary metadata inspection, entropy analysis, and import table review to classify samples without execution. Generate YARA detection rules from your findings to catch similar variants. Map observed techniques to ATT&CK, extract indicators of compromise (IOCs), and document behavioral signatures. This approach lets you safely assess unknown binaries and build repeatable detection logic before any dynamic analysis.
How do you extract C2 config from beacon and detect command-and-control beaconing?
Malware Analysis teaches C2 configuration extraction from beacon samples using memory forensics, pcap analysis, and config parsers. Analyze beacon cadence patterns, JA4 fingerprinting, and traffic signatures to identify command-and-control communications. Inspect memory dumps with Volatility 3 to recover in-memory C2 settings. Malware Analysis shows how to correlate beacon behavior with ATT&CK techniques and generate behavioral indicators for detection rules.
How can malware analysis detect fileless and in-memory malware artifacts?
Malware Analysis covers memory forensics techniques to detect fileless malware and in-memory payloads using Volatility 3 and memory dump analysis. Identify suspicious process injection, shellcode patterns, and encrypted payloads resident in RAM. Analyze AMSI and ETW bypass attempts to understand evasion tactics. Extract artifacts without touching disk, then map findings to ATT&CK behaviors and generate low-false-positive detection rules from your observations.
What tools and frameworks does malware analysis recommend for safe detonation?
Malware Analysis guides you through sandbox detonation workflows, capa framework integration for capability mapping, and safe sample handling. Use isolated environments to trigger malware behavior, capture network traffic (pcap), and collect memory dumps. Correlate sandbox telemetry with static findings to validate your reverse-engineering results and confirm payload recovery before authoring final detection rules.
How do you generate YARA rules for malware detection from analysis findings?
Malware Analysis teaches YARA rule writing by extracting static signatures, byte patterns, and behavioral indicators from your reverse-engineering work. Author rules with low false-positive rates by combining entropy checks, import hashes, and string patterns unique to each malware family. Validate rules against known samples and variants, then integrate them into your detection pipeline alongside IOCs and ATT&CK mappings.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: malware-analysis description: Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing) metadata: type: defensive phase: analysis tools: capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata mitre: TA0042 kill_chain: phase: [weaponize] step: [2] attck_tactics: [TA0042, TA0005, TA0011] attck_techniques: [T1027, T1027.002, T1027.013, T1140, T1055, T1055.012, T1620, T1562.001, T1497, T1547.001, T1546.003, T1059.001, T1071.001, T1071.004, T1573, T1572, T1568.002, T1480] depends_on: [reverse-engineering] feeds_into: [threat-hunting, incident-response, edr-evasion, network-attack] inputs: [malware_sample, memory_image, pcap_capture, sandbox_report] outputs: [yara_rules, ioc_list, behavioral_report, malware_config, capability_map, c2_indicators] references: - references/static-triage-capa.md - references/unpacking-deobfuscation.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 14 files
skills/malware-analysis/SKILL.md
skills/malware-analysis/references/config-c2-extraction.md
skills/malware-analysis/references/dynamic-fileless-memory.md
skills/malware-analysis/references/network-c2-detection.md
skills/malware-analysis/references/static-triage-capa.md
skills/malware-analysis/references/unpacking-deobfuscation.md
skills/malware-analysis/references/yara-detection-engineering.md
skills/malware-analysis/scripts/auto_unpack.py
skills/malware-analysis/scripts/beacon_profiler.py
skills/malware-analysis/scripts/cs_config_extract.py
skills/malware-analysis/scripts/frida_unpack.js
skills/malware-analysis/scripts/mem_triage.py
skills/malware-analysis/scripts/triage.py
skills/malware-analysis/scripts/yara_gen.py