malware-analysis

Files (8)

• SKILL.md
• config.json · config/
• mitre_techniques.md · references/
• report_template.md · references/
• extract_iocs.py · scripts/
• generate_report.py · scripts/
• static_analysis.py · scripts/
• triage.py · scripts/

SKILL.md (first lines)

# Malware Analysis Skill

This skill produces **analyst-grade threat reports** — not data dumps. Every conclusion must be backed by evidence and reasoning.

## Core Principles

1. **Evidence-based reasoning**: Never state a conclusion without explaining WHY
2. **Connect the dots**: Link indicators to behaviors to capabilities to impact
3. **Assess confidence**: State how confident you are and why
4. **Actionable output**: Reports should enable decisions, not just inform

## Analysis Workflow

### Step 1: Collect Data

Run all scripts to gather raw data:

```bash
# Static analysis - get hashes, PE info, strings, APIs, entropy
python3 scripts/static_analysis.py /path/to/sample -f json > static.json

# Threat intelligence - check reputation across sources
python3 scripts/triage.py -t file /path/to/sample -f json > triage.json

# IOC extraction - extract network/host indicators
python3 scripts/extract_iocs.py /path/to/sample -f json > iocs.json
```

### Step 2: Analyze and Reason (THIS IS THE KEY STEP)

Using the collected data, perform analyst-grade reasoning:

#### 2.1 Threat Intelligence Assessment

Ask yourself:
- Is this sample known? If found in MalwareBazaar/ThreatFox, it's **confirmed malware**
- What's the VT detection rate? 
  - 0 detections: New sample, FP, or clean — **requires behavioral analysis**
  - 1-5 detections: Possibly new variant or targeted — **suspicious**
  - 5-15 detections: Confirmed malicious by multiple vendors
  - 15+ detections: Well-known malware
- What family is it attributed to? Research that family's typical behavior
- When was it first seen? Recent = active campaign

**Always explain your reasoning:**
> "This sample is identified as RedLine Stealer by MalwareBazaar with 45/70 VT detections. The high detection rate and presence in curated malware repositories confirms this is a known threat, not a false positive."

#### 2.2 Behavioral Analysis from Static Indicators

**API Analysis** - Map APIs to behaviors:

| API Pattern | Likely Behavior | Reasoning |
|-------------|-----------------|-----------|
| VirtualAlloc + VirtualProtect + WriteProcessMemory + CreateRemoteThread | Process Injection | This is the classic injection pattern: allocate memory, make it executable, write code, execute in target |
| CredEnumerate, CryptUnprotectData | Credential Theft | These APIs specifically access Windows credential stores and DPAPI-protected data (browser passwords) |
| InternetOpen + URLDownloadToFile | Downloader | Initializes HTTP and downloads files — classic dropper behavior |
| RegSetValueEx + Run key paths in strings | Persistence | Writing to Run keys ensures execution at startup |
| IsDebuggerPresent, GetTickCount, NtQuerySystemInformation | Anti-Analysis | Multiple evasion checks suggest the malware hides its behavior during analysis |
| CryptEncrypt + file enumeration APIs | Possible Ransomware | Encryption capability combined with file discovery — but could also be secure C2 |

**Always explain your reasoning:**
> "The presence of VirtualAlloc, VirtualProtect, and CreateRemoteThread together strongly suggests process injection capability. Individually these APIs have legitimate uses, but this specific combination is the textbook pattern for injecting code into other processes."

**Packing Analysis:**

| Indicator | Meaning | Confidence |
|-----------|---------|------------|
| Entropy > 7.0 | Compressed/encrypted content | High |
| Section entropy > 7.0 (especially .text) | Packed code section | High |
| UPX0, UPX1, .aspack, .packed sections | Known packer signatures | Very High |
| RWX sections | Self-modifying code | Medium |
| Small import table with GetProcAddress/LoadLibrary only | Dynamic API resolution | High |

**If packed, state the implication:**
> "This sample shows multiple packing indicators (entropy 7.4, UPX sections). The static analysis findings represent the unpacker stub, NOT the actual payload. Dynamic analysis is required to reveal true functionality."

#### 2.3 Capability Assessment

Based on the evidence, determine what the malware CAN DO:

| Capability | Required Evidence | Confidence Level |
|------------|-------------------|------------------|
| Process Injection | 2+ injection APIs | High if 3+, Medium if 2 |
| Credential Theft | Any cred access API | High (these are specific) |
| Keylogging | SetWindowsHookEx | Medium (has legit uses) |
| Network C2 | 2+ network APIs + extracted URLs/IPs | High |
| File Download | URLDownloadToFile or similar | High |
| Persistence | Registry/service APIs + relevant strings | Medium |
| Encryption/Ransomware | Crypto APIs + file enumeration | Medium (needs context) |

**State confidence and reasoning:**
> "**Credential Theft Capability: HIGH CONFIDENCE** — CryptUnprotectData is present, which specifically decrypts DPAPI-protected data including browser passwords. This API has no legitimate use case in most software."

#### 2.4 Risk Assessment

Determine risk level with justification:

| Risk Level | Criteria |
|------------|----------|
| **CRITICAL** | Credential theft APIs, process injection, confirmed malware family known for data theft/ransomware |
| **HIGH** | Multiple malicious capabilities, network C2, persistence mechanisms |
| **MEDIUM** | Suspicious indicators but no confirmed malicious capability, or packing hiding true behavior |
| **LOW** | Few indicators, possibly legitimate software with suspicious patterns |
| **UNKNOWN** | Insufficient evidence, heavily packed, or no TI hits |

### Step 3: Write the Report

Structure your report as follows:

```markdown
# Threat Analysis Report: [MALWARE_NAME or "Unknown Sample"]

| | |
|---|---|
| **Risk Level** | [CRITICAL/HIGH/MEDIUM/LOW] |
| **Confidence** | [High/Medium/Low] |
| **Analysis Date** | [DATE] |

---

From tsale/awesome-dfir-skills, Apache-2.0.

More from tsale/awesome-dfir-skills