Analyze Malware Samples and Extract IOCs

This skill guides defensive malware analysis from file identification through reporting. Its file-identification step covers file/sha256sum, string extraction (strings -a, FLOSS for obfuscated strings), packer detection (Detect It Easy, exeinfope), and import analysis (rabin2 -i, dumpbin /imports). Its static-analysis phase loads the sample in a disassembler (IDA Pro, Ghidra, Binary Ninja), identifies the entry point/WinMain/DllMain, maps execution flow, identifies capabilities (network, file, registry, process operations), and extracts IOCs (C2 addresses, file paths, mutex names). Its dynamic-analysis phase sets up a Windows VM with Process Monitor, Wireshark, Regshot, API Monitor or x64dbg, and INetSim or FakeNet, executes the sample under monitoring for 5-10 minutes, and documents network connections, file/registry changes, spawned processes, and persistence mechanisms. It catalogs common malware techniques: persistence mechanisms (registry Run keys, scheduled tasks, services, WMI subscriptions, DLL/COM hijacking, startup folder, boot-record modification), evasion techniques (anti-VM, anti-debugging, anti-sandbox, packing, obfuscation, process hollowing, living-off-the-land), and C2 communication methods (HTTP/HTTPS, DNS tunneling, domain generation algorithms, fast flux, Tor/I2P, social-media and cloud-service C2 channels). It lists analysis platforms (Cuckoo Sandbox, ANY.RUN, Hybrid Analysis, Joe Sandbox, CAPE), monitoring tools, and unpacking tools (Unipacker, x64dbg with Scylla, OllyDumpEx, PE-sieve, UPX). It defines IOC categories (network, file system, registry, process) and gives an example YARA rule detecting packer characteristics by MZ header and packer strings. Its reporting framework structures an analysis report into executive summary, sample information, static/dynamic analysis findings, indicators of compromise, and recommendations.

Use it for incident response and forensics, threat intelligence research, security product development, academic research, or CTF competitions. Its ethical guidelines explicitly exclude creating or distributing malware, attacking systems without authorization, maliciously evading security products, building botnets or C2 infrastructure, or any offensive operation without proper authorization.

Inputs: a malware sample and a verified defensive/authorized analysis context. Outputs: a structured analysis report with sample hashes, static and dynamic findings, extracted IOCs (network, file system, registry, process), YARA detection rules, and remediation recommendations.

IDA Pro, Ghidra, Binary Ninja for disassembly; Cuckoo Sandbox, ANY.RUN, Hybrid Analysis, Joe Sandbox, CAPE for automated analysis; Process Monitor, Process Hacker, Wireshark, API Monitor, Regshot for dynamic monitoring; and YARA for detection rules.

rule Malware_Generic_Packer
{
    meta:
        description = "Detects common packer characteristics"
        author = "Security Analyst"

    strings:
        $mz = { 4D 5A }
        $upx = "UPX!" ascii
        $section = ".packed" ascii

    condition:
        $mz at 0 and ($upx or $section)
}

Incident responders, threat intelligence researchers, and security engineers analyzing malware samples for defensive purposes who need a verified-context static/dynamic workflow and IOC-extraction methodology rather than ad hoc analysis.