Analyze Malware Samples and Extract IOCs

Malware Analyst is a skill for defensive malware analysis: identifying a sample, extracting its indicators of compromise, and reporting findings for incident response and threat intelligence. It walks through static and dynamic analysis, then names the techniques and tooling an analyst needs to recognize.

Initial triage covers file identification and hashing, string extraction (including obfuscation-aware tools like FLOSS), packer detection, and import analysis. Static analysis loads the sample in a disassembler (IDA Pro, Ghidra, or Binary Ninja) to find the entry point, map execution flow, and identify network/file/registry/process capabilities and IOCs. Dynamic analysis runs the sample in an isolated Windows VM with Process Monitor, Wireshark, Regshot, and network simulation (INetSim/FakeNet), observing and documenting network connections, file and registry changes, spawned processes, and persistence mechanisms over several minutes of execution.

It names the common techniques to recognize: persistence (registry Run keys, scheduled tasks, services, WMI subscriptions, DLL/COM hijacking, startup folder, boot-record modification), evasion (anti-VM, anti-debugging, anti-sandbox timing checks, packers like UPX/Themida/VMProtect, obfuscation, process hollowing, living-off-the-land tools), and C2 communication (HTTP/HTTPS blending in, DNS tunneling, domain generation algorithms, fast flux, Tor/I2P, and even social media or cloud services as C2 channels). It also names specific tools by category - analysis sandboxes (Cuckoo, ANY.RUN, Hybrid Analysis, Joe Sandbox, CAPE), monitoring tools (Process Monitor, Process Hacker, Wireshark, API Monitor, Regshot), and unpacking tools (Unipacker, x64dbg with Scylla for IAT reconstruction, OllyDumpEx, PE-sieve, UPX) - and structures IOC extraction across network, file-system, registry, and process indicators, plus writing YARA detection rules like this one:

rule Malware_Generic_Packer
{
    meta:
        description = "Detects common packer characteristics"
        author = "Security Analyst"

    strings:
        $mz = { 4D 5A }
        $upx = "UPX!" ascii
        $section = ".packed" ascii

    condition:
        $mz at 0 and ($upx or $section)
}

This skill is explicitly scoped to defensive and authorized use: incident response and forensics, threat-intelligence research, security-product development, academic research, and CTF competitions. It will never assist with creating or distributing malware, attacking systems without authorization, maliciously evading security products, building botnets or C2 infrastructure, or any offensive operation without proper authorization - its first response step is verifying the request has a defensive or authorized purpose before proceeding.

Input is a suspicious file sample and the analysis context (available tooling, isolation environment). Output is a structured analysis report: an executive summary, sample identification (hashes, file type, packer info), static and dynamic analysis findings, indicators of compromise (network/file/registry), and recommendations (detection rules, mitigation, remediation guidance).

It names specific sandboxes and tools throughout - Cuckoo/CAPE, ANY.RUN, Hybrid Analysis, Joe Sandbox, IDA Pro, Ghidra, Binary Ninja, x64dbg, Process Monitor, Wireshark - and produces YARA rules as its detection-engineering output.

Security analysts, incident responders, and threat-intelligence researchers doing authorized malware analysis who need a structured methodology from initial triage through IOC extraction and reporting.