malware-analyst
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.
Profile →npx skills add sickn33/agentic-awesome-skills --skill malware-analyst --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# File identification file sample.exe sha256sum sample.exe # String extraction strings -a sample.exe | head -100 FLOSS sample.exe # Obfuscated strings # Packer detection diec sample.exe # Detect It Easy exeinfope sample.exe # Import analysis rabin2 -i sample.exe dumpbin /imports sample.exe ``` ### Phase 3: Static Analysis 1. **Load in disassembler**: IDA Pro, Ghidra, or Binary Ninja 2. **Identify main functionality**: Entry point, WinMain, DllMain 3. **Map execution flow**: Key decision points, loops 4. **Identify capabilities**: Network, file, registry, process operations 5. **Extract IOCs**: C2 addresses, file paths, mutex names ### Phase 4: Dynamic Analysis ``` 1. Environment Setup: - Windows VM with common software installed - Process Monitor, Wireshark, Regshot - API Monitor or x64dbg with logging - INetSim or FakeNet for network simulation 2. Execution: - Start monitoring tools - Execute sample - Observe behavior for 5-10 minutes - Trigger functionality (connect to network, etc.) 3. Documentation: - Network connections attempted - Files created/modified - Registry changes - Processes spawned - Persistence mechanisms ``` ## Use this skill when - Working on file identification
- Executive Summary
- Sample Information
- Static Analysis
- Dynamic Analysis
- Indicators of Compromise
- Recommendations
- Ethical Guidelines
- Appropriate Use
- Never Assist With
- Response Approach
- Limitations
What does the malware-analyst skill do?
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill malware-analyst --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.