arkana-analyze

Analyze malware binaries with Arkana to produce structured digests and IOCs.

39|9|Updated Feb 12, 2026
One-click install
npx skills add https://github.com/JameZUK/Arkana --skill arkana-analyze
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: arkana-analyze
Source: https://github.com/JameZUK/Arkana/tree/main/.claude/skills/arkana-analyze
Command: npx skills add https://github.com/JameZUK/Arkana --skill arkana-analyze

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Binary analysis is complex, time-consuming, and fragmented across many tools. Arkana unifies 190 analysis tools behind a single MCP interface to triage, decompile, emulate, extract configurations, and generate structured reports.

Core Features & Use Cases

  • Unified analysis workflow spanning static analysis, dynamic emulation, data-flow tracking, deobfuscation, unpacking, and reporting
  • Malware triage, reverse engineering, C2/config extraction, and threat intelligence across PE/ELF/Mach-O, .NET, Go, Rust, and shellcode
  • Session continuity with notes, function summaries, and tool history to enable investigations over hours or days

Quick Start

Provide a binary sample and run Arkana to generate a full triage digest with IOCs and artifacts.

Frequently Asked Questions about arkana-analyze

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I perform malware triage and extract IOCs from a binary sample?▼

Malware triage and IOC extraction are performed by providing a binary sample to Arkana, which unifies static analysis, decompilation, and emulation to generate a structured digest with actionable indicators of compromise.

Does binary analysis with Arkana support Go, Rust, and .NET executables?▼

Yes, binary analysis with Arkana supports PE, ELF, and Mach-O formats, including .NET, Go, Rust, and shellcode samples, enabling comprehensive reverse engineering and deobfuscation across diverse malware families.

What is the best way to deobfuscate and unpack malware during reverse engineering?▼

The best way to deobfuscate and unpack malware is using a unified workflow that integrates dynamic emulation, data-flow tracking, and decompilation, allowing you to bypass obfuscation layers and extract the underlying logic.

How do I extract C2 configurations and generate threat intelligence from suspicious files?▼

C2 configurations and threat intelligence are extracted by running the binary through integrated CAPA, YARA, and refinery pipelines, which identify malicious capabilities and output structured artifacts for reporting.

Can I maintain session continuity for long-running malware investigations?▼

Yes, you can maintain session continuity for malware investigations over hours or days, utilizing built-in notes, function summaries, and tool history to track analysis progress across complex reverse engineering tasks.