skills.rest
dslsdzc
dslsdzcCOMMUNITY
Explore all skills by this author →
GitHub

re-malware

Orchestrates malware analysis workflows from sandboxing through behavior analysis to IOC reporting.

64|9|Updated Aug 17, 2026
Search Tags:#sandbox#reverse engineering#threat intelligence#yara#malware analysis#ioc extraction#c2 analysis
One-click install
npx skills add https://github.com/dslsdzc/rev-skills --skill re-malware-dslsdzc
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: re-malware
Source: https://github.com/dslsdzc/rev-skills/tree/main/.claude/skills/re-malware
Command: npx skills add https://github.com/dslsdzc/rev-skills --skill re-malware-dslsdzc

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Analyzing a suspicious sample safely and systematically is hard: running it directly risks contaminating the environment, packed samples distort behavior observations, and results without evidence cannot be reproduced. This gateway skill orchestrates the full malware analysis pipeline so each step happens in the right order with proper isolation and evidence archiving. ## Core Features & Use Cases - Sandbox-first orchestration: Enforces VM snapshot / container isolation with network containment (INetSim, fake DNS) before any dynamic execution. - Guided analysis pipeline: Coordinates static triage, behavior analysis, C2/protocol reverse engineering, unpacking, and IOC extraction with YARA rule generation. - Specialized routing: Directs ransomware, loaders, fileless samples, malicious documents, and in-memory-only samples to dedicated sub-skills. - Use Case: You receive a suspicious email attachment. The skill routes you through sandbox setup, static triage, behavior observation, C2 traffic capture, and finally produces a structured report with IOCs and YARA rules. ## Quick Start Analyze this suspicious sample safely in a sandbox and produce a behavior report with IOCs and YARA rules.

Frequently Asked Questions about re-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely analyze a malware sample?▼

Set up an isolated sandbox first using VM snapshots or containers with network containment via INetSim or fake DNS. Then run static triage (file type, hash, entropy, strings) before any dynamic execution, and archive every artifact with its SHA-256 hash.

How to analyze packed or obfuscated malware?▼

Check entropy first; values above 7.0 suggest packing or encryption. Route the sample through unpacking and deobfuscation steps, then return the unpacked output to the sandbox for a fresh behavior analysis run.

Can malware be analyzed without running it?▼

Yes, static triage alone can identify file type, architecture, hashes, and suspicious strings without a sandbox. For deeper logic, use decompilers like Ghidra, IDA, or radare2, though dynamic behavior and C2 details require sandboxed execution.

How do I extract C2 domains and encryption keys from malware?▼

Capture callback traffic in the isolated sandbox, then reconstruct the protocol state machine and identify the cryptography used. Keys may be extracted statically from the binary or from memory dumps taken during execution.

Why does behavior analysis show only packer activity?▼

This happens when a packed sample is executed without unpacking first, so all observed behavior comes from the packer stub. Confirm packing via entropy checks, unpack the sample, then re-run behavior analysis on the unpacked payload.

Related Skills

Explore More Software Engineering Skills→
FuzzdkkFuzzdkk
3

evidence-acquisition

Acquire and preserve digital evidence with hash verification and chain-of-custody logging.

Community
Advanced
hypnguyen1209hypnguyen1209
338

malware-analysis

Dissect malware samples to produce threat intelligence and IOCs.

Community
Advanced
woohyun212woohyun212
21

malware-analysis

Automates end-to-end malware analysis to produce IOCs, YARA/Sigma rules, and MITRE ATT&CK mappings.

Community
Advanced
tinywifitinywifi
2

jarsec

Analyze Minecraft mod files for malware via static and sandbox analysis.

Community
Advanced