Agent skill · security · sickn33
malware-analyst
Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.
Why this skill is useful
Provides specific commands and workflows for malware analysis that the AI wouldn't reliably generate on its own.
What it needs
Requires api-monitor, cuckoo, process-monitor, regshot, wireshark installed locally. About 4k tokens when loaded. Last updated 2026-08-07. 44,571 stars on the source repository.
What this skill does
File identification file sample.exe sha256sum sample.exe String extraction strings -a sample.exe head -100 FLOSS sample.exe # Obfuscated strings Packer detection diec sample.exe # Detect It Easy exeinfope sample.exe Import analysis rabin2 -i sample.exe dumpbin /imports sample.exe 1. Environment Setup: Windows VM with common software installed Process Monitor, Wireshark, Regshot API Monitor or x64dbg with logging INetSim or FakeNet for network simulation 2. Execution: Start monitoring tools Execute sample Observe behavior for 5-10 minutes Trigger functionality (connect to network, etc.) 3. Documentation: Network connections attempted Files created/modified Registry changes Processes spawned Persistence mechanisms Registry Run keys - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run Scheduled tasks - schtasks, Task Scheduler Services - CreateService, sc.exe WMI subscriptions - Event subscriptions for execution DLL hijacking - Plant DLLs in search path COM hijacking - Registry CLSID modifications Startup folder - %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup Boot records - MBR/VBR modification Anti-VM - CPUID, registry checks, timing Anti-debugging - IsDebuggerPresent, NtQueryInformationProcess Anti-sandbox - Sleep acceleration detection, mouse movement Packing - UPX, Themida, VMProtect, custom packers Obfuscation - String encryption, control flow flattening Process hollowing - Inject into legitimate process Living-off-the-land - Use built-in tools (PowerShell, certutil) HTTP/HTTPS - Web traffic to blend in DNS tunneling - Data exfil via DNS queries Domain generation - DGA for resilient C2 Fast flux - Rapidly changing DNS Tor/I2P - Anonymity networks Social media - Twitter, Pastebin as C2 channels Cloud services - Legitimate services as C2 Cuckoo Sandbox - Open-source automated analysis ANY.RUN - Interactive cloud sandbox Hybrid Analysis - VirusTotal alternative Joe Sandbox - Enterprise sandbox solution CAPE - Cuckoo fork with enhancements Process Monit …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sickn33/malware-analyst