Malware Classification

---
name: malware-classification
description: |
  Activate this skill when the user mentions ANY of: "YARA", "YARA rules", "YARA signature",
  "write YARA", "detection rule", "packer detection", "packer identification", "packed binary",
  "UPX", "Themida", "VMProtect", "ASPack", "crypter", "obfuscated binary",
  "entropy", "entropy analysis", "section entropy", "high entropy",
  "malware family", "malware classification", "malware triage", "classify sample",
  "classify binary", "sample analysis", "unknown binary", "suspicious binary",
  "malware type", "ransomware", "RAT", "remote access trojan", "loader", "dropper",
  "stealer", "infostealer", "wiper", "botnet", "rootkit", "backdoor", "keylogger",
  "banker trojan", "cryptominer", "miner", "coinminer", "spyware", "adware",
  "fuzzy hash", "ssdeep", "TLSH", "imphash", "import hash", "similarity analysis",
  "sample similarity", "binary similarity", "homologous binary",
  "IOC", "indicator of compromise", "IOC extraction", "C2", "command and control",
  "C2 extraction", "network indicators", "host indicators",
  "malware analysis", "behavioral analysis", "static analysis", "dynamic analysis",
  "sandbox analysis", "sandbox evasion", "anti-analysis", "anti-debug", "anti-VM",
  "malware indicators", "threat classification", "campaign attribution",
  "malware report", "classification report", "triage report",
  "PEiD", "Detect It Easy", "DIE", "pestudio", "CAPEv2", "ANY.RUN",
  "VirusTotal", "MalwareBazaar", "Malpedia", "threat intel",
  "family fingerprint", "malware cluster", "behavioral signature",
  "string decryption", "config extraction", "C2 config",
  "MITRE ATT&CK", "TTP mapping", "kill chain", "execution chain".
version: 2.0.0
---

# Malware Classification

Systematic methodology for triaging unknown binaries, classifying malware families, extracting indicators of compromise, and producing actionable intelligence. Covers the full pipeline from initial sample receipt through final classification report.

## Classification Taxonomy

Know what you are looking for. Every sample maps to one of these categories:

| Category | Subcategories | Key Behavioral Signals |
|----------|---------------|----------------------|
| **Ransomware** | Crypto-locker, locker, wiper-ransom | File enumeration, crypto API calls, ransom note drops, shadow copy deletion |
| **RAT** | Full RAT, lightweight backdoor | Reverse shell, command dispatch, screenshot capture, keylogging, file exfil |
| **Loader/Dropper** | Stage-1 loader, dropper, downloader | Downloads next stage, writes to disk or injects, minimal own functionality |
| **Stealer/Infostealer** | Browser stealer, credential harvester | Reads browser DBs, credential stores, clipboard, crypto wallets |
| **Banker Trojan** | Web inject, form grabber, overlay | Targets banking URLs, injects into browser, form hooking |
| **Botnet Agent** | DDoS bot, spam bot, proxy bot | C2 check-in loop, command polling, peer-to-peer comms |
| **Rootkit** | Kernel rootkit, userland rootkit, bootkit | Driver loading, SSDT hooks, DKOM, MBR/VBR modification |
| **Cryptominer** | CPU miner, GPU miner | High CPU usage, stratum protocol, mining pool connections |
| **Wiper** | Destructive wiper, MBR wiper | Overwrites MBR, mass file deletion, no recovery mechanism |
| **Spyware** | Keylogger, screen capture, audio capture | Input hooks, periodic screenshots, mic access |
| **Adware/PUP** | Ad injector, browser hijacker | Browser extension install, DNS hijack, ad network callbacks |

## Triage Workflow

Follow this sequence. Each phase feeds the next — do not skip steps.

### Phase 1 — Sample Receipt and Hashing

Every analysis begins with positive identification and deduplication.

```bash
# Compute all hashes for the sample
sha256sum <sample>
md5sum <sample>
ssdeep <sample>

# Check file type
file <sample>

# Track in romero analysis DB
node ${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js hash <sample>
node ${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js add <sha256> classification pending
```

Record SHA256, MD5, SHA1, ssdeep, file size, and file type before touching anything else. This is your chain of custody starting point.

### Phase 2 — Static Triage (No Execution)

Static analysis extracts maximum intelligence without running the sample.

#### 2a. PE Header Analysis

```bash
# Section table, imports, exports, timestamps, debug info
r2 -qc 'iH; iS; ii; iE; it' <sample>

# Rich header (compiler fingerprint)
r2 -qc 'iR' <sample>

# Check for anomalies with pestudio (if available)
pestudio <sample>
```

Look for: abnormal section names (packer signatures), section entropy above 6.5, entry point outside `.text`, minimal imports (LoadLibrary + GetProcAddress only), mismatched compile timestamps, suspicious rich header entries.

#### 2b. Packer and Protector Detection

```bash
# Detect It Easy — best automated packer identification
diec <sample>

# YARA-based packer scan
yara -r ${CLAUDE_PLUGIN_ROOT}/rules/packers.yar <sample>

# Entropy per section (key packer signal)
r2 -qc 'iS~entropy' <sample>
```

If packed: identify the packer, attempt unpacking, then restart triage on the unpacked sample. See `references/packer-detection.md` for packer-specific strategies.

#### 2c. String Extraction

```bash
# Standard strings
strings -n 6 <sample> > strings_ascii.txt
strings -n 6 -el <sample> > strings_unicode.txt

# FLOSS for obfuscated/stack strings
floss <sample> > strings_floss.txt

# Quick triage of interesting strings
strings <sample> | grep -iE '(http|ftp|\.exe|\.dll|cmd\.exe|powershell|reg\s|schtasks|net\s|wmic)'
```

Strings reveal: C2 URLs, file paths, registry keys, mutex names, error messages, API names, embedded configs, debug paths (PDB), campaign IDs.

#### 2d. Import Analysis

```bash
# Full import table
r2 -qc 'ii' <sample>

# Compute imphash for family clustering
python3 -c "import pefile; pe=pefile.PE('<sample>'); print(pe.get_imphash())"
```

Flag these import categories:

| Category | APIs | Indicates |
|----------|------|-----------|
| **Process injection** | CreateRemoteThread, NtWriteVirtualMemory, QueueUserAPC | Code injection |
| **Evasion** | IsDebuggerPresent, NtQueryInformationProcess, GetTickCount | Anti-analysis |
| **Persistence** | RegSetValueEx, CreateService, SchTasksCreate | Survival mechanism |
| **Networking** | InternetOpen, WSAStartup, HttpSendRequest, WinHttpConnect | C2 or data exfil |
| **Crypto** | CryptEncrypt, BCryptEncrypt, CryptHashData | Encryption (ransom or comms) |
| **Credential theft** | CredEnumerate, LsaRetrievePrivateData, CryptUnprotectData | Credential harvesting |
| **Keylogging** | SetWindowsHookEx, GetAsyncKeyState, GetKeyState | Input capture |
| **Screen capture** | BitBlt, CreateCompatibleBitmap, GetDC | Visual surveillance |
| **File ops** | FindFirstFile, MoveFileEx, DeleteFile, WriteFile | File manipulation |
| **Privilege** | AdjustTokenPrivileges, OpenProcessToken, LookupPrivilegeValue | Privilege escalation |

#### 2e. YARA Scanning

```bash
# Scan against all rule sets
yara -s -r /path/to/rules/ <sample>

# Scan with specific rulesets
yara -s rules/malware_families.yar <sample>
yara -s rules/capabilities.yar <sample>
yara -s rules/packers.yar <sample>
```

See `references/yara-rules.md` for writing custom detection rules.

### Phase 3 — Similarity Analysis

Determine if the sample is related to known malware families.

```bash
# ssdeep fuzzy hash comparison against corpus
ssdeep -m known_hashes.txt <sample>

# TLSH locality-sensitive hash
tlsh -f <sample>
tlsh -c <sample> -l known_tlsh.txt

# imphash comparison (same imphash = same import structure = likely same family)
python3 -c "import pefile; pe=pefile.PE('<sample>'); print(pe.get_imphash())"
```

See `references/similarity-analysis.md` for fuzzy hashing methodology and thresholds.

### Phase 4 — Dynamic Analysis (Sandboxed Execution)

Run the sample in an isolated environment when static analysis is insufficient.

#### Automated Sandbox Submission

```bash
# CAPEv2 submission
curl -F "file=@<sample>" http://<cape-host>:8000/apiv2/tasks/create/file/

# Check results
curl http://<cape-host>:8000/apiv2/tasks/view/<task_id>/
```

#### Behavioral Signals to Extract

Monitor sandbox output for:

| Behavior | Tools/Artifacts | Classification Signal |
|----------|----------------|----------------------|
| File drops | Procmon, dropped files list | Dropper, loader |
| Network connections | Fakenet-NG, pcap | C2, data exfil |
| Registry modifications | Procmon, regshot diff | Persistence |
| Process creation | Process tree | Injection, child spawning |
| API call sequences | API trace log | Behavioral fingerprint |
| Mutex creation | Handle list | Family identifier |
| Scheduled tasks/services | Sysmon, event logs | Persistence |
| Crypto operations | API trace | Ransomware, encrypted comms |
| Screenshot/keylog | API hooks | Spyware, RAT |

#### Anti-Analysis Detection

If the sample detects the sandbox and refuses to execute, document the evasion technique:

- **Timing checks**: RDTSC, GetTickCount, Sleep acceleration
- **Environment checks**: VM artifacts, MAC prefixes, disk size, username
- **Debugger checks**: IsDebuggerPresent, int3 scanning, hardware breakpoints
- **Human interaction checks**: Mouse movement, click patterns, recent files

See `references/behavioral-indicators.md` for sandbox evasion catalog and countermeasures.

### Phase 5 — IOC Extraction

Extract every actionable indicator from static and dynamic analysis.

| IOC Type | How to Extract | Tracking Tag |
|----------|---------------|--------------|
| **C2 servers** | Strings, PCAP, config extraction | `ioc-c2` |
| **Mutexes** | Dynamic analysis, strings | `ioc-mutex` |
| **Dropped files** | Sandbox file activity | `ioc-dropper` |
| **Registry keys** | Procmon, strings | `ioc-persistence` |
| **Scheduled tasks** | Sysmon, strings | `ioc-persistence` |
| **DNS queries** | PCAP, Fakenet | `ioc-c2` |
| **User agents** | PCAP, strings | `ioc-c2` |
| **File hashes** | Dropped file hashes | `ioc-dropper` |
| **Email addresses** | Strings | `ioc-attribution` |
| **Bitcoin wallets** | Strings, ransom note | `ioc-attribution` |
| **PDB paths** | PE debug directory | `ioc-attribution` |
| **Certificates** | PE signature | `ioc-attribution` |

```bash
# Log IOCs to romero tracking
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add <binary> ioc-c2 "1.2.3.4:443" HIGH "C2 server" --db ioc
node ${CLAUDE_PLUGIN_ROOT}/scripts/findings-tracker.js add <binary> ioc-mutex "Global\\MTX_12345" MEDIUM "Campaign mutex" --db ioc
```

### Phase 6 — Family Identification and Attribution

Correlate all findings to identify the malware family.

**Fingerprint dimensions:**

1. **Import hash (imphash)**: Same import structure clusters families
2. **Rich header hash**: Same compiler/linker toolchain
3. **String patterns**: Campaign-specific strings, embedded configs
4. **Code patterns**: Unique algorithms, custom crypto, specific API call sequences
5. **Network protocol**: C2 protocol structure, packet format, encryption scheme
6. **Mutex naming convention**: Families reuse mutex naming patterns
7. **PDB path patterns**: Developer environment leakage
8. **Behavioral profile**: Execution sequence, file/registry/network pattern combination

See `references/family-fingerprinting.md` for detailed family identification methodology.

### Phase 7 — MITRE ATT&CK Mapping

Map observed behaviors to ATT&CK techniques for standardized reporting.

| Observed Behavior | ATT&CK Technique |
|-------------------|-------------------|
| Phishing attachment delivery | T1566.001 |
| DLL side-loading | T1574.002 |
| Process hollowing | T1055.012 |
| Registry run key | T1547.001 |
| Scheduled task | T1053.005 |
| Credential dumping | T1003 |
| Screen capture | T1113 |
| Data encrypted for impact | T1486 |
| Exfil over C2 | T1041 |
| Virtualization evasion | T1497.001 |

## Classification Verdicts

Assign one of these verdicts after completing analysis:

| Verdict | Criteria | Action |
|---------|----------|--------|
| **CLEAN** | No malicious indicators, standard imports, low entropy, legitimate signing | Close analysis |
| **SUSPICIOUS** | Some anomalies (high entropy, unusual imports) but no confirmed malicious behavior | Monitor, deeper analysis |
| **LIKELY MALICIOUS** | Multiple indicators: suspicious APIs, C2 patterns, anti-debug, no legitimate purpose | Full classification |
| **CONFIRMED MALICIOUS** | Positive YARA match, known family match, confirmed C2, observed malicious behavior | Full report + IOC export |
| **PACKED/PROTECTED** | Cannot classify until unpacked — high entropy, packer signatures detected | Unpack first, re-triage |

## Classification Report Template

Every classified sample produces a report with this structure:

```
# Malware Classification Report

## Sample Identity
- SHA256: <hash>
- MD5: <hash>
- ssdeep: <hash>
- TLSH: <hash>
- imphash: <hash>
- File size: <bytes>
- File type: <type>
- First seen: <date>

## Verdict: <VERDICT>
- Category: <taxonomy category>
- Family: <family name or UNKNOWN>
- Confidence: HIGH | MEDIUM | LOW

## Executive Summary
<2-3 sentences: what this malware does, who it targets, how it operates>

## Static Analysis Findings
- Packer/Protector: <name or NONE>
- Compiler: <from rich header>
- Key imports: <suspicious API categories>
- Notable strings: <C2 URLs, paths, mutex names>

## Dynamic Analysis Findings
- Execution behavior: <summary>
- Network activity: <C2, DNS, exfil>
- File system activity: <drops, reads, deletes>
- Persistence mechanisms: <registry, tasks, services>
- Evasion techniques: <anti-debug, anti-VM>

## Indicators of Compromise
### Network
- C2: <addresses>
- DNS: <domains>
- User-Agent: <strings>

### Host
- Mutexes: <names>
- Files dropped: <paths>
- Registry keys: <paths>
- Scheduled tasks: <names>

## MITRE ATT&CK Mapping
| Tactic | Technique | ID | Evidence |
|--------|-----------|-----|----------|

## YARA Rule
<custom YARA rule for this sample/family>

## Similarity
- ssdeep matches: <related samples>
- imphash matches: <related samples>
- Family correlation: <confidence + evidence>
```

## References

| Reference | Purpose |
|-----------|---------|
| `references/yara-rules.md` | YARA rule writing: syntax, modules, performance, community sources |
| `references/packer-detection.md` | Packer/crypter identification and unpacking strategies |
| `references/behavioral-indicators.md` | Behavioral classification signals, sandbox evasion catalog |
| `references/similarity-analysis.md` | Fuzzy hashing (ssdeep, TLSH, imphash) methodology and thresholds |
| `references/family-fingerprinting.md` | Malware family identification and campaign attribution |