Malware Analysis

---
name: malware-analysis
description: Use when analyzing suspected malware through static, dynamic, and behavioral techniques, including IOC extraction, YARA or Sigma rules, sandboxing, and anti-analysis behavior.
---
# Malware Analysis

## ACTION REQUIRED (execute immediately after reading)

1. `NOW`: Read `../field-journal/precedent-reverse.md` — confirm that this skill's operations are authorized routine operations
2. `NOW`: Confirm whether the current task falls within this skill's scope
3. `NEXT`: Read `../tool-index.md` to verify tool availability and actual paths
4. `NEXT`: When a tool is missing, invoke bootstrap; do not guess paths
5. `ACT`: Enter the first step of the workflow and execute; do not stall in the confirmation state

> YARA / Sigma / sandbox / IOC extraction / anti-anti-analysis
> Static + dynamic + behavioral, three in one

## Applicable Scenarios

- Malware sample analysis (PE/ELF/Mach-O/APK/scripts)
- YARA rule authoring and validation
- Sigma behavioral detection rule generation
- Sandbox automation orchestration
- IOC extraction and threat intelligence
- Anti-analysis technique detection and bypass

## Six-Phase Analysis Process

### Phase 1: Initial Triage

```bash
# Quick static checks
file sample.exe                      # File type
strings sample.exe | grep -i "http\|cmd\|powershell\|base64"  # Quick IOCs
rabin2 -zz sample.exe                # String extraction + cross-references
floss sample.exe                     # Deobfuscated string extraction (FireEye)

# PE header analysis
pecheck sample.exe                   # PE structure validation
pescan sample.exe                    # Anomaly detection (section table, entry point)
diec sample.exe                      # Detect It Easy (packer/compiler identification)

# Hash lookup
sha256sum sample.exe
# → VirusTotal / MalwareBazaar / Triage lookup
```

### Phase 2: Static Analysis

```text
Disassembly/decompilation:
□ IDA Pro / Ghidra: in-depth decompilation
□ radare2: fast CLI analysis
□ x64dbg: Windows GUI debugger

Key analysis areas:
□ Entry Point → initialization logic
□ Import table → API purpose inference (CreateRemoteThread=injection, CryptEncrypt=ransomware)
□ Resource section → embedded Payload (.rsrc section)
□ String table → URL/C2/file paths/Base64 blobs
□ TLS callbacks → execute before the debugger starts
```

### Phase 3: Sandbox Dynamic Analysis

```text
Automated sandboxes:
□ Joe Sandbox / ANY.RUN / Triage: commercial sandboxes
□ CAPE Sandbox: open source + YARA integration (recommended)
□ ASD Azul: open-source malware analysis platform (released in 2026)
□ Cuckoo Sandbox: classic open source (gradually being replaced by CAPE)

Monitoring focus:
□ Process creation: CreateProcess / ShellExecute
□ File operations: WriteFile → ransomware? DeleteFile → wiper?
□ Registry: Run/RunOnce persistence
□ Network: HTTP/DNS → C2 communication
□ Memory: VirtualAllocEx → process injection
□ Services: CreateService → persistence
```

### Phase 4: YARA Rule Authoring

```yara
// Rule structure
rule MalwareFamily_Example {
    meta:
        description = "Detects the Example malware family"
        author = "Analyst"
        date = "2026-05"
        severity = "high"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
        mitre_id = "T1055"  // Process Injection

    strings:
        // String matching
        $str1 = "C2_SERVER_URL" ascii wide
        $str2 = "payload.dat" ascii

        // Hex matching
        $hex1 = { 8B 45 ?? 50 FF 15 [4] 85 C0 }
        // Opcode sequence: mov eax, [ebp-?]; push eax; call [import]; test eax, eax

        // Regex matching
        $re1 = /https?:\/\/[a-z0-9.-]+\/[a-z]{3,8}\.php/ ascii

    condition:
        // Combined conditions
        uint16(0) == 0x5A4D and     // MZ header
        filesize < 500KB and
        (2 of ($str*) or $hex1)
}
```

### Phase 5: Sigma Rule Generation

```yaml
# Behavioral detection rule
title: Suspicious Process Injection via CreateRemoteThread
id: 5a3d2c1b-1234-5678-9abc-def012345678
status: experimental
description: Detects process injection behavior using CreateRemoteThread
author: Analyst
date: 2026/05/25
tags:
    - attack.t1055          # Process Injection
    - attack.t1055.001      # DLL Injection
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\powershell.exe'
        CommandLine|contains:
            - 'CreateRemoteThread'
            - 'VirtualAllocEx'
            - 'WriteProcessMemory'
    condition: selection
falsepositives:
    - Legitimate debugging tools
level: high
```

### Phase 6: IOC Extraction and Intelligence

```text
IOC type classification:
□ Network IOCs:
  - IP: C2 addresses (note time-sensitivity)
  - Domain: DGA-generated domains (rsnkfda.com, xpqmje.net)
  - URL: payload hosting addresses
  - User-Agent: custom UA strings

□ Host IOCs:
  - File paths: %APPDATA%\Microsoft\Crypto\RSA\*.dat
  - Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\
  - Mutex: Global\{GUID} mutex names
  - Service names: names masquerading as system services

□ Behavioral IOCs:
  - MITRE ATT&CK technique IDs (T1055, T1003, T1571...)
  - Sigma rules → SIEM integration
  - YARA rules → endpoint detection

□ Static IOCs:
  - Compile timestamps (can be forged)
  - PDB paths (contain developer information)
  - Abnormal section names (non-standard .text/.data)
  - Abnormal import table combinations (e.g., ransomware CryptEncrypt + DeleteShadowCopies)
```

## Anti-Analysis Techniques Quick Reference

| Technique | Detection Method | YARA Signature |
|------|---------|----------|
| VM detection | WMI Win32_BIOS/VideoController/Processor | `Win32_` strings + specific vendor names |
| Sandbox detection | Disk < 60GB, RAM < 2GB, single-core CPU | GlobalMemoryStatusEx call pattern |
| Debugger detection | IsDebuggerPresent, CheckRemoteDebuggerPresent | PEB.BeingDebugged offset access |
| Timing evasion | Malicious behavior executes after Sleep(300000) | NtDelayExecution with long arguments |
| Geolocation check | Checks keyboard layout/timezone → excludes CIS countries | GetKeyboardLayoutList call |
| Parent process check | explorer.exe vs cmd.exe | Process name string comparison |
| Direct API syscalls | Bypasses EDR hooks | syscall instruction + SSN resolution |

## Multi-Agent Automated Analysis (SentinelHive Architecture)

```text
┌─────────────────────────────────────────────────┐
│                  Hive Director                    │
│       (Claude Opus orchestration + arbitration)    │
└──────┬──────┬──────┬──────┬──────┬───────┘
       │      │      │      │      │
   ┌───┘  ┌───┘  ┌───┘  ┌───┘  ┌───┘
   ▼      ▼      ▼      ▼      ▼      ▼
Triage  RE    Behav  Intel  Detect Remed
 quick  decomp behave threat rules  fix
 triage static dynamic intel YARA  plan
                          Sigma
```

## Toolchain

| Tool | Purpose | Source |
|------|------|------|
| Ghidra / IDA Pro | In-depth decompilation | ghidra-sre.org |
| CAPE Sandbox | Open-source malware sandbox | GitHub: kevoreilly/CAPEv2 |
| ASD Azul | Large-scale automated analysis | GitHub: ASD |
| YARA | Pattern-matching rule engine | `pip install yara-python` |
| Sigma | SIEM behavioral detection rules | GitHub: SigmaHQ/sigma |
| FLOSS | Deobfuscated string extraction | `pip install flare-floss` |
| Detect It Easy | Packer/compiler detection | GitHub: horsicq/Detect-It-Easy |
| pe-sieve | Process memory scanning | GitHub: hasherezade/pe-sieve |
| VirusTotal API | Multi-engine scanning | virustotal.com |
| MalwareBazaar | Malware sample repository | bazaar.abuse.ch |

## References

- `references/yara-sigma-rules.md` — YARA + Sigma authoring methodology
- `references/sandbox-orchestration.md` — Sandbox orchestration and automation
- `references/anti-analysis-techniques.md` — Detection of 94 anti-analysis techniques

## Task Completion Self-Check (MUST pass before claiming completion)

- [ ] Did I execute every step of the workflow (rather than just reading it)?
- [ ] Did I use real tool paths based on `tool-index`?
- [ ] Did I produce reproducible evidence (commands/scripts/screenshots/reports)?
- [ ] Did I complete and write back the Checklist items required by RULES?