Claude Skill Package for operational malware analysis — 덮음 triage, 동적 분석, 검출 공학, 및 보고. 깊은 정적 역 공학 (예를 들어, Ghidra/IDA 프로 분해).

USER 이 기술 뒤에 수동 분석 기술을 배우기 위해? 전통적인 분석 방법 및 도구를 다루는 포괄적 인 Malware Analysis SOP를 확인하십시오.

---

☸ 포함 된 것

1 Orchestrator + 5 Sub-Skills + host-side scripts triage, 동적 분석, 검출 공학 및 보고를 덮음. 이 기술은 Claude 코드에 대한 지침으로 작성됩니다 : Claude는 정적 툴링을 실행하고, 수출 된 증거, 쓰기 및 규칙을 테스트하고 보고서를 초안합니다. 고립 된 VM에서 샘플을 실행합니다. 다른 모든 것은 당신을 위해 수행됩니다.

• SKILL.md (root) - Orchestrator - 오른쪽 서브 스킬로에 대한 단일 항목 포인트, 단계별 분석 상태를 관리하고 멀티 샘플 배치 워크플로우를 지원합니다. 필요한 것을 설명합니다.

1.malware-triage - 초기 평가 및 우선 순위 2.malware-dynamic-analysis - 안전한 실행 및 행동 모니터링 3. ** 특수 파일 - analyzer ** - Non-PE 파일 분석 (.

Malware Analysis Skills Toolkit

Claude skills package for operational malware analysis — covering triage, dynamic analysis, detection engineering, and reporting. Does not cover deep static reverse engineering (e.g., Ghidra/IDA Pro disassembly).

💡 Want to learn the manual analysis techniques behind these skills? Check out the comprehensive Malware Analysis SOP covering traditional analysis methods and tools.

---

📦 What’s Included

1 Orchestrator + 5 Sub-Skills + host-side scripts covering triage, dynamic analysis, detection engineering, and reporting. The skills are written as instructions to Claude Code: Claude runs the static tooling, parses exported evidence, writes and tests the rules, and drafts the report. You execute the sample in your isolated VM; everything else is done for you.

• SKILL.md (root) - Orchestrator — single entry point that routes to the right sub-skill, manages analysis state across phases, and supports multi-sample batch workflows. Just describe what you need.

1. malware-triage - Initial assessment and prioritization
2. malware-dynamic-analysis - Safe execution and behavior monitoring
3. specialized-file-analyzer - Non-PE file analysis (.NET, Office, PDF, scripts, HTA, disk images)
4. detection-engineer - Detection rules and IOC management
5. malware-report-writer - Professional report creation

---

🧠 How It Works (agentic)

These are not tutorials you read — they are instructions Claude Code executes. Claude runs the static tools on the host, parses the evidence you export from the VM, and produces the rules and report. The only manual step is detonating the sample in your isolated VM.

                          YOUR HOST (Claude Code + internet)
  ┌───────────────────────────────────────────────────────────────────────┐
  │  Triage            Claude runs: file · hash_calculator.py · pe_info.py  │
  │                    · strings (ASCII+UTF-16) · ioc_extract.py            │
  │                    → classification, priority, behavior predictions     │
  │                            │                                            │
  │                            ▼  emits a VM runbook tailored to predictions│
  └────────────────────────────┼──────────────────────────────────────────┘
                               │  runbook (filters, export commands)
        ┌──────────────────────▼───────────────────────┐
        │   ISOLATED VM (REMnux / FlareVM, no internet) │   ← you detonate here
        │   snapshot → monitor → execute → 15+ min →    │
        │   export TEXT evidence → revert               │
        └──────────────────────┬───────────────────────┘
                               │  evidence/ (Procmon CSV, Sysmon JSON, tshark, dropped files)
  ┌────────────────────────────▼──────────────────────────────────────────┐