SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
dynamic-malware-analysis
0
Execute and analyze malware samples within a highly controlled, instrumented sandbox environment to observe their true behavior, network communications, file system modifications, and registry changes in real-time.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisherβs SKILL.md
# Dynamic Malware Analysis
## When to Use
- When static analysis (examining the code without running it) is insufficient because the malware is heavily packed, encrypted, or obfuscated.
- To rapidly understand the "blast radius" of a malicious payload (What files does it drop? What domains does it contact? What persistence mechanisms does it establish?).
- When you need to extract decryption keys, Command & Control (C2) configurations, or secondary stage payloads that are only unlocked during runtime.
## Prerequisites
- Isolated analysis environment (VM with snapshot capability)
- Sample file safely obtained and handled with appropriate precautions
- PE analysis tools (PE-bear, CFF Explorer, Detect It Easy) installed
- Disassembler/decompiler (Ghidra, IDA Free, or Binary Ninja) configured
## Workflow
### Phase 1: The Sandbox Environment (CRITICAL)
```text
# Concept: NEVER run malware Setup 1. 2. 3. 4. ```
### Phase 2: Instrumentation (Setting the Traps)
```text
# Before detonation 1. Process Monitor (Procmon) 2. Wireshark 3. FakeNet / INetSim # ```
### Phase 3: Detonation and Observation
```bash
# # ```
### Phase 4: Analysis (Connecting the Dots)
```text
# 1. Behavioral 2. Network ```
#### Decision Point π
```mermaid
flowchart TD
A[Prepare Sandbox reliably ] --> B[Enable ]
B --> C{Does ]}
C -->|Yes| D[Log ]
C -->|No| E[Check ]
D --> F[Analyze ]
```
## π΅ Blue Team Detection & Defense
- **Indicator of Compromise (IoC) Generation**: The **Behavioral Analytics**: EDR **Sandbox Evasion Detection**: Malware Key Concepts
| Concept | Description |
|---------|-------------|
## Output Format
```
Dynamic Malware Analysis β Assessment Report
============================================================
Target: [Target identifier]
Assessor: [Operator name]
Date: [Assessment date]
Scope: [Authorized scope]
MITRE ATT&CK: [Relevant technique IDs]
Findings Summary:
[Finding 1]: [Severity] β [Brief description]
[Finding 2]: [Severity] β [Brief description]
Detailed Results:
Phase 1: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Phase 2: [Phase name]
- Result: [Outcome]
- Evidence: [Screenshot/log reference]
- Impact: [Business impact assessment]
Risk Rating: [Critical/High/Medium/Low/Informational]
Recommendations:
1. [Immediate remediation step]
2. [Long-term hardening measure]
3. [Monitoring/detection improvement]
```
## π Shared Resources
> For cross-cutting methodology applicable to all vulnerability classes, see:
> - [`_shared/references/elite-chaining-strategy.md`](../_shared/references/elite-chaining-strategy.md) β Exploit chaining methodology and high-payout chain patterns
> - [`_shared/references/elite-report-writing.md`](../_shared/references/elite-report-writing.md) β HackerOne-optimized report writing, CWE quick reference
> - [`_shared/references/real-world-bounties.md`](../_shared/references/real-world-bounties.md) β Verified disclosed bounties by vulnerability class
## References
- SANS: [FOR610: Reverse-Engineering Malware](https://www.sans.org/cyber-security-courses/reverse-engineering-malware-malware-analysis-tools-techniques/)
- REMnux: [A Toolkit for Malware Analysts](https://remnux.org/)
- Mandiant: [Flare-VM](https://github.com/mandiant/flare-vm)