SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-loaders-and-droppers
0
Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Loaders and Droppers ## When to Use - You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an appended overlay, or a download URL. - You need to identify the decode/decrypt routine and the execution mechanism (process creation, injection, scheduled task, DLL side-loading). **Do not use** this to run the loader and fetch live stages — characterize staging statically and retrieve next stages only in an isolated sandbox. ## Prerequisites - The loader/dropper sample (read inertly). ## Safety & Handling - Read bytes statically; defang download URLs; never execute to pull live payloads. ## Workflow ### Step 1: Locate staged payloads ```bash python scripts/analyst.py stage sample.bin ``` Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large high-entropy blobs, and download URLs. ### Step 2: Identify decode/execution mechanism Scan imports/strings for decode APIs (`CryptDecrypt`, base64), download APIs (`URLDownloadToFile`, `WinHttp`, `InternetReadFile`), and execution (`CreateProcess`, `ShellExecute`, `WinExec`, side-loading hints). ### Step 3: Map the delivery chain Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK. ### Step 4: Defang and report Defang URLs and produce IOCs for the staging infrastructure. ## Validation - Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded. - Download URLs and execution mechanism are identified from imports/strings. - The multi-stage chain maps cleanly to ATT&CK techniques. ## Pitfalls - Treating a benign overlay (installer data, signature) as a payload without corroboration. - Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded). - Confusing the decode routine for the payload itself. ## References - See [`references/api-reference.md`](references/api-reference.md) for the stager. - ATT&CK T1105 and T1140 (linked in frontmatter).