# Anti Malware

> Defensive malware detection and analysis skill. Use when user needs to detect, analyze, or defend against malicious software - including static/dynamic analysis, IOC extraction, YARA rule creation, sandbox behavioral analysis, memory forensics, and threat hunting. Trigger on: "detect malware", "analyze suspicious file", "malware analysis", "threat hunting", "IOC extraction", "YARA rules", "sandbox analysis", "memory forensics", "malware defense", "antivirus evasion detection".

- Skill: `belentani7/anti-malware` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add belentani7/anti-malware`
- Raw SKILL.md: https://api.skillmd.com/api/skills/belentani7/anti-malware/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: belentani7 (https://skillmd.com/u/belentani7)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/belentani7/anti-malware

---


# Anti-Malware Defense Skill

Defensive cybersecurity skill for malware detection, analysis, and mitigation. Focuses on legitimate security operations: identifying threats, extracting indicators of compromise, and hardening systems.

## Core Capabilities

### 1. Static Analysis
- File header/magic byte verification
- PE/ELF structure analysis (imports, sections, resources)
- String extraction and entropy analysis
- Packer/crypter detection (UPX, ASPack, custom)
- YARA rule matching and creation
- Hash calculation (MD5, SHA1, SHA256, SSDEEP, TLSH)

### 2. Dynamic/Behavioral Analysis
- Process monitoring (API calls, registry, filesystem, network)
- Sandbox execution with API hooking (Cuckoo, CAPE, custom)
- Network traffic analysis (PCAP, DNS, HTTP, C2 detection)
- Persistence mechanism identification
- Anti-analysis/anti-VM technique detection

### 3. Memory Forensics
- Volatility/Volatility3 plugin usage
- Process listing, DLL injection detection
- Rootkit detection (DKOM, SSDT hooks, IDT)
- Encrypted payload extraction
- Shellcode identification

### 4. Threat Intelligence & IOC
- IOC extraction (IPs, domains, hashes, mutexes, registry keys)
- MITRE ATT&CK technique mapping
- Threat feed integration (MISP, OpenCTI, AlienVault OTX)
- Campaign attribution support

## Workflow

```
1. TRIAGE
   - Hash lookup (VirusTotal, MalwareBazaar, Hybrid Analysis)
   - Quick static properties (file type, architecture, compiler)
   - Entropy/packer check

2. STATIC ANALYSIS
   - Disassembly (IDA, Ghidra, radare2)
   - String/import analysis
   - YARA scanning
   - Configuration extraction

3. DYNAMIC ANALYSIS
   - Sandbox execution
   - Behavioral monitoring
   - Network capture
   - Memory dump acquisition

4. DOCUMENTATION
   - IOC report (STIX/JSON)
   - YARA rules for detection
   - Mitigation recommendations
   - ATT&CK mapping
```

## Tools & References

### Primary Tools
- **Static**: Ghidra, IDA Free, radare2, CFF Explorer, PE-bear, YARA
- **Dynamic**: Cuckoo Sandbox, CAPE, ANY.RUN, Joe Sandbox, Procmon, Regshot
- **Memory**: Volatility3, Rekall, WinDbg, GDB
- **Network**: Wireshark, Zeek, NetworkMiner, Arkime
- **Intel**: MISP, OpenCTI, YARA-Rules repo, VirusTotal API

### Reference Files
- `references/yara-rules.md` - YARA rule patterns and best practices
- `references/mitre-attack.md` - ATT&CK technique reference
- `references/ioc-formats.md` - STIX/JSON IOC templates
- `references/packer-signatures.md` - Known packer detection patterns

## Output Formats

### Malware Analysis Report
```markdown
# Malware Analysis Report: <sample-name>

## Executive Summary
- Classification: <trojan/ransomware/rootkit/botnet/etc>
- Severity: <Critical/High/Medium/Low>
- Confidence: <High/Medium/Low>

## Static Indicators
- File Hash (SHA256): <hash>
- File Type: <PE32/ELF64/Script/etc>
- Architecture: <x86/x64/ARM>
- Packer: <detected or "none">
- Entropy: <value>
- Imports: <suspicious APIs>
- Strings: <relevant IOCs>

## Behavioral Indicators
- Process Injection: <yes/no + technique>
- Persistence: <registry/scheduled task/service/etc>
- Network: <C2 domains/IPs, protocols>
- Filesystem: <dropped files, encryption>
- Anti-Analysis: <VM detection, debugger detection>

## MITRE ATT&CK Mapping
| Technique ID | Technique Name | Observation |
|--------------|----------------|-------------|
| T1055        | Process Injection | ... |
| T1547        | Boot/Logon Autostart | ... |

## IOCs (STIX/JSON)
```json
{
  "indicators": [
    {"type": "file", "value": "<sha256>", "description": "Malware sample"},
    {"type": "domain", "value": "<c2.domain>", "description": "C2 server"}
  ]
}
```

## YARA Detection Rule
```yara
rule <malware_family>_<variant> {
    meta:
        description = "<family> variant <variant>"
        author = "analyst"
        date = "YYYY-MM-DD"
        hash = "<sha256>"
    strings:
        $s1 = "<unique_string>" ascii wide
        $s2 = { <hex_pattern> }
    condition:
        any of them
}
```

## Mitigation Recommendations
1. Block IOCs at perimeter (firewall, proxy, DNS)
2. Deploy YARA rule to EDR/XDR
3. Hunt for behavioral indicators in environment
4. Patch exploited vulnerabilities
5. User awareness for delivery vector
```

## Trigger Phrases
Use this skill when user mentions:
- "analyze this suspicious file"
- "malware analysis" / "malware detection"
- "create YARA rule" / "YARA signature"
- "threat hunting" / "IOC extraction"
- "sandbox analysis" / "dynamic analysis"
- "memory forensics" / "volatility"
- "reverse engineering malware"
- "antivirus evasion detection"
- "packer detection"
- "C2 communication analysis"
- "ransomware analysis"
- "process injection detection"
- "rootkit detection"