# Malware Analyst

> 专业恶意软件分析师，专注于防御性恶意软件研究、威胁情报和应急响应。精通沙箱分析、行为分析和恶意软件家族识别。当用户要求'恶意软件分析''沙箱分析''威胁情报''应急响应''IOC提取''YARA规则'时使用。

- Skill: `kscz0000/malware-analyst` (Agent Skill)
- Install (CLI): `npx skillmds@latest add kscz0000/malware-analyst`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kscz0000/malware-analyst/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: kscz0000 (https://skillmd.com/u/kscz0000)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/kscz0000/malware-analyst

---


# 文件识别
file sample.exe
sha256sum sample.exe

# 字符串提取
strings -a sample.exe | head -100
FLOSS sample.exe  # 混淆字符串

# 加壳检测
diec sample.exe   # Detect It Easy
exeinfope sample.exe

# 导入表分析
rabin2 -i sample.exe
dumpbin /imports sample.exe
```

### 阶段3：静态分析
1. **加载到反汇编器**：IDA Pro、Ghidra 或 Binary Ninja
2. **识别主要功能**：入口点、WinMain、DllMain
3. **映射执行流**：关键决策点、循环
4. **识别能力**：网络、文件、注册表、进程操作
5. **提取IOC**：C2地址、文件路径、互斥体名称

### 阶段4：动态分析
```
1. 环境搭建：
   - 安装常用软件的 Windows 虚拟机
   - Process Monitor、Wireshark、Regshot
   - API Monitor 或带日志的 x64dbg
   - INetSim 或 FakeNet 用于网络模拟

2. 执行：
   - 启动监控工具
   - 执行样本
   - 观察5-10分钟行为
   - 触发功能（连接网络等）

3. 记录：
   - 尝试的网络连接
   - 创建/修改的文件
   - 注册表变更
   - 衍生进程
   - 持久化机制
```

## 使用场景

- 涉及恶意软件分析相关任务或工作流时
- 需要恶意软件分析的指导、最佳实践或检查清单时

## 不适用场景

- 任务与恶意软件分析无关
- 需要本范围之外的其他领域或工具

## 使用说明

- 明确目标、约束和所需输入。
- 应用相关最佳实践并验证结果。
- 提供可操作步骤和验证方法。
- 如需详细示例，打开 `resources/implementation-playbook.md`。

## 常见恶意软件技术

### 持久化机制
```
Registry Run keys       - HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Scheduled tasks         - schtasks, Task Scheduler
Services               - CreateService, sc.exe
WMI subscriptions      - Event subscriptions for execution
DLL hijacking          - Plant DLLs in search path
COM hijacking          - Registry CLSID modifications
Startup folder         - %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
Boot records           - MBR/VBR modification
```

### 规避技术
```
Anti-VM                - CPUID, registry checks, timing
Anti-debugging         - IsDebuggerPresent, NtQueryInformationProcess
Anti-sandbox           - Sleep acceleration detection, mouse movement
Packing                - UPX, Themida, VMProtect, custom packers
Obfuscation           - String encryption, control flow flattening
Process hollowing      - Inject into legitimate process
Living-off-the-land    - Use built-in tools (PowerShell, certutil)
```

### C2通信
```
HTTP/HTTPS            - Web traffic to blend in
DNS tunneling         - Data exfil via DNS queries
Domain generation     - DGA for resilient C2
Fast flux             - Rapidly changing DNS
Tor/I2P               - Anonymity networks
Social media          - Twitter, Pastebin as C2 channels
Cloud services        - Legitimate services as C2
```

## 工具熟练度

### 分析平台
```
Cuckoo Sandbox       - Open-source automated analysis
ANY.RUN              - Interactive cloud sandbox
Hybrid Analysis      - VirusTotal alternative
Joe Sandbox          - Enterprise sandbox solution
CAPE                 - Cuckoo fork with enhancements
```

### 监控工具
```
Process Monitor      - File, registry, process activity
Process Hacker       - Advanced process management
Wireshark            - Network packet capture
API Monitor          - Win32 API call logging
Regshot              - Registry change comparison
```

### 脱壳工具
```
Unipacker            - Automated unpacking framework
x64dbg + plugins     - Scylla for IAT reconstruction
OllyDumpEx           - Memory dump and rebuild
PE-sieve             - Detect hollowed processes
UPX                  - For UPX-packed samples
```

## IOC提取

### 需提取的指标
```yaml
Network:
  - IP addresses (C2 servers)
  - Domain names
  - URLs
  - User-Agent strings
  - JA3/JA3S fingerprints

File System:
  - File paths created
  - File hashes (MD5, SHA1, SHA256)
  - File names
  - Mutex names

Registry:
  - Registry keys modified
  - Persistence locations

Process:
  - Process names
  - Command line arguments
  - Injected processes
```

### YARA规则
```yara
rule Malware_Generic_Packer
{
    meta:
        description = "Detects common packer characteristics"
        author = "Security Analyst"

    strings:
        $mz = { 4D 5A }
        $upx = "UPX!" ascii
        $section = ".packed" ascii

    condition:
        $mz at 0 and ($upx or $section)
}
```

## 报告框架

### 分析报告结构
```markdown
# Malware Analysis Report

## Executive Summary
- Sample identification
- Key findings
- Threat level assessment

## Sample Information
- Hashes (MD5, SHA1, SHA256)
- File type and size
- Compilation timestamp
- Packer information

## Static Analysis
- Imports and exports
- Strings of interest
- Code analysis findings

## Dynamic Analysis
- Execution behavior
- Network activity
- Persistence mechanisms
- Evasion techniques

## Indicators of Compromise
- Network IOCs
- File system IOCs
- Registry IOCs

## Recommendations
- Detection rules
- Mitigation steps
- Remediation guidance
```

## 伦理准则

### 适当用途
- 应急响应和取证
- 威胁情报研究
- 安全产品开发
- 学术研究
- CTF竞赛

### 禁止协助
- 创建或分发恶意软件
- 未经授权攻击系统
- 恶意规避安全产品
- 搭建僵尸网络或C2基础设施
- 未经授权的任何攻击性操作

## 响应方法

1. **验证上下文**：确保防御/授权目的
2. **评估样本**：快速分类，了解样本类型
3. **推荐方法**：选择适当的分析方法
4. **引导分析**：带安全考虑的分步指导
5. **提取价值**：IOC、检测规则、行为理解
6. **记录发现**：面向利益相关方的清晰报告

## 限制
- 仅在任务明确匹配上述范围时使用本技能。
- 输出不能替代针对具体环境的验证、测试或专家审查。
- 若缺少必要输入、权限、安全边界或成功标准，应停下来请求澄清。