/malware-analysis

name: malware-analysis
description: Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
metadata:
  type: defensive
  phase: analysis
  tools: capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata
  mitre: TA0042
kill_chain:
  phase: [weaponize]
  step: [2]
  attck_tactics: [TA0042, TA0005, TA0011]
  attck_techniques: [T1027, T1027.002, T1027.013, T1140, T1055, T1055.012, T1620, T1562.001, T1497, T1547.001, T1546.003, T1059.001, T1071.001, T1071.004, T1573, T1572, T1568.002, T1480]
depends_on: [reverse-engineering]
feeds_into: [threat-hunting, incident-response, edr-evasion, network-attack]
inputs: [malware_sample, memory_image, pcap_capture, sandbox_report]
outputs: [yara_rules, ioc_list, behavioral_report, malware_config, capability_map, c2_indicators]
references:
  - references/static-triage-capa.md
  - references/unpacking-deobfuscation.md
  - references/dynamic-fileless-memory.md
  - references/config-c2-extraction.md
  - references/network-c2-detection.md
  - references/yara-detection-engineering.md
scripts:
  - scripts/triage.py
  - scripts/auto_unpack.py
  - scripts/frida_unpack.js
  - scripts/cs_config_extract.py
  - scripts/mem_triage.py
  - scripts/beacon_profiler.py
  - scripts/yara_gen.py

Malware Analysis

When to Activate

• Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
• Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).
• Detonating safely and recovering **fileless / in-memory** artifacts (injection, AMSI/ETW patching, WMI persistence).
• Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.
• Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).
• Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

| Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py | | Per-section entropy + packer/RWX/EP heuristics | T1027.002 | CWE-1066 | references/static-triage-capa.md | scripts/triage.py | | Obfuscated string recovery (FLOSS) | T1140, T1027.013 | CWE-656 | references/static-triage-capa.md | scripts/triage.py | | Capability detection → ATT&CK (capa, static+dynamic) | T1027 | CWE-506 | references/static-triage-capa.md | scripts/triage.py | | Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling) | T1140, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/auto_unpack.py | | DBI unpacking via API hooks (Frida) | T1055, T1620 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js | | .NET deobfuscation/unpacking (de4dot/dnSpyEx) | T1027, T1140 | CWE-656 | references/unpacking-deobfuscation.md | scripts/frida_unpack.js | | Sandbox detonation + behavioral capture | T1497 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Memory injection/hollowing/ghosting analysis (Vol3) | T1055, T1055.012 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | AMSI/ETW in-memory patch + patchless detection | T1562.001 | CWE-693 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Fileless WMI/registry/PowerShell persistence | T1546.003, T1547.001, T1059.001 | CWE-506 | references/dynamic-fileless-memory.md | scripts/mem_triage.py | | Cobalt Strike / AdaptixC2 config extraction | T1071.001, T1573 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Config framework at scale (MACO/CAPE) | T1071.001 | CWE-798 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Generic unknown-C2 protocol RE + decoder | T1573, T1071.004 | CWE-311 | references/config-c2-extraction.md | scripts/cs_config_extract.py | | Beacon cadence/jitter detection (PCAP/Zeek) | T1071.001, T1029 | CWE-778 | references/network-c2-detection.md | scripts/beacon_profiler.py | | JA4+ TLS/HTTP/cert fingerprinting (Sliver/Havoc JA4X) | T1071.001, T1573 | CWE-295 | references/network-c2-detection.md | scripts/beacon_profiler.py | | Tunneled/DoH C2 surfacing (cloudflared/chisel) | T1572, T1568.002, T1071.004 | CWE-441 | references/network-c2-detection.md | scripts/beacon_profiler.py | | YARA-X family rule authoring + FP validation | T1027 | CWE-506 | references/yara-detection-engineering.md | scripts/yara_gen.py |

Quick Start

# 1. Static triage: hashes + PE anomalies + capability combos + FLOSS/capa/YARA-X
python3 scripts/triage.py sample.exe --floss --capa --yara rules/family.yar --json out/triage.json
capa -j sample.exe > out/capa.json                       # capabilities -> ATT&CK

# 2. Unpack (try emulation first; DBI fallback in isolated VM)
python3 scripts/auto_unpack.py sample.exe -o out/dumps/  # static emulation, no detonation
frida -f C:\sample.exe -l scripts/frida_unpack.js --no-pause   # DBI, isolated VM only
de4dot sample.exe -o cleaned.exe                         # .NET layer

# 3. Dynamic + memory (capture mem BEFORE remediation)
python3 scripts/mem_triage.py -f mem.raw --vol vol --patch-hunt --json out/mem.json

# 4. Config + C2 extraction
python3 scripts/cs_config_extract.py beacon.bin --json    # Cobalt Strike
python3 1768.py -S beacon.bin                             # full CS incl. runtime/heap config
configextractor sample.bin                               # MACO/MWCP/CAPE at scale

# 5. Network C2 detection
python3 scripts/beacon_profiler.py capture.pcap --min-beacons 6     # cadence/jitter
zeek -r