/malware-classification

name: malware-classification
description: |
  Activate this skill when the user mentions ANY of: "YARA", "YARA rules", "YARA signature",
  "write YARA", "detection rule", "packer detection", "packer identification", "packed binary",
  "UPX", "Themida", "VMProtect", "ASPack", "crypter", "obfuscated binary",
  "entropy", "entropy analysis", "section entropy", "high entropy",
  "malware family", "malware classification", "malware triage", "classify sample",
  "classify binary", "sample analysis", "unknown binary", "suspicious binary",
  "malware type", "ransomware", "RAT", "remote access trojan", "loader", "dropper",
  "stealer", "infostealer", "wiper", "botnet", "rootkit", "backdoor", "keylogger",
  "banker trojan", "cryptominer", "miner", "coinminer", "spyware", "adware",
  "fuzzy hash", "ssdeep", "TLSH", "imphash", "import hash", "similarity analysis",
  "sample similarity", "binary similarity", "homologous binary",
  "IOC", "indicator of compromise", "IOC extraction", "C2", "command and control",
  "C2 extraction", "network indicators", "host indicators",
  "malware analysis", "behavioral analysis", "static analysis", "dynamic analysis",
  "sandbox analysis", "sandbox evasion", "anti-analysis", "anti-debug", "anti-VM",
  "malware indicators", "threat classification", "campaign attribution",
  "malware report", "classification report", "triage report",
  "PEiD", "Detect It Easy", "DIE", "pestudio", "CAPEv2", "ANY.RUN",
  "VirusTotal", "MalwareBazaar", "Malpedia", "threat intel",
  "family fingerprint", "malware cluster", "behavioral signature",
  "string decryption", "config extraction", "C2 config",
  "MITRE ATT&CK", "TTP mapping", "kill chain", "execution chain".
version: 2.0.0

Malware Classification

Systematic methodology for triaging unknown binaries, classifying malware families, extracting indicators of compromise, and producing actionable intelligence. Covers the full pipeline from initial sample receipt through final classification report.

Classification Taxonomy

Know what you are looking for. Every sample maps to one of these categories:

| Category | Subcategories | Key Behavioral Signals | |----------|---------------|----------------------| | **Ransomware** | Crypto-locker, locker, wiper-ransom | File enumeration, crypto API calls, ransom note drops, shadow copy deletion | | **RAT** | Full RAT, lightweight backdoor | Reverse shell, command dispatch, screenshot capture, keylogging, file exfil | | **Loader/Dropper** | Stage-1 loader, dropper, downloader | Downloads next stage, writes to disk or injects, minimal own functionality | | **Stealer/Infostealer** | Browser stealer, credential harvester | Reads browser DBs, credential stores, clipboard, crypto wallets | | **Banker Trojan** | Web inject, form grabber, overlay | Targets banking URLs, injects into browser, form hooking | | **Botnet Agent** | DDoS bot, spam bot, proxy bot | C2 check-in loop, command polling, peer-to-peer comms | | **Rootkit** | Kernel rootkit, userland rootkit, bootkit | Driver loading, SSDT hooks, DKOM, MBR/VBR modification | | **Cryptominer** | CPU miner, GPU miner | High CPU usage, stratum protocol, mining pool connections | | **Wiper** | Destructive wiper, MBR wiper | Overwrites MBR, mass file deletion, no recovery mechanism | | **Spyware** | Keylogger, screen capture, audio capture | Input hooks, periodic screenshots, mic access | | **Adware/PUP** | Ad injector, browser hijacker | Browser extension install, DNS hijack, ad network callbacks |

Triage Workflow

Follow this sequence. Each phase feeds the next — do not skip steps.

Phase 1 — Sample Receipt and Hashing

Every analysis begins with positive identification and deduplication.

# Compute all hashes for the sample
sha256sum <sample>
md5sum <sample>
ssdeep <sample>

# Check file type
file <sample>

# Track in romero analysis DB
node ${CLAUDE_PLUGIN_ROOT}/scripts/binary-hasher.js hash <sample>
node ${CLAUDE_PLUGIN_ROOT}/scripts/analysis-tracker.js add <sha256> classification pending

Record SHA256, MD5, SHA1, ssdeep, file size, and file type before touching anything else. This is your chain of custody starting point.

Phase 2 — Static Triage (No Execution)

Static analysis extracts maximum intelligence without running the sample.

2a. PE Header Analysis

# Section table, imports, exports, timestamps, debug info
r2 -qc 'iH; iS; ii; iE; it' <sample>

# Rich header (compiler fingerprint)
r2 -qc 'iR' <sample>

# Check for anomalies with pestudio (if available)
pestudio <sample>

Look for: abnormal section names (packer signatures), section entropy above 6.5, entry point outside `.text`, minimal imports (LoadLibrary + GetProcAddress only), mismatched compile timestamps, suspicious rich header entries.

2b. Packer and Protector Detection

# Detect It Easy — best automated packer identification
diec <sample>

# YARA-based packer scan
yara -r ${CLAUDE_PLUGIN_ROOT}/rules/packers.yar <sample>

# Entropy per section (key packer signal)
r2 -qc 'iS~entropy' <sample>

If packed: identify the packer, attempt unpacking, then restart triage on the unpacked sample. See `references/packer-detection.md` for packer-specific strategies.

2c. String Extraction

# Standard strings
strings -n 6 <sample> > strings_ascii.txt
strings -n 6 -el <sample> > strings_unicode.txt

# FLOSS for obfuscated/stack strings
floss <sample> > strings_floss.txt

# Quick triage of interesting strings
strings <sample> | grep -iE '(http|ftp|\.exe|\.dll|cmd\.exe|powershell|reg\s|schtasks|net\s|wmic)'

Strings reveal: C2 URLs, file paths, registry keys, mutex names, error messages, API names, embedded configs, debug paths (PDB), campaign IDs.

2d. Import Analysis

# Full import table
r2 -qc 'ii' <sample>

# Compute imphash for family clustering
python3 -c "import pefile; pe=pefile.PE('<sample>'); print(pe.get_imphash())"

Flag these import categories:

| Category | APIs | Indicates | |------