| name | malware-analysis |
| description | Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing) |
| metadata | {"type":"defensive","phase":"analysis","tools":"capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata","mitre":"TA0042"} |
| kill_chain | {"phase":["weaponize"],"step":[2],"attck_tactics":["TA0042","TA0005","TA0011"],"attck_techniques":["T1027","T1027.002","T1027.013","T1140","T1055","T1055.012","T1620","T1562.001","T1497","T1547.001","T1546.003","T1059.001","T1071.001","T1071.004","T1573","T1572","T1568.002","T1480"]} |
| depends_on | ["reverse-engineering"] |
| feeds_into | ["threat-hunting","incident-response","edr-evasion","network-attack"] |
| inputs | ["malware_sample","memory_image","pcap_capture","sandbox_report"] |
| outputs | ["yara_rules","ioc_list","behavioral_report","malware_config","capability_map","c2_indicators"] |
| references | ["references/static-triage-capa.md","references/unpacking-deobfuscation.md","references/dynamic-fileless-memory.md","references/config-c2-extraction.md","references/network-c2-detection.md","references/yara-detection-engineering.md"] |
| scripts | ["scripts/triage.py","scripts/auto_unpack.py","scripts/frida_unpack.js","scripts/cs_config_extract.py","scripts/mem_triage.py","scripts/beacon_profiler.py","scripts/yara_gen.py"] |
