malware-check

name

malware-check

description

Analyze code, binaries (.exe, .app, .dll, .apk, .ipa), and projects for malicious patterns, backdoors, reverse shells, crypto miners, ransomware, supply chain attacks, and privacy violations. Use this skill whenever the user asks to check if code is malicious, scan a binary for malware, verify an app is safe, audit code security, detect obfuscated payloads, analyze a suspicious file, or review a project for backdoors. Also use when the user mentions "is this safe", "check for malware", "scan this binary", "is this app malicious", "security scan", or "malware analysis".

malware-check

Static and dynamic analysis tool for detecting malicious code, suspicious binaries, and privacy violations.

Prerequisites

Ensure malware-check is installed:

pip install malware-check

For full capabilities:

pip install malware-check pefile lief yara-python

Verify with: malware-check info

If not installed, install it before proceeding.

What It Detects

• Reverse shells (Python, Bash, PowerShell, PHP, Ruby, Perl, Go, Java, C/C++)
• Backdoors (web shells in PHP/JSP/ASP.NET, command injection in all languages, bind shells, hidden routes, user creation, remote code loading)
• Obfuscation (base64+eval, charcode, hex payloads, ROT13, URL encoding - auto-decoded before scanning)
• Crypto miners (stratum pools, mining APIs, wallet addresses)
• Ransomware (file encryption walks, ransom messages)
• Credential theft (hardcoded secrets, clipboard theft, browser credential harvesting)
• Supply chain attacks (malicious install hooks, dependency confusion)
• Persistence (cron, schtasks, registry Run keys, LaunchAgents, SUID)
• Keyloggers (keyboard hooks across platforms)
• Privacy violations (40+ tracking SDKs, PII fields, invasive permissions)
• Binary indicators (packed binaries, RWX sections, suspicious imports, unsigned code)
• Unsafe deserialization, template injection (SSTI)

Usage

Scan source code or project directory

malware-check scan <path> --verbose

Scan a compiled binary (.exe, .dll, .app, .dmg, .elf)

malware-check scan <binary-path> --verbose

Scan with Docker behavioral analysis

# Build sandbox first (one-time)
malware-check build-sandbox

# Run with dynamic analysis
malware-check scan <binary-path> --dynamic --verbose

Scan mobile apps (.apk, .ipa)

malware-check scan app.apk --mobile --verbose

Generate reports

# JSON
malware-check scan <path> --format json -o report.json

# HTML dashboard
malware-check scan <path> --format html -o report.html

# SARIF (for CI/CD)
malware-check scan <path> --format sarif -o report.sarif

Workflow

1. Run malware-check scan <target> --verbose first to get an overview
2. If findings are detected, run malware-check scan <target> --format html -o report.html for a detailed HTML report
3. For binaries, add --dynamic for behavioral analysis in Docker sandbox
4. For mobile apps, add --mobile for MobSF analysis
5. Present findings to the user organized by severity (Critical > High > Medium > Low)
6. For each finding, include: severity, category, file path, line number, evidence, and recommendation
7. Use the SARIF format (--format sarif) when integrating with CI/CD pipelines

Custom YARA Rules

Point to a custom rules directory:

malware-check scan <path> --yara-rules /path/to/rules/

Investigation Tools

When deeper analysis is needed beyond what malware-check provides, refer to docs/INVESTIGATION_TOOLS.md for 60+ recommended tools organized by file type (binary, PE, Mach-O, mobile, network, YARA, sandboxes, SAST, threat intel).

Key CLI Options

Flag	Purpose
--verbose / -v	Show detailed findings with evidence
--format / -f	Output: console, json, html, sarif
-o / --output	Output file path
--dynamic	Enable Docker sandbox behavioral analysis
--mobile	Enable MobSF mobile analysis
--yara-rules	Custom YARA rules directory
--exit-code	Non-zero exit on findings (for CI)
--no-privacy	Disable privacy analysis