Skip to main content Home Creators brucesongs kali-claw malware-analysis-advanced
malware-analysis-advanced Advanced malware analysis covering unpacking (UPX, VMProtect, Themida, Enigma, custom packers), sandbox-evasion detection (anti-VM, anti-debug, anti-analysis), rootkit analysis (user-mode, kernel-mode, bootkits, UEFI), YARA rule authoring and optimization, and IDA Pro / Ghidra / Binary Ninja workflows. Distinct from foundational `binary-reverse` — focuses on dynamic unpacking, evasion triage, rootkit techniques, and analyst workflow automation. Use when analyzing modern packed malware (Emotet, TrickBot, Conti, LockBit, BlackCat/ALPHV, REvil), authoring detection rules, or building automated malware triage pipelines.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/brucesongs/kali-claw --skill malware-analysis-advancedThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository Semantic-layer attack testing against AI systems and LLM-integrated applications.
Cloud security covers security assessment for major cloud platforms including AWS, Azure, and GCP, with core focus on IAM misconfiguration detection, storage bucket exposure scanning, metadata service attacks, container escape, and Kubernetes RBAC auditing.
Defensive deception and honeypot deployment covering SSH/Telnet (Cowrie), web (OpenCanary), enterprise (HFish), ICS/SCADA (Conpot), all-in-one (T-Pot), AI-driven deception (Beelzebub), Thinkst Canarytokens (DNS, HTTP, file, AWS API key, SQL), Dionaea multi-protocol honeypot, notification pipelines (Slack/Teams webhooks), false positive tuning, and attacker engagement — including lure design, deployment OPSEC, IOC extraction, and attacker attribution.
Related occupations SOC
Based on SOC occupation classification
name malware-analysis-advanced description Advanced malware analysis covering unpacking (UPX, VMProtect, Themida, Enigma, custom packers), sandbox-evasion detection (anti-VM, anti-debug, anti-analysis), rootkit analysis (user-mode, kernel-mode, bootkits, UEFI), YARA rule authoring and optimization, and IDA Pro / Ghidra / Binary Ninja workflows. Distinct from foundational `binary-reverse` — focuses on dynamic unpacking, evasion triage, rootkit techniques, and analyst workflow automation. Use when analyzing modern packed malware (Emotet, TrickBot, Conti, LockBit, BlackCat/ALPHV, REvil), authoring detection rules, or building automated malware triage pipelines. origin kali-claw version 0.2.0.2 compatibility ["kali-linux-2025-2-arm64","python-3.11+","ida-9.0+","ghidra-11.0+","binary-ninja-5.0+","radare2-5.8+","yara-4.5+","volatility3-2.7+"] allowed-tools ["ida","ghidra","binary-ninja","radare2","x64dbg","windbg","gdb","yara","volatility3","upx","vmprotect-devirt","pe-sieve","hollows-hunter","procdot","process-hacker","autoruns","pcap-ng-tools","zeek","suricata","pe-tree","imhex"] metadata {"domain":"malware-analysis","tool_count":21,"guide_count":2,"mitre":"TA0005-Defense Evasion, TA0010-Exfiltration, T1027-Obfuscated Files, T1497-Virtualization/Sandbox Evasion, T1562-Impair Defenses, T1014-Hidden Processes, T1547-Boot/Logon Autostart","last_reviewed":"2026-07-26"}
Malware Analysis Advanced
Summary
Advanced malware analysis is the discipline of unpacking, reverse engineering, and understanding modern packed/obfuscated malware (UPX, VMProtect, Themida, Enigma, custom packers), identifying sandbox-evasion techniques (anti-VM, anti-debug, anti-analysis), analyzing rootkits (user-mode, kernel-mode, bootkits, UEFI), and authoring detection rules (YARA). This domain covers full unpacking workflows (static + dynamic), modern threat actor tooling (Emotet, TrickBot, Conti, LockBit, BlackCat/ALPHV, REvil), YARA rule authoring and optimization, and industry-standard analyst tooling (IDA Pro, Ghidra, Binary Ninja, radare2). Distinct from foundational binary-reverse — this skill focuses on dynamic unpacking, evasion triage, rootkit techniques, and analyst workflow automation.
Key Terms
Packer — Tool that compresses + encrypts executable to evade AV (UPX, VMProtect, Themida)Unpacking — Recovering original executable from packed binaryAnti-VM — Code that detects virtual machine (sandbox evasion)Anti-debug — Code that detects debugger presence (analyst evasion)Anti-analysis — Umbrella term for AV/VM/debug/sandbox evasionRootkit — Tool that hides processes / files / network connectionsUser-mode rootkit — Rootkit running in ring 3 (DLL injection, API hooking)Kernel-mode rootkit — Rootkit running in ring 0 (driver, syscall hooking)Bootkit — Rootkit that infects bootloader (MBR / VBR)UEFI rootkit — Rootkit that infects UEFI firmware (persistent across reinstall)YARA — Pattern-matching tool for malware identificationPE — Portable Executable format (Windows binaries)ELF — Executable and Linkable Format (Linux binaries)Triage — Initial malware assessment (severity, family, capability)Sandbox — Isolated analysis environment (Cuckoo, JoeSandbox, Any.Run)
Scope
This skill covers advanced malware analysis :
Unpacking modern packers (UPX, VMProtect, Themida, Enigma, custom)
Sandbox-evasion detection (anti-VM, anti-debug, anti-analysis)
Rootkit analysis (user-mode, kernel-mode, bootkits, UEFI)
YARA rule authoring and optimization
IDA Pro / Ghidra / Binary Ninja workflows
Modern threat tooling (Emotet, TrickBot, Conti, LockBit, BlackCat/ALPHV, REvil)
Automated triage pipelines Out of scope : foundational RE (see binary-reverse), exploit development (see exploit-development), reverse engineering theory (see reverse-engineering-advanced).
Use Cases
Unpacking packed malware : Recover original code from VMProtect/Themida binariesSandbox evasion triage : Identify anti-VM/anti-debug techniquesRootkit detection : Find user-mode/kernel-mode rootkit techniquesYARA rule authoring : Detect malware families by signatureThreat actor tooling analysis : Reverse engineer Emotet, TrickBot, Conti, LockBit, BlackCat, REvilAutomated triage pipeline : Build Cuckoo/JoeSandbox pipeline for mass triageDetection rule optimization : Tune YARA rules for performanceMemory forensics : Use Volatility for in-memory malware analysisUEFI analysis : Identify UEFI rootkits (LoJax, MosaicRegressor)API hook detection : Find user-mode rootkit hooks
Core Tools Tool Purpose IDA ProIndustry-standard disassembler + decompiler GhidraOpen-source RE tool (NSA) Binary NinjaModern disassembler + decompiler radare2Open-source disassembler x64dbgWindows dynamic debugger WinDbgWindows kernel debugger gdbGNU Debugger (Linux) yaraPattern-matching tool for malware detection volatility3Memory forensics framework upxUPX unpacker vmprotect-devirtVMProtect devirtualization pe-sievePE artifact scanner (process memory) hollows-hunterProcess hollowing detector procdotVisual malware analysis process-hackerProcess explorer (Windows) autorunsAutostart entry scanner pcap-ng-toolsNetwork capture analysis zeekNetwork behavior analyzer suricataIDS / IPS for malware traffic pe-treeVisual PE analysis imhexModern hex editor
Methodology
Phase 1 — Static triage
sha256sum malware.exe
file malware.exe
pe-tree malware.exe
strings -a malware.exe | grep -iE "http|dll|reg|cmd"
python3 -c "
import pefile
pe = pefile.PE('malware.exe')
for section in pe.sections:
print(f'{section.Name.decode().strip():12s} entropy={section.get_entropy():.2f}')
"
Phase 2 — Unpacking
upx -d malware.exe -o malware_unpacked.exe
Phase 3 — Dynamic analysis
cuckoo submit malware.exe
volatility -f memory.dmp windows.pslist
volatility -f memory.dmp windows.netscan
volatility -f memory.dmp windows.malfind
Phase 4 — Sandbox evasion detection
strings malware.exe | grep -iE "vmware|virtualbox|qemu|hyper-v|xen"
strings malware.exe | grep -iE "vbox|vmware tools|prl_"
strings malware.exe | grep -iE "IsDebuggerPresent|CheckRemoteDebuggerPresent|NtQueryInformationProcess"
Phase 5 — Rootkit analysis
pe-sieve /pid 1234 /imp 3
hollows-hunter /pid 1234
bcdedit /enum firmware
Phase 6 — YARA rule authoring rule Emotet_Loader_v4 {
meta:
author = "redteam"
date = "2026-06-28"
description = "Emotet v4 loader"
reference = "https://attack.mitre.org/software/S0679/"
strings:
$s1 = "emotet" wide ascii nocase
$s2 = { 6A 40 68 00 30 00 00 6A 14 8D 91 }
$s3 = "%u%.4x" wide ascii
$api1 = "CryptStringToBinaryA" wide
$api2 = "InternetOpenA" wide
condition:
uint16(0) == 0x5A4D and
3 of ($s*) and
2 of ($api*)
}
Phase 7 — IDA Pro workflow
import idautils, idc
for func_ea in idautils.Functions():
name = idc.get_func_name(func_ea)
if name in ["IsDebuggerPresent" , "CheckRemoteDebuggerPresent" ]:
print (f"Anti-debug: {name} at {hex (func_ea)} " )
import ida_hexrays
cf = ida_hexrays.decompile(func_ea)
print (cf)
Phase 8 — Ghidra workflow
from ghidra.program.model.symbol import SymbolType
sm = currentProgram.getSymbolTable()
for sym in sm.getAllSymbols(True ):
if sym.getSymbolType() == SymbolType.FUNCTION:
name = sym.getName()
if "VirtualProtect" in name or "WriteProcessMemory" in name:
print (f"Inject: {name} at {sym.getAddress()} " )
Phase 9 — Memory forensics (Volatility)
volatility -f memory.dmp windows.pslist
volatility -f memory.dmp windows.netscan
volatility -f memory.dmp windows.malfind
volatility -f memory.dmp windows.dlllist --pid 1234
volatility -f memory.dmp windows.modscan
Phase 10 — Reporting Produce malware analysis report:
Family + variant
IOCs (hashes, domains, IPs, mutexes)
TTP mapping (MITRE ATT&CK)
YARA rules
Detection recommendations
Practical Steps
Step 1 — Triage new sample
sha256sum malware.exe > hash.txt
curl -s "https://www.virustotal.com/api/v3/files/$(sha256sum malware.exe | cut -d' ' -f1) " \
-H "x-apikey: $VT_KEY " | jq .
pe-tree malware.exe
Step 2 — Unpack UPX sample upx -d malware_packed.exe -o malware_unpacked.exe
sha256sum malware_unpacked.exe
file malware_unpacked.exe
strings -a malware_unpacked.exe | grep -iE "http|dll"
Step 3 — Unpack VMProtect sample
Step 4 — Identify anti-VM
strings malware.exe | grep -iE "vmware|virtualbox|qemu"
strings malware.exe | grep -iE "vmware tools|vbox guest additions"
strings malware.exe | grep -iE "SYSTEM\\\\CurrentControlSet\\\\Services\\\\VBoxGuest"
Step 5 — YARA rule authoring rule BlackCat_ALPHV_Ransomware {
meta:
author = "redteam"
description = "BlackCat/ALPHV Rust-based ransomware"
reference = "https://attack.mitre.org/software/S1068/"
strings:
$rust = "rust_panic" wide ascii
$s1 = "BlackCat" wide ascii nocase
$s2 = "{ 52 75 73 74 }" // "Rust" in hex
$api1 = "CryptEncrypt" wide
$api2 = "BCryptEncrypt" wide
condition:
uint16(0) == 0x5A4D and
$rust and
any of ($s*) and
any of ($api*)
}
Step 6 — Memory forensics volatility -f memory.dmp windows.pslist | grep -v "Microsoft\|Windows"
volatility -f memory.dmp windows.netscan
volatility -f memory.dmp windows.malfind --pid 1234
Step 7 — Rootkit detection
pe-sieve /pid 1234 /imp 3
hollows-hunter /pid 1234
autoruns -accepteula -a autostart.arn
Defense Perspective
Packed malware evades AV signature — unpacking + behavioral detection requiredSandbox evasion defeats dynamic analysis — anti-VM must be bypassedRootkits hide in kernel — kernel-mode detection (PatchGuard, EDR) requiredUEFI rootkits persist across reinstall — firmware scanning requiredYARA rules need constant tuning — false positives / false negativesMemory forensics catches fileless malware — Volatility essentialThreat actor tooling evolves rapidly — analyst workflow automation neededMalware uses LOLBins — signed binaries (certutil, bitsadmin) bypass allowlist
Behavior-based detection (EDR / XDR)
Memory scanning (pe-sieve, hollows-hunter)
YARA scanning at egress + endpoint
Volatility memory forensics for IR
Application allowlisting (AppLocker, WDAC)
Kernel-mode protection (PatchGuard)
UEFI Secure Boot
Behavioral baseline for processes
Packer Triage Cheat Sheet Packer Detection Unpacking difficulty UPX Section ".UPX0/.UPX1" Easy (upx -d) ASPack Section ".aspack" Medium (manual) Themida Section ".Themida" Hard (WinDbg) VMProtect Section ".vmp0/.vmp1" Very Hard (devirt) Enigma Section ".enigma1/.enigma2" Hard Custom High entropy + obfuscation Very Hard
Sandbox Evasion Techniques Technique Detection Bypass CPUID VM bit Static strings Patch CPUID Registry VM keys Strings (VMware, VBox) Registry scrub MAC address OUI Network adapter Spoof MAC Process count Psapi enumeration Inject extra processes Sleep + check Timing analysis Hook sleep Mouse movement Cursor position Virtual mouse Disk size <60GB = VM Larger VMDK Recent files User profile age Pre-populate
Rootkit Categories Type Ring Persistence Example User-mode 3 Registry Hacker Defender Kernel-mode 0 Driver Rustock Bootkit 0 MBR/VBR TDL4 UEFI -1 Firmware LoJax
Threat Actor Tooling Family Type Packer Notable Techniques Emotet Loader Custom Macro dropper, polymorphic TrickBot Banking trojan Custom Process hollowing, anti-VM Conti Ransomware Custom LockBit-shared code, Rclone exfil LockBit 3.0 Ransomware Custom StealBit exfil, customizable BlackCat/ALPHV Ransomware Rust MEGA exfil, cross-platform REvil Ransomware Custom Affiliate program, onion leak
Engagement Workflow
Triage — hash, file type, PE analysis, VT lookupStatic analysis — strings, section entropy, import analysisUnpacking — UPX/manual/VMProtect devirtDynamic analysis — sandbox + manual x64dbgEvasion triage — anti-VM, anti-debug, anti-analysisRootkit detection — user/kernel/boot/UEFIYARA authoring — detection rulesReporting — IOCs, TTPs, detection recommendations
Lab Setup
git clone https://github.com/cuckoosandbox/cuckoo
cd cuckoo && python3 setup.py install
wget https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_11.0_build/ghidra_11.0_PUBLIC_20231222.zip
unzip ghidra_11.0_PUBLIC_20231222.zip
pip install volatility3
pip install yara-python
Quality Checklist
Detection Methods
Static Analysis Detection
AV signatures : YARA rules, ClamAV signatures match known malware families.Entropy analysis : PE sections with entropy > 7.0 (packed/encrypted).Import table anomalies : Missing imports (LoadLibrary, GetProcAddress); imports via hash resolution.PE structure anomalies : Imports via only LoadLibraryA/GetProcAddress; signature of dynamic resolution.
Dynamic Analysis Detection
Sandbox detonation : Cuckoo, Joe Sandbox; behavioral signatures.API call sequences : Mimikatz signature (OpenProcess + ReadProcessMemory + WriteProcessMemory on lsass).Network anomalies : Connections to known C2 infrastructure (Cobalt Strike teamserver default ports).
SIEM Detection Rules
Splunk SPL : index=malware sourcetype=yara | where rule matches "mimikatz/*"YARA rules : Continuous scanning of filesystem for known signatures.AMSI integration : Scan PowerShell, VBA, JavaScript content via AMSI.
Defense Evasion Techniques
Anti-Analysis
Anti-debugging : IsDebuggerPresent, ntdll!KdUserExceptionDispatcher check, timing checks (rdtsc).Anti-VM : MAC address check (VMware 00:50:56), CPUID hypervisor bit, registry artifacts.Anti-sandbox : Mouse movement check (real users have jitter), recent documents check, uptime check.Anti-AV : Process enumeration looking for av processes; exit if found.
Code Obfuscation
Packing : UPX, ASPack, Themida, VMProtect; detect via entropy.Polymorphic code : Decryptor changes; payload signature constant.Metamorphic code : Body rewritten each generation; no static signature.Control flow flattening : Switch dispatcher; defeats static analysis.Junk code insertion : No-op instructions between real instructions.String encryption : Encrypt sensitive strings; decrypt at runtime only.
Memory-Resident Evasion
Reflective DLL injection : Load DLL from memory; no file artifacts.Process hollowing : Replace legitimate process memory; appears as legitimate process.Module stomping : Load legitimate DLL, overwrite; inherits module legitimacy.Phantom DLL hollowing : Hollow rarely-used DLL; less attention.
Modern AV/EDR Bypass
AMSI bypass : Patch amsi.dll!AmsiScanBuffer in-memory.ETW bypass : Patch ntdll!EtwEventWrite in-memory.Direct syscalls : Bypass user-mode hooks (SysWhispers, HellsGate).BYOVD : Load vulnerable signed driver for kernel R/W.
References 