malware-triage

name	malware-triage
description	Defensive malware triage for a local sample the user supplied. Use when the user asks to 看样本, IOC, family, YARA, packed loader, suspicious binary/script, or extract indicators for detection. Do not use to write malware, C2, or evasion. Prefer re-autopilot when the goal is clean-room logic recovery rather than threat notes.

Malware Triage

Defensive first hour on a guest-supplied sample. Goal: decide what it is, what it touches, and what to hunt — without detonating it on a gold host.

Scope

• Work on a copy. Hash the original. Record filename, size, type.
• Prefer a throwaway directory and no network, unless the guest explicitly wants a contained detonation.
• Do not upload the sample to a public sandbox unless asked.
• Do not produce builders, crypters, stealers, or evasion kits.

Hour-zero loop

preserve → identify → static cheap → (optional) contained dynamic → IOC + detection

1. Preserve

cp -- sample sample.bak
sha256sum sample
file sample

Note Magics, overlay, archive members. If it is a zip/iso/img, list members before extracting; extract to a sibling dir.

2. Identify

Cheap questions, in order:

• Document / script / PE / ELF / Mach-O / APK / firmware / disk?
• Packer or installer? (UPX, NSIS, Inno, MSIX, PyInstaller, packed ELF)
• Signed? (Windows catalog / codesign) Who is the publisher?
• Obvious lure name vs real type (invoice.pdf.exe, polyglot)

If it is a clean-room crackme / CTF toy with a flag check, hand off to $ctf-autopwn or $re-autopilot. This skill is for threat-shaped samples.

3. Static cheap (no execute)

• strings -n 8 and wide strings. Collect URLs, IPs, mutexes, user-agents, registry paths, PDB, build IDs. Mark unconfirmed.
• Imports / exports / sections. High entropy .text or a tiny stub + fat overlay → packed.
• For scripts: read the outer layer. Decode one encoding at a time (base64, xor, gzip). Stop at the first clear purpose statement (downloader, stealer, ransomware note, miner).
• For APK: Manifest permissions + exported components + suspicious receivers; then $re-autopilot apk lane if logic is needed.
• YARA only if rules exist locally. Do not invent family names from one string.

Write a ledger: observation → hypothesis → next test.

4. Contained dynamic (optional)

Only if the guest wants behavior and you have a throwaway box/VM/container.

• Snapshot first. No shared folders you care about.
• Run with outbound blocked or sinkholed DNS if possible.
• Record process tree, files dropped, persistence keys, DNS/HTTP destinations.
• Stop after the first clear behavior. Do not "see how far it goes."

If no sandbox: stay static and say so.

5. IOC and detection

Emit only indicators you actually saw:

Type	Value	Where seen	Confidence
sha256	…	original	confirmed
domain	…	strings / traffic	lead or confirmed
mutex / path	…	strings / runtime	…

Pair every confirmed behavior with a defensive artifact when possible: a YARA string set from observed bytes, or a Sigma-style hunt idea (process + network). No "undetectable" claims.

Family talk

Do not baptize a family from a single PDB or GitHub string. Say "consistent with X" and list the overlapping indicators. If nothing matches, call it "unclassified loader/dropper/implant" plus the behavior.

Handoff

• Need protocol / C2 grammar recovered → $net-reverse (still no implant).
• Need source bug that the sample exploits → $netsec-audit on the victim software, not the implant.
• Need a CTF flag → $ctf-autopwn.

Completion

1. What it is (type, packer, likely role).
2. What you actually observed (not folklore).
3. IOC table.
4. Recommended next containment / hunt step.
5. What you did not run (network, detonation).