malware-analysis-skill

Analyze suspicious files, executables, and samples for malicious behavior using the Practical Malware Analysis methodology (Sikorski & Honig), orchestrated through the REMnux MCP server. Use whenever the user asks to triage, reverse-engineer, analyze, investigate, unpack, or figure out what a binary does — PE (.exe/.dll/.sys), ELF, Mach-O, script, Office doc, PDF, archive, or raw shellcode. Covers the full four-layer methodology — basic static (hashes, strings, PE/ELF headers, imports, packing), basic dynamic (sandbox/Procmon/FakeNet), advanced static (Ghidra/IDA disassembly), and advanced dynamic (x64dbg debugging, unpacking, anti-analysis bypass). Produces IOC extraction, MITRE ATT&CK TTP mapping, host- and network-based detections, and analyst reports with STIX 2.1 output for OpenCTI ingestion. Trigger even for low-signal phrasings like 'what is this file', 'is this malicious', 'I got this dropper', or 'pulled this off a workstation'.