| name | malware-triage |
| description | Defensive malware triage for a local sample the user supplied. Use when the user asks to 看样本, IOC, family, YARA, packed loader, suspicious binary/script, or extract indicators for detection. Do not use to write malware, C2, or evasion. Prefer re-autopilot when the goal is clean-room logic recovery rather than threat notes. |
Malware Triage
Defensive first hour on a guest-supplied sample. Goal: decide what it is, what it touches, and what to hunt — without detonating it on a gold host.
Scope
- Work on a copy. Hash the original. Record filename, size, type.
- Prefer a throwaway directory and no network, unless the guest explicitly wants a contained detonation.
- Do not upload the sample to a public sandbox unless asked.
- Do not produce builders, crypters, stealers, or evasion kits.
Hour-zero loop
preserve → identify → static cheap → (optional) contained dynamic → IOC + detection
1. Preserve
cp -- sample sample.bak
sha256sum sample
file sample
Note Magics, overlay, archive members. If it is a zip/iso/img, list members before extracting; extract to a sibling dir.
2. Identify
Cheap questions, in order:
- Document / script / PE / ELF / Mach-O / APK / firmware / disk?
- Packer or installer? (
UPX, NSIS, Inno, MSIX, PyInstaller, packed ELF)
- Signed? (Windows catalog / codesign) Who is the publisher?
- Obvious lure name vs real type (
invoice.pdf.exe, polyglot)
If it is a clean-room crackme / CTF toy with a flag check, hand off to $ctf-autopwn or $re-autopilot. This skill is for threat-shaped samples.
3. Static cheap (no execute)
strings -n 8 and wide strings. Collect URLs, IPs, mutexes, user-agents, registry paths, PDB, build IDs. Mark unconfirmed.- Imports / exports / sections. High entropy
.text or a tiny stub + fat overlay → packed.
- For scripts: read the outer layer. Decode one encoding at a time (base64, xor, gzip). Stop at the first clear purpose statement (downloader, stealer, ransomware note, miner).
- For APK: Manifest permissions + exported components + suspicious receivers; then
$re-autopilot apk lane if logic is needed.
- YARA only if rules exist locally. Do not invent family names from one string.
Write a ledger: observation → hypothesis → next test.
4. Contained dynamic (optional)
Only if the guest wants behavior and you have a throwaway box/VM/container.
- Snapshot first. No shared folders you care about.
- Run with outbound blocked or sinkholed DNS if possible.
- Record process tree, files dropped, persistence keys, DNS/HTTP destinations.
- Stop after the first clear behavior. Do not "see how far it goes."
If no sandbox: stay static and say so.
5. IOC and detection
Emit only indicators you actually saw:
| Type | Value | Where seen | Confidence |
|---|
| sha256 | … | original | confirmed |
| domain | … | strings / traffic | lead or confirmed |
| mutex / path | … | strings / runtime | … |
Pair every confirmed behavior with a defensive artifact when possible: a YARA string set from observed bytes, or a Sigma-style hunt idea (process + network). No "undetectable" claims.
Family talk
Do not baptize a family from a single PDB or GitHub string. Say "consistent with X" and list the overlapping indicators. If nothing matches, call it "unclassified loader/dropper/implant" plus the behavior.
Handoff
- Need protocol / C2 grammar recovered →
$net-reverse (still no implant).
- Need source bug that the sample exploits →
$netsec-audit on the victim software, not the implant.
- Need a CTF flag →
$ctf-autopwn.
Completion
- What it is (type, packer, likely role).
- What you actually observed (not folklore).
- IOC table.
- Recommended next containment / hunt step.
- What you did not run (network, detonation).
