malware-analysis

name	malware-analysis
description	Use when reverse-engineering or detecting malware — static triage + capa/YARA-X, emulation/DBI/.NET unpacking, dynamic/fileless/Volatility 3 memory analysis, C2 config extraction (Cobalt Strike/CAPE), C2 traffic detection (JA4+, beaconing)
metadata	{"type":"defensive","phase":"analysis","tools":"capa, FLOSS, YARA-X, pefile, x64dbg, dnSpyEx, de4dot, Frida, Qiling, Speakeasy, unipacker, Volatility3, FakeNet-NG, INetSim, 1768.py, CobaltStrikeParser, MACO, CAPEv2, Zeek, ja4, Suricata","mitre":"TA0042"}
kill_chain	{"phase":["weaponize"],"step":[2],"attck_tactics":["TA0042","TA0005","TA0011"],"attck_techniques":["T1027","T1027.002","T1027.013","T1140","T1055","T1055.012","T1620","T1562.001","T1497","T1547.001","T1546.003","T1059.001","T1071.001","T1071.004","T1573","T1572","T1568.002","T1480"]}
depends_on	["reverse-engineering"]
feeds_into	["threat-hunting","incident-response","edr-evasion","network-attack"]
inputs	["malware_sample","memory_image","pcap_capture","sandbox_report"]
outputs	["yara_rules","ioc_list","behavioral_report","malware_config","capability_map","c2_indicators"]
references	["references/static-triage-capa.md","references/unpacking-deobfuscation.md","references/dynamic-fileless-memory.md","references/config-c2-extraction.md","references/network-c2-detection.md","references/yara-detection-engineering.md"]
scripts	["scripts/triage.py","scripts/auto_unpack.py","scripts/frida_unpack.js","scripts/cs_config_extract.py","scripts/mem_triage.py","scripts/beacon_profiler.py","scripts/yara_gen.py"]

Malware Analysis

When to Activate

• Triaging an unknown binary/script: identity, packing verdict, capability map, IOCs, go/no-go for detonation.
• Recovering the real payload from a packed/crypted/obfuscated loader (commodity loaders, RAT chains, .NET).
• Detonating safely and recovering fileless / in-memory artifacts (injection, AMSI/ETW patching, WMI persistence).
• Extracting malware configuration (C2, keys, sleep/jitter, campaign IDs) for threat intel and detection.
• Detecting/characterizing C2 on the wire (beacon cadence, JA4+ fingerprints, tunneled/DoH channels).
• Writing durable, low-FP YARA-X detection from analysis findings; incident-response scoping.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Hash/imphash/Rich/ssdeep/TLSH triage + PE anomalies	T1027	CWE-506	references/static-triage-capa.md	scripts/triage.py
Per-section entropy + packer/RWX/EP heuristics	T1027.002	CWE-1066	references/static-triage-capa.md	scripts/triage.py
Obfuscated string recovery (FLOSS)	T1140, T1027.013	CWE-656	references/static-triage-capa.md	scripts/triage.py
Capability detection → ATT&CK (capa, static+dynamic)	T1027	CWE-506	references/static-triage-capa.md	scripts/triage.py
Emulation unpacking (Unicorn/unipacker/Speakeasy/Qiling)	T1140, T1620	CWE-656	references/unpacking-deobfuscation.md	scripts/auto_unpack.py
DBI unpacking via API hooks (Frida)	T1055, T1620	CWE-656	references/unpacking-deobfuscation.md	scripts/frida_unpack.js
.NET deobfuscation/unpacking (de4dot/dnSpyEx)	T1027, T1140	CWE-656	references/unpacking-deobfuscation.md	scripts/frida_unpack.js
Sandbox detonation + behavioral capture	T1497	CWE-506	references/dynamic-fileless-memory.md	scripts/mem_triage.py
Memory injection/hollowing/ghosting analysis (Vol3)	T1055, T1055.012