malware-analysis-claude-skills

🥈Silver

Complete Claude skills toolkit for professional malware analysis. 5 specialized skills covering triage, dynamic analysis, detection engineering, and reporting. Works with REMnux/FlareVM offline environments.

600Updated 1mo ago

Intermediate30min to implementautomation

Saves ~240 min per use

Quick InstallView Source

git clone https://github.com/gl0bal01/malware-analysis-claude-skills.git

Works with:

Claude

Overview

About This Skill

Setup & Installation

Quick Install

No install command available. Check the GitHub repository for manual installation instructions.

Alternative Install (Git Clone)

git clone https://github.com/gl0bal01/malware-analysis-claude-skills

Requirements

Claude Code or compatible AI agent
Works with: Claude

Quick Start Guide

Install the Skill

Copy the install command above and run it in your terminal.

Open Your AI Agent

Launch Claude Code, Cursor, or your preferred AI coding agent.

Try It Out

Use the prompt template or examples below to test the skill.

Customize

Adapt the skill to your specific use case and workflow.

Usage Examples

Prompt Template

Analyze the following malware sample [MALWARE_SAMPLE] using the malware-analysis-claude-skills toolkit. Perform a comprehensive analysis including triage, dynamic analysis, detection engineering, and generate a detailed report. The analysis should be conducted in a REMnux/FlareVM offline environment.

Example Output

# Malware Analysis Report

## Summary
- **Malware Type**: Trojan
- **Severity**: High
- **First Seen**: 2023-10-15
- **Last Updated**: 2023-10-20

## Triage Analysis
- **File Hash**: SHA256: a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6
- **File Size**: 456 KB
- **Compiled Date**: 2023-09-28
- **Packed**: Yes (UPX)

## Dynamic Analysis
- **Processes Created**:
  - `explorer.exe`
  - `svchost.exe`
- **Network Connections**:
  - `192.168.1.100:443`
  - `10.0.0.1:8080`
- **Registry Modifications**:
  - `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`

## Detection Engineering
- **YARA Rule**:
  ```
  rule Trojan_Example {
    meta:
      description = "Detects Example Trojan"
      author = "Claude"
    strings:
      $s1 = "MaliciousString1"
      $s2 = "MaliciousString2"
    condition:
      $s1 or $s2
  }
  ```

## Recommendations
- **Immediate Actions**:
  - Isolate infected systems
  - Block network connections to identified IPs
- **Long-term Actions**:
  - Update antivirus signatures
  - Educate users on phishing awareness