# Malware Analyst

> Draft · awaiting review.

> Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.

- Badge: `reach ≥2 · not run yet`
- Type: Skill; tier: not run yet
- Tasks: Malware reversing, Detection engineering; mission: Defensive; works with: Claude Code
- Source: https://github.com/tomabai/malware-analyst, pinned to `da852e4`, licence MIT
- Last checked: 2026-10-21; next check: 2027-01-19; method v0.1, reach-v0.1

## At a glance

- **What it is:** A static malware analysis skill that deobfuscates and reverse-engineers suspicious files and writes detection signatures for them. A skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it.
- **Made for:** Deobfuscates suspicious files layer by layer, explains what the code does, extracts indicators of compromise and writes variant-agnostic detection signatures. +2 more
- **Runs:** Inside your AI client: its model follows the instructions and works with the client's own tools. Other modes: slash command.
- **Sends data to:** No outside connection found in the files read. Other connections not ruled out: read in the documentation and the cited code, not searched in full.
- **Can change things:** Changes, runs commands, according to the capabilities read.
- **Needs:** Claude Code as the AI client · node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor

Profile read at commit `da852e4` on 2026-10-25; every fact cites a file and line at that commit.

## What it does

A static malware analysis skill that deobfuscates and reverse-engineers suspicious files and writes detection signatures for them. (SKILL.md#L3)

Made for (the author says):

- Deobfuscates suspicious files layer by layer, explains what the code does, extracts indicators of compromise and writes variant-agnostic detection signatures. (README.md#L3)
- Meant for files a user shares as suspicious, obfuscated scripts, and samples of named families such as Sandworm, Agent Tesla and malOpenclaw. (SKILL.md#L3)
- Produces indicators of compromise as concrete artifacts for detection and incident response. (SKILL.md#L99)

Documented uses:

- Deobfuscate an obfuscated script or dropper layer by layer (base64, hex, XOR, eval/exec wrappers, custom ciphers) and show each layer. [Malware reversing] (README.md#L10)
- Extract network, filesystem, behavioural and cryptographic IOCs from a sample, each tagged with a confidence level. [Incident response and forensics (DFIR)] (README.md#L12)
- Write text-based signatures for grep, YARA strings or SIEM rules. [Detection engineering] (SKILL.md#L139)
- Triage a compiled binary by noting its format, extracting readable strings and imports, and flagging suspicious API calls. [Malware reversing] (SKILL.md#L206)

Not for (the author says):

- The skill rules out executing the sample in any form, including in a sandbox or partially; analysis is static. (SKILL.md#L12)

## What it can do

| Group | What it covers | Effect | On by default |
|---|---|---|---|
| Phase 1: Initial Triage | Identifies file type, target language or runtime, surface-level obfuscation technique and the likely number of layers. (SKILL.md#L20-27) | reads | yes |
| Phase 2: Full Deobfuscation | Writes a standalone decryptor file with the cipher algorithm and encrypted data taken from the sample, brute-forces array-rotation offsets and runs it with node or uv run python. (SKILL.md#L64-68) | reads, changes, runs commands | yes |
| Phase 3: Behavioral Analysis | Explains the sample's purpose and execution flow in plain English, step by step, and assesses which capabilities from a capability breakdown are present. (SKILL.md#L74-82) | reads | yes |
| Phase 4: IOC Extraction | Resolves still-obfuscated values with a static decryptor before listing IOCs as concrete values; tags each IOC high, medium or low confidence and [decrypted] where applicable. (SKILL.md#L123-127) | reads, changes, runs commands | yes |
| Phase 5: Detection Signatures | Writes text-based (grep/YARA/SIEM) and regex signatures meant to catch variants by targeting the technique rather than the sample's variable names or literals. (README.md#L13) |  | yes |
| Phase 6: Threat Summary | Produces a concise, shareable report with category, sophistication, most-dangerous capability and immediate containment actions. (README.md#L14) |  | yes |

## How it runs

Skill instructions that the client's model follows; when a layer appears to need runtime to decode, the model writes and runs a separate script implementing only the decryption algorithm against the extracted ciphertext. (SKILL.md#L56)

- Starts: Inside your AI client: its model follows the instructions and works with the client's own tools. Runs as skill instructions inside Claude Code after the folder is placed in the user's skills directory. (README.md#L22)
- Can also run: Inside your AI client: its model follows the instructions and works with the client's own tools (slash command, switch `/malware-analyst`). The repository's listing file malware-analyst.md gives /malware-analyst as the invocation. (malware-analyst.md#L12)
- Your AI client: **SKILL.md instructions**: SKILL.md instructions that the model works through phase by phase, showing its work at each step. (SKILL.md#L18)
- Your machine: **Suspicious sample**: The suspicious file or pasted obfuscated code the user shares, which the model reads. (SKILL.md#L3)
- Your machine: **Static decryptor script**: Decryptor script that the model runs with node for JavaScript or uv run python for Python. (SKILL.md#L68)

## What you need

- Runtime: Claude Code as the AI client. (malware-analyst.md#L11)
- Other tools: node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor. (SKILL.md#L68)
- Installer: Manual install: the user places the malware-analyst/ directory containing SKILL.md in the user-level ~/.claude/skills/ directory. (README.md#L22)

## Limits and risks

- When a layer needs runtime to decode, the skill has the model copy the cipher algorithm verbatim from the sample into a new file and run it; the author does not count this as executing the malware. (SKILL.md#L56-65)
- The SKILL.md frontmatter has two fields, name and description. (SKILL.md#L1-4)
- Values whose key is derived at runtime, such as from a machine UUID, are reported as unresolved with what is known about their structure. (SKILL.md#L72)
- For binary or compiled files the author does not expect full deobfuscation; output is strings, imports, suspicious API calls and behavioural clues. (SKILL.md#L206)
- For array-rotation obfuscation, the decryptor brute-forces the rotation offset by re-running the integrity check across all offsets until the checksum matches. (SKILL.md#L67)
- A standing rule tells the model to write and run a standalone decryptor script whenever strings are encrypted with a key visible in the source, instead of reporting obfuscated placeholders as IOCs. (SKILL.md#L218)
- The skill description tells the client to trigger the skill when the user pastes heavily obfuscated code, even if the user does not say malware. (SKILL.md#L3)

## Rights in plain language

- Declared: execution 0 (runs no programs).
- Code: reach ≥2 (open): execution 2 (runs shell commands or eval); unknown: secrets.
- Lab: not run yet.

Why three columns? Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

## Privilege Reach

Reach level 2 (open), one right unknown.

| Right | Declared | Code | Lab |
|---|---|---|---|
| Files: where does it read and write? | not declared | 1 reads outside the project | not run yet |
| Network: whom does it talk to? | not declared | 0 uses no network | not run yet |
| Execution: what does it run? | 0 runs no programs | 2 runs shell commands or eval | not run yet |
| Secrets: which credentials does it touch? | not declared | ? unknown | not run yet |
| Persistence: what survives the run? | not declared | 0 leaves results only | not run yet |
| Approval: does it ask before acting? | not declared | 0 asks each time | not run yet |

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe

## Install

### Upstream

Quoted from `README.md#L22` at the pinned commit (not a command to copy): `Place the `malware-analyst/` directory (containing `SKILL.md`) in your `~/.claude/skills/` directory`


### Run it with least privilege

- claude code: `permissions.allow: [Read, Grep]; keep Bash on ask, and run decryptor scripts only in a disposable VM without network`
- note: `derived from the code, not tested in the lab`

- derived, not tested: proposed from the code analysis

## Lab runs

Not run yet.

## Questions and answers

**Why compare declared, code and lab?**

Declarations are often incomplete and scanners can be bypassed, so we run each tool once and compare.

**What rights does Malware Analyst declare?**

execution 0 (runs no programs).

**What does its code suggest?**

reach ≥2 (open): execution 2 (runs shell commands or eval); unknown: secrets.

**What did it use when it ran in the lab?**

not run yet.

**Was it tried, and when?**

Not yet (tier listed).

**What changed since the last check?**

Upstream last pushed 2026-07-12; 0 release(s) since the pinned version.

**How do I run it with least privilege?**

Derived, not tested: claude_code: permissions.allow: [Read, Grep]; keep Bash on ask, and run decryptor scripts only in a disposable VM without network; note: derived from the code, not tested in the lab

Method: https://readbeforerun.ai/method/