Malware Analyst

Draft · awaiting review

Agent skill that walks through a static malware analysis: deobfuscation, IOC extraction and detection signatures.

For Malware reversing, Detection engineeringWorks with Claude CodeMaintained tomabai, last push 2026-07-12

SkillA skill is a set of instructions, and sometimes scripts, that your AI client loads when a task needs it. by tomabai · read from the code at da852e4 on 2026-10-21The date we last read the tool’s files. The code after “at” names the exact version (the git commit) we read; a newer version may differ. · Not run yet.Whether we have run the tool in our lab. “Did more than it said” means the run used rights its description does not name; “did no more than it said” means it stayed within them.

Code showsWhat a reading of the code found the tool can do, at the checked version, in the words of the rights table in the record. It is a ceiling, not what the tool did. A right marked unknown has no evidence either way, and that never counts as harmless.

What the code shows, worst first. No run advice yet: the one word needs a read under the full rule.

Level 2. Execution. The agent runs decryptor scripts it writes itself with node or uv run python, and line 65 has it copy the cipher code for them verbatim from the sample.
SKILL.md L68
No evidence. Secrets. Unknown: the skill text shows no access to credentials, but the search patterns for secrets match 3 lines, so a zero cannot be written. That never counts as zero.

Before first useSettings for your AI client that limit the tool to the rights its task needs; derived from the code unless marked tested. derived from the code, not tested

Claude Code: permissions.allow: [Read, Grep]; keep Bash on ask, and run decryptor scripts only in a disposable VM without network.

What we checked, and what we found Disagree?

Skill · code showsreach ≥2 · open

What the code can reach, 0 to 3 per right; a dashed point means no evidence, never zero. The three readings

Is it for you?

Made for: Deobfuscates suspicious files layer by layer, explains what the code does, extracts indicators of compromise and writes variant-agnostic detection signatures.
Meant for files a user shares as suspicious, obfuscated scripts, and samples of named families such as Sandworm, Agent Tesla and malOpenclaw.
Produces indicators of compromise as concrete artifacts for detection and incident response.
Use it when: Deobfuscate an obfuscated script or dropper layer by layer (base64, hex, XOR, eval/exec wrappers, custom ciphers) and show each layer Malware reversing
Extract network, filesystem, behavioural and cryptographic IOCs from a sample, each tagged with a confidence level Incident response and forensics (DFIR)
Write text-based signatures for grep, YARA strings or SIEM rules Detection engineering
Triage a compiled binary by noting its format, extracting readable strings and imports, and flagging suspicious API calls Malware reversing
Not for: The skill rules out executing the sample in any form, including in a sandbox or partially; analysis is static.
You need: Claude Code as the AI client
node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor
Details: You need

Install

linked, not distributed: the Field Guide does not bundle agents or MCP servers

Upstream

Place the `malware-analyst/` directory (containing `SKILL.md`) in your `~/.claude/skills/` directory
Quoted from README.md#L22 at the pinned commit; a quotation, not a command to copy.

Run it with least privilege

claude code: permissions.allow: [Read, Grep]; keep Bash on ask, and run decryptor scripts only in a disposable VM without network
note: derived from the code, not tested in the lab

derived, not tested: proposed from the code analysis

End of the card. Below: what we checked, and what we found.Markdown JSON

The record · every value with its evidence

What we checked, and what we found.

Profile read at commit da852e4 on 2026-10-25: 33 facts, each with its quoted line confirmed by script; not installed, not run in the lab.Each fact was read from the tool's files at the checked version and links to the line it comes from. Where nothing was found, the page says so instead of assuming “none”.

Selected by criteria v0.1, approved by Ilja Schlak: awaiting approval. Each section opens with the answer; the file and line of every fact follow it.

What it can change the capability groups as upstream groups them, worst first

Changes, runs commands, according to the capabilities read.

The author describes the workflow as six phases. README.md L7, README.md#L7 at the checked commit

What it can do, by group
Group	What it covers	Effect	On by default
Phase 2: Full Deobfuscation	Writes a standalone decryptor file with the cipher algorithm and encrypted data taken from the sample, brute-forces array-rotation offsets and runs it with node or uv run python. SKILL.md L64-68, SKILL.md#L64-68 at the checked commit	reads, changes, runs commands	yes
Phase 4: IOC Extraction	Resolves still-obfuscated values with a static decryptor before listing IOCs as concrete values; tags each IOC high, medium or low confidence and [decrypted] where applicable. SKILL.md L123-127, SKILL.md#L123-127 at the checked commit	reads, changes, runs commands	yes
Phase 1: Initial Triage	Identifies file type, target language or runtime, surface-level obfuscation technique and the likely number of layers. SKILL.md L20-27, SKILL.md#L20-27 at the checked commit	reads	yes
Phase 3: Behavioral Analysis	Explains the sample's purpose and execution flow in plain English, step by step, and assesses which capabilities from a capability breakdown are present. SKILL.md L74-82, SKILL.md#L74-82 at the checked commit	reads	yes
Phase 5: Detection Signatures	Writes text-based (grep/YARA/SIEM) and regex signatures meant to catch variants by targeting the technique rather than the sample's variable names or literals. README.md L13, README.md#L13 at the checked commit	guides only: asks, explains or decides, acts on nothing itself	yes
Phase 6: Threat Summary	Produces a concise, shareable report with category, sophistication, most-dangerous capability and immediate containment actions. README.md L14, README.md#L14 at the checked commit	guides only: asks, explains or decides, acts on nothing itself	yes

Where it sends data and who can connect to it

No outside connection found in the files read.

Listens for no connections in the files read.

Other connections not ruled out: read in the documentation and the cited code, not searched in full.

How it runs generated from the files read, never drawn by hand

Skill instructions that the client's model follows; when a layer appears to need runtime to decode, the model writes and runs a separate script implementing only the decryption algorithm against the extracted ciphertext. SKILL.md L56, SKILL.md#L56 at the checked commit

Your AI client

Parts that live inside the AI client: skill instructions, client configuration.

SKILL.md instructions SKILL.md instructions that the model works through phase by phase, showing its work at each step. SKILL.md L18, SKILL.md#L18 at the checked commit

Your machine

Programs and files on the machine where you run the tool.

Suspicious sample The suspicious file or pasted obfuscated code the user shares, which the model reads. SKILL.md L3, SKILL.md#L3 at the checked commit
Static decryptor script Decryptor script that the model runs with node for JavaScript or uv run python for Python. SKILL.md L68, SKILL.md#L68 at the checked commit

The six rights, read three waysThe six rights a tool can take (files, network, execution, secrets, persistence, approval), each read three ways and rated 0 to 3. 0 never means safe; “?” means no evidence. what the author says, what the code shows, what one lab run showed

Level 2 (open), one right unknown, read from the code. Not run in our lab yet.

Privilege Reach: six rights, each read three ways. Levels 0 to 3; ? means no evidence.
Right	Author sayswhat the author says	Code showswhat static analysis finds	Run showedwhat one lab run showed
Fileswhere does it read and write?
Networkwhom does it talk to?
Executionwhat does it run?
Secretswhich credentials does it touch?
Persistencewhat survives the run?
Approvaldoes it ask before acting?

0 contained · 1 scoped · 2 open · 3 privileged · ? no evidence · 0 never means safe · zero means: none declared (Declared), none found (Code), none observed (Lab)

Author says: the evidence

Execution · 0README.md L18 the author declares static analysis only and that the file under analysis is never executed

Code shows: the evidence

Files · 1SKILL.md L65 the agent writes a new standalone decryptor file, and no path outside the working directory is named
Network · 0none found: patterns net-v0.1 in 1 files at da852e4
Execution · 2SKILL.md L68 the agent runs decryptor scripts it writes itself with node or uv run python, and line 65 has it copy the cipher code for them verbatim from the sample
Secrets · ?no evidence: the skill text shows no access to credentials, but the search patterns for secrets match 3 lines, so a zero cannot be written
Persistence · 0none found: patterns persist-v0.1 in 1 files at da852e4
Approval · 0none found: patterns hitl-v0.1 in 1 files at da852e4

Valid for commit da852e4 · checked 2026-10-21 · method reach-v0.1The published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.

Limits and risks what the files say that fits nowhere else, and what this reading does not cover

When a layer needs runtime to decode, the skill has the model copy the cipher algorithm verbatim from the sample into a new file and run it; the author does not count this as executing the malware. SKILL.md L56-65, SKILL.md#L56-65 at the checked commit
The SKILL.md frontmatter has two fields, name and description. SKILL.md L1-4, SKILL.md#L1-4 at the checked commit
Values whose key is derived at runtime, such as from a machine UUID, are reported as unresolved with what is known about their structure. SKILL.md L72, SKILL.md#L72 at the checked commit
For binary or compiled files the author does not expect full deobfuscation; output is strings, imports, suspicious API calls and behavioural clues. SKILL.md L206, SKILL.md#L206 at the checked commit
For array-rotation obfuscation, the decryptor brute-forces the rotation offset by re-running the integrity check across all offsets until the checksum matches. SKILL.md L67, SKILL.md#L67 at the checked commit
A standing rule tells the model to write and run a standalone decryptor script whenever strings are encrypted with a key visible in the source, instead of reporting obfuscated placeholders as IOCs. SKILL.md L218, SKILL.md#L218 at the checked commit
The skill description tells the client to trigger the skill when the user pastes heavily obfuscated code, even if the user does not say malware. SKILL.md L3, SKILL.md#L3 at the checked commit
Not covered: what it does at runtime. Other connections not ruled out: read in the documentation and the cited code, not searched in full.

What you need and what the documented installer does

What you need
Kind	What
AI client	Claude Code
Runtime	Claude Code as the AI client. malware-analyst.md L11, malware-analyst.md#L11 at the checked commit
Other tools	node for JavaScript decryptors and uv for Python decryptors when a layer needs a static decryptor. SKILL.md L68, SKILL.md#L68 at the checked commit

What the documented installer does

Manual install: the user places the malware-analyst/ directory containing SKILL.md in the user-level ~/.claude/skills/ directory. README.md L22, README.md#L22 at the checked commit

Lab runs one run is an observation, not a benchmark

No lab run yet. Once we run it, this section shows what it did and whether it did more than it said.

About this entry

Type: Skill · Defensive · works with Claude Code
Source: github.com/tomabai/malware-analyst · MIT · manifest SKILL.md
Version readThe install command installs exactly the version we checked (the pinned git commit), so what you get is what the card describes.: da852e4 · last upstream push 2026-07-12 · no release since the pinned commit
In the catalog: listed · added 2026-10-21 · last checked 2026-10-21 · next check 2027-01-19 · fresh
ScannersA scan of the tool's files with a scanner for malicious patterns. “Pending” means it has not run yet.: cisco-skill-scanner: not run, pending
Changes: none since the entry was added on 2026-10-21
MethodThe published rules we follow: how tools are selected, how their rights are read and rated, how a lab run is done.: v0.1 · reach-v0.1 · badge · the rules

Disagree?

Dispute a value with evidence (file, line, commit): write to hello@readbeforerun.ai. A dispute is checked against the pinned commit; a changed value is logged under Changes.

This entry as Markdown as JSON

How this entry was checked, and how to cite it

Selected by the published criteria (method v0.1). What the author says comes only from author statements; what the code shows comes from the code and manifests at commit da852e4, each with one evidence line. A “?” means no evidence, never zero; zero never means safe.

The descriptive profile (what it does, can do, how it runs, what it needs) was read through the same isolated pipeline at commit da852e4 on 2026-10-25: one reader proposed every fact with a quoted line, a script confirmed each quoted line (33 of 33), and a second reader checked each sentence against its lines. Where nothing was found, the page says so instead of assuming “none”.

Known issues and limits: remote server-side behaviour stays “?”; the lab is not your production; static analysis can miss runtime behaviour.

Placement, badges or fast tracks are not for sale. The author is employed by an IT consultancy; the company has no influence on selection, execution or result.

Cite this:

Ilja Schlak. "Malware Analyst". Agentic Security Field Guide, checked 2026-10-21, method reach-v0.1. https://readbeforerun.ai/catalog/tomabai-malware-analyst/

The method · the rules

For maintainers

Badge for your README (reach ≥2 · not run yet):

[![reach ≥2 · not run yet](https://readbeforerun.ai/badge/tomabai-malware-analyst.svg)](https://readbeforerun.ai/catalog/tomabai-malware-analyst/)