malware-analysis

Analyze suspicious binary files with static and dynamic analysis, YARA rules, and MITRE ATT&CK mapping.

Updated Jul 1, 2026

Search Tags:#binary analysis #sandboxing #MITRE ATT&CK #malware analysis #YARA rules

Ready to run

npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill malware-analysis-bpnrockstar

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: malware-analysis
Source: https://github.com/bpnrockstar/UnifiedBugHunter/tree/main/skills/malware-analysis
Command: npx skills add https://github.com/bpnrockstar/UnifiedBugHunter --skill malware-analysis-bpnrockstar

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill provides a methodology for analyzing suspicious binaries, focusing on unpacking, analysis, behavioral sandboxing, network signature generation, YARA rule creation, and MITRE ATT&CK mapping. It helps in identifying indicators of compromise (IOCs) and capabilities within malware samples.

Core Features & Use Cases

Static Analysis: Identify packers, imports, and analyze file formats like PE, ELF, Mach-O.
Dynamic Analysis: Capture network traffic and system calls during execution.
YARA Rule Generation: Create rules for detecting specific malware patterns.
MITRE ATT&CK Mapping: Classify behaviors against MITRE's framework.

Quick Start

Analyze a binary file named 'malware_sample.bin' for signs of suspicious behavior and network communications.

Frequently Asked Questions about malware-analysis

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze a suspicious binary file for malware indicators?▼

Analyzing a suspicious binary file for malware involves executing static and dynamic analysis to identify packers, imports, and system calls. This process helps uncover indicators of compromise and map malicious behaviors to the MITRE ATT&CK framework.

How do I generate YARA rules for detecting specific malware patterns?▼

Generating YARA rules for malware detection is achieved by analyzing suspicious binaries to identify unique patterns and capabilities. The Skill creates these rules to detect specific malware signatures based on the static and dynamic analysis results.

Does this malware analysis approach support multiple executable formats like PE, ELF, and Mach-O?▼

Yes, malware analysis supports identifying packers and imports across multiple executable file formats. It specifically analyzes PE, ELF, and Mach-O files during static analysis to detect suspicious behavior and network communications.

How do I map suspicious binary behaviors to the MITRE ATT&CK framework?▼

Mapping suspicious binary behaviors to the MITRE ATT&CK framework is done by classifying the capabilities observed during dynamic analysis and sandboxing. This identifies specific tactics and techniques used by the malware sample.

Can I capture network traffic and system calls during dynamic malware analysis?▼

Yes, dynamic malware analysis captures network traffic and system calls during binary execution. This behavioral sandboxing approach helps identify active network communications and indicators of compromise within the malware sample.

What is the best way to identify packers and imports in suspicious binaries?▼

The best way to identify packers and imports in suspicious binaries is through static analysis. This methodology examines file formats like PE, ELF, and Mach-O without execution to safely unpack and analyze the malware sample.