malware-analysis-orchestrator

Automate malware triage and reverse-engineering with per-sample case directories and ranked evidence.

287|44|Updated Mar 18, 2026

Search Tags:#mcp #orchestration #reverse-engineering #ghidra #malware-analysis #binary-ninja

Ready to run

npx skills add https://github.com/mrphrazer/agentic-malware-analysis --skill malware-analysis-orchestrator

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: malware-analysis-orchestrator
Source: https://github.com/mrphrazer/agentic-malware-analysis/tree/main/agent_helpers/claude/skills/malware-analysis-orchestrator
Command: npx skills add https://github.com/mrphrazer/agentic-malware-analysis --skill malware-analysis-orchestrator

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) and assets (resource) components.

What problem does it solve?

Automates structured malware triage and reverse-engineering, producing per-sample case directories with ranked evidence, hypotheses, and a deep-analysis plan.

Core Features & Use Cases

Role-based orchestration (Orchestrator, Planner, Reporter)
MCP-backed Binary Ninja and Ghidra integration for function-level analysis
Phase-driven artifact generation (strings, imports, hypotheses, component maps, deep-analysis plan, priority queue, reporting)
Per-sample case directory under status/
Complete intermediate outputs for reproducibility

Quick Start

Run the orchestrator on a sample and inspect the status/ directory for artifacts and next steps.

Frequently Asked Questions about malware-analysis-orchestrator

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate malware triage and reverse-engineering for suspicious binaries?▼

Malware triage automation works by processing PE, ELF, and Mach-O binaries through role-based execution phases to generate per-sample case directories. These directories contain ranked evidence, hypotheses, and a structured deep-analysis plan for reproducible reverse-engineering.

What is structured malware analysis orchestration and how does it maintain evidence tracing?▼

Structured malware analysis orchestration coordinates role-based execution to gather artifacts, generate hypotheses, and map components. It maintains evidence tracing by dumping intermediate results and maintaining status directories that expose a prioritized task queue for reproducibility.

Does this malware analysis orchestrator work with Binary Ninja and Ghidra MCP backends?▼

Yes, the malware analysis orchestrator supports optional Binary Ninja or Ghidra MCP backends. These integrations enable function-level analysis to gather artifacts, generate hypotheses, and map binary components during the reverse-engineering workflow.

Can I use this tool to analyze both Windows PE and Linux ELF malware samples?▼

Yes, you can analyze both Windows PE and Linux ELF malware samples, as well as Mach-O binaries. The orchestrator applies phase-driven artifact generation across all three executable formats to produce structured triage reports and analysis plans.

How do I get started with end-to-end malware triage orchestration?▼

To start end-to-end malware triage orchestration, run the orchestrator on a target sample. Inspect the generated status/ directory to review intermediate outputs, ranked evidence, and the prioritized task queue that outlines your next deep-analysis steps.

What are the limitations of automated malware analysis orchestration?▼

Automated malware analysis orchestration focuses on structured triage, evidence gathering, and generating deep-analysis plans rather than fully automated remediation. It requires optional Binary Ninja or Ghidra MCP backends for function-level analysis and is limited to PE, ELF, and Mach-O binary formats.