reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-java-jar-malware/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: analyzing-java-jar-malware
+description: 'Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by
+  inventorying the archive, reading the manifest entry point, detecting obfuscators and string
+  encryption, and flagging suspicious runtime, reflection, and networking class usage. Activates
+  for requests to analyze a malicious JAR, inspect Java malware, or identify a Java RAT.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - java
+  - jar
+  - rat
+  - decompilation
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1059
+  - T1027
+  - T1620
+d3fend:
+  - D3-SDA
+  - D3-DA
+references:
+  - 'JAR/ZIP and Java class file format — https://docs.oracle.com/javase/specs/jvms/se17/html/'
+  - 'MITRE ATT&CK T1027 Obfuscated Files or Information — https://attack.mitre.org/techniques/T1027/'
+---
+
+# Analyzing Java/JAR Malware
+
+## When to Use
+
+- You have a malicious or suspicious `.jar` (often a cross-platform RAT) and need to map its
+  structure, entry point, obfuscation, and capability surface before decompiling.
+- You want to triage a Java payload without running the JVM.
+
+**Do not use** `java -jar` to run it — that executes the malware. Treat the JAR as a ZIP and read
+its contents statically.
+
+## Prerequisites
+
+- The JAR file, read inertly. Optional: a Java decompiler (CFR, Procyon) for the next stage.
+
+## Safety & Handling
+
+- Read the archive statically; never launch the JVM on the sample. Defang any URLs found.
+
+## Workflow
+
+### Step 1: Inventory the archive and entry point
+
+```bash
+python scripts/analyst.py inspect sample.jar
+```
+
+Lists `.class` files, embedded resources/payloads (nested JARs, scripts, encrypted blobs), and
+reads `META-INF/MANIFEST.MF` for `Main-Class`/`Premain-Class`.
+
+### Step 2: Detect obfuscation and packers
+
+Flags obfuscator fingerprints (Allatori, ProGuard, Zelix), single-character class/package names,
+and string-decryption indicators.
+
+### Step 3: Flag capability classes
+
+Surface dangerous API usage in strings/constant pools: `Runtime.exec`/`ProcessBuilder`,
+`java.lang.reflect`, `URLClassLoader`, `javax.crypto`, `java.net.Socket`, registry/persistence
+helpers.
+
+### Step 4: Route to decompilation
+
+Hand the key classes to a decompiler (CFR/Procyon) for source recovery; record IOCs.
+
+## Validation
+
+- The manifest entry point is read and reported.
+- Embedded payloads/nested archives are enumerated.
+- Capability flags are backed by concrete class/string evidence.
+
+## Pitfalls
+
+- String-encrypted samples where capability strings appear only after decryption.
+- Multi-stage droppers that unpack a second JAR at runtime.
+- Benign obfuscated commercial JARs — corroborate with capability and delivery context.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
+- JVM/JAR format and ATT&CK T1027 references (linked in frontmatter).