reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/vendor-new/malware-analysis-claude-skills/malware-report-writer/assets/report_template.md
+++ b/vendor-new/malware-analysis-claude-skills/malware-report-writer/assets/report_template.md
@@ -0,0 +1,298 @@
+# Malware Analysis Report
+
+**Analyst:** [Your Name]  
+**Date:** [Analysis Date]  
+**Sample Hash (SHA256):** [Hash]  
+**Report ID:** [Unique ID]
+
+---
+
+## Executive Summary
+
+[2-3 paragraph high-level summary suitable for non-technical stakeholders]
+
+**Key Findings:**
+- **Malware Family:** [Family name or "Unknown"]
+- **Threat Level:** [Critical/High/Medium/Low]
+- **Primary Functionality:** [Brief description]
+- **Recommended Actions:** [Immediate actions needed]
+
+---
+
+## Sample Information
+
+| Field | Value |
+|-------|-------|
+| **Filename** | [Original filename] |
+| **File Size** | [Size in bytes/KB/MB] |
+| **File Type** | [PE32/PE64/Script/Document/etc] |
+| **MD5** | [MD5 hash] |
+| **SHA1** | [SHA1 hash] |
+| **SHA256** | [SHA256 hash] |
+| **First Seen** | [Date/Time or "Unknown"] |
+
+---
+
+## Static Analysis
+
+### File Header Analysis
+
+**PE Structure:**
+- **Architecture:** [x86/x64/ARM]
+- **Compilation Timestamp:** [Date/Time]
+- **Entry Point:** [Address]
+- **Sections:** [Number and names]
+
+**Packing/Obfuscation:**
+- **Packed:** [Yes/No]
+- **Packer Identified:** [Name or "Unknown"]
+- **Entropy:** [Value - High entropy suggests packing/encryption]
+
+### Strings Analysis
+
+**Notable Strings:**
+- [Key strings that indicate functionality, URLs, file paths, registry keys]
+- [Decoded/deobfuscated strings if applicable]
+
+### Import/Export Analysis
+
+**Key Imports:**
+- [DLL name]: [Notable functions that indicate malicious behavior]
+- [Example: kernel32.dll: CreateRemoteThread, VirtualAllocEx (process injection)]
+- [Example: ws2_32.dll: socket, connect, send (network communication)]
+
+**Exports:**
+- [List any exported functions]
+
+### Resource Analysis
+
+**Embedded Resources:**
+- [Icons, images, additional executables, configuration data]
+- [Any suspicious or high-entropy resources]
+
+---
+
+## Dynamic Analysis
+
+### Behavioral Analysis
+
+**Execution Environment:**
+- **Operating System:** [Windows version, architecture]
+- **Analysis Tools:** [List tools used: Process Monitor, Wireshark, etc.]
+- **Analysis Duration:** [Time period]
+
+### Process Activity
+
+**Process Creation:**
+- [Parent process → Child processes]
+- [Process injection or hollowing detected]
+
+**Command Line Arguments:**
+- [Any command line execution observed]
+
+### File System Activity
+
+**Files Created/Modified:**
+- [Path]: [Purpose/Description]
+- [Path]: [Purpose/Description]
+
+**Files Deleted:**
+- [List any files deleted]
+
+### Registry Activity
+
+**Registry Keys Created/Modified:**
+- [Registry path]: [Value and purpose]
+- [Persistence mechanisms identified]
+
+**Notable Registry Operations:**
+- [Any suspicious registry behavior]
+
+### Network Activity
+
+**DNS Queries:**
+- [Domain]: [IP resolved]
+- [Suspicious or newly registered domains]
+
+**Network Connections:**
+- **Protocol:** [TCP/UDP/HTTP/HTTPS]
+- **Remote Address:** [IP:Port]
+- **Purpose:** [C2 communication/Data exfiltration/Download additional payload]
+
+**Network Indicators:**
+- [User-Agent strings]
+- [URI patterns]
+- [HTTP headers]
+
+### System Changes
+
+**Mutex Creation:**
+- [Mutex names - used to prevent multiple infections]
+
+**Service Installation:**
+- [Service name, display name, description]
+
+**Scheduled Tasks:**
+- [Task name and trigger]
+
+---
+
+## Indicators of Compromise (IOCs)
+
+> **Note:** All network and host IOCs MUST be defanged before inclusion in this report.
+> Defanging rules: URLs use `hxxp`/`hxxps`; domains bracket the dot before the TLD (`evil[.]com`);
+> IP addresses bracket each dot (`192[.]168[.]1[.]1`); email addresses replace `@` with `[@]`.
+
+### File Indicators
+```
+MD5: [hash]
+SHA1: [hash]
+SHA256: [hash]
+Filename: [name]
+File Size: [size]
+```
+
+### Network Indicators
+```
+IP Addresses:
+[192.168.1.1] → 192[.]168[.]1[.]1 - [Purpose/Description]
+
+Domains:
+[domain.com] → domain[.]com - [Purpose/Description]
+
+URLs:
+[https://example.com/path] → hxxps://example[.]com/path - [Purpose/Description]
+```
+
+### Host Indicators
+```
+Registry Keys:
+[Registry path]
+
+File Paths:
+[File path]
+
+Mutex Names:
+[Mutex name]
+
+Service Names:
+[Service name]
+```
+
+---
+
+## Detection Rules
+
+### YARA Rule
+
+```yara
+rule [RuleName]_[MalwareFamily] {
+    meta:
+        description = "[Brief description]"
+        author = "[Your name]"
+        date = "[Date]"
+        hash = "[Sample SHA256]"
+        
+    strings:
+        $string1 = "[hex or text pattern]" [modifiers]
+        $string2 = "[hex or text pattern]" [modifiers]
+        $api1 = "[API call pattern]"
+        
+    condition:
+        [Condition logic - e.g., uint16(0) == 0x5A4D and filesize < 500KB and all of ($string*)]
+}
+```
+
+### Sigma Rule (Optional - for behavioral detection)
+
+```yaml
+title: [Detection Name]
+id: [generate a unique UUID, e.g. a1b2c3d4-e5f6-7890-abcd-ef1234567890]
+status: experimental
+description: [What behavior this detects]
+references:
+    - [URLs or references]
+author: [Your Name]
+date: [YYYY-MM-DD]
+tags:
+    - attack.[tactic]         # e.g. attack.execution
+    - attack.t[XXXX].[YYY]   # e.g. attack.t1059.001
+logsource:
+    category: [process_creation/network_connection/etc]
+    product: windows
+detection:
+    selection:
+        [Field]: [Value]
+    condition: selection
+falsepositives:
+    - [Potential false positives]
+level: [critical/high/medium/low]
+```
+
+---
+
+## Malware Classification
+
+**Family:** [Malware family name or "Unknown"]  
+**Type:** [Trojan/Ransomware/Worm/RAT/Backdoor/Dropper/Loader/etc]  
+**Capabilities:**
+- [Capability 1 - e.g., Data exfiltration]
+- [Capability 2 - e.g., Remote access]
+- [Capability 3 - e.g., Keylogging]
+
+---
+
+## Remediation and Mitigation
+
+### Immediate Actions
+1. [Isolate infected systems]
+2. [Block network IOCs at firewall/proxy]
+3. [Search for other instances using IOCs]
+
+### Long-term Recommendations
+1. [Update endpoint protection signatures]
+2. [Deploy detection rules]
+3. [Review and strengthen security controls]
+4. [User awareness training if applicable]
+
+### Recovery Steps
+1. [Remove malware using antivirus/manual removal]
+2. [Restore from clean backups if needed]
+3. [Reset compromised credentials]
+4. [Monitor for reinfection]
+
+---
+
+## Technical Details
+
+[Additional technical information, screenshots, memory dumps analysis, code snippets, etc.]
+
+---
+
+## Conclusion
+
+[Final summary paragraph with key takeaways and overall assessment]
+
+---
+
+## References
+
+- [VirusTotal Report Link]
+- [Any.Run Sandbox Report]
+- [External research/blog posts about similar samples]
+- [CVE numbers if applicable]
+
+---
+
+## Appendix
+
+### Analysis Timeline
+- [Timestamp]: [Event]
+- [Timestamp]: [Event]
+
+### Tools Used
+- [Tool name and version]
+- [Tool name and version]
+
+### Screenshots
+[Include relevant screenshots from analysis]