reverse-skills-max: initial public release (restored, redacted, hardened)

2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
--- a/vendor-new/malware-analysis-claude-skills/malware-triage/references/indicators.md
+++ b/vendor-new/malware-analysis-claude-skills/malware-triage/references/indicators.md
@@ -0,0 +1,325 @@
+# Common Malware Indicators Reference
+
+## Suspicious Import Functions
+
+### Process Injection/Manipulation
+- `CreateRemoteThread` - Inject code into another process
+- `WriteProcessMemory` - Write to another process's memory
+- `VirtualAllocEx` - Allocate memory in another process
+- `OpenProcess` - Access another process
+- `NtUnmapViewOfSection` - Process hollowing technique
+- `SetThreadContext` - Modify thread execution
+- `ResumeThread` - Resume suspended thread (often after injection)
+- `QueueUserAPC` - APC injection technique
+
+### Keylogging
+- `SetWindowsHookEx` - Install keyboard hooks
+- `GetAsyncKeyState` - Poll keyboard state
+- `GetForegroundWindow` - Get active window title
+- `GetKeyState` - Check key status
+
+### Network Activity
+- `InternetOpen` / `InternetOpenUrl` - WinINet HTTP requests
+- `HttpSendRequest` - Send HTTP request
+- `send` / `recv` - Raw socket communication
+- `WSAStartup` - Initialize Winsock
+- `connect` / `socket` - Network connections
+- `URLDownloadToFile` - Download files from URLs
+
+### Persistence Mechanisms
+- `RegSetValueEx` / `RegCreateKeyEx` - Registry manipulation
+- `CreateService` - Install Windows service
+- `StartService` - Start service
+- `ITaskService` / `ITaskFolder::RegisterTaskDefinition` - COM interfaces for scheduled task creation; `schtasks.exe /create` is the command-line equivalent
+
+### Stealth/Anti-Analysis
+- `IsDebuggerPresent` - Debugger detection
+- `CheckRemoteDebuggerPresent` - Remote debugger check
+- `NtQueryInformationProcess` - Process information (anti-debug)
+- `GetTickCount` - Timing checks (anti-sandbox)
+- `Sleep` - Delay execution (sandbox evasion)
+- `FindWindow` - Look for analysis tools
+
+### EDR/Telemetry Evasion
+- `EtwEventWrite` / `NtTraceEvent` - ETW patching target; writing 0xC3 (ret) to prologue blinds EDR telemetry
+- `AmsiScanBuffer` / `AmsiScanString` / `AmsiInitialize` - AMSI bypass targets; patched to return S_OK (0) with AMSI_RESULT_CLEAN (0), or to return E_INVALIDARG so the caller treats the result as no threat
+- `UpdateProcThreadAttribute` - PPID spoofing when called with PROC_THREAD_ATTRIBUTE_PARENT_PROCESS attribute
+- `VirtualProtect` - Required before patching; look for calls targeting ntdll.dll or amsi.dll memory ranges
+- `GetProcAddress` + `LoadLibrary` - Runtime API resolution to avoid static import evidence (common in syscall stubs)
+
+### Callback-based Shellcode Execution
+- `EnumChildWindows` / `EnumDesktopWindows` - Callback used as execution primitive instead of CreateThread
+- `CreateTimerQueueTimer` - Timer callback used to invoke shellcode
+- `TpAllocWork` / `TpPostWork` / `TpReleaseWork` - Threadpool callbacks for shellcode dispatch
+- `SetTimer` / `EnumSystemLocales` / `EnumTimeFormatsEx` - Less common callback execution primitives
+
+### File Manipulation
+- `CreateFile` / `WriteFile` / `ReadFile` - File I/O
+- `DeleteFile` - Delete files
+- `MoveFile` / `CopyFile` - File operations
+- `FindFirstFile` / `FindNextFile` - Directory enumeration
+
+### Encryption/Encoding
+- `CryptEncrypt` / `CryptDecrypt` - Data encryption
+- `CryptAcquireContext` - Crypto provider setup
+- `CryptGenKey` - Generate encryption keys
+
+## Suspicious String Patterns
+
+### Network Indicators
+- Hardcoded IP addresses (especially RFC1918 or suspicious IPs)
+- Domain names (especially newly registered or suspicious TLDs)
+- URL patterns: `http://`, `https://`, `ftp://`
+- Port numbers in strings (especially non-standard ports)
+- User-Agent strings (especially custom/unusual ones)
+- Email addresses (especially for data exfiltration)
+
+### File Paths
+- `%APPDATA%`, `%TEMP%`, `%LOCALAPPDATA%` - Common malware locations
+- `\Microsoft\Windows\Start Menu\Programs\Startup\` - Persistence
+- `C:\ProgramData\` - Hidden location
+- Hidden folders: `$Recycle.Bin`, `System Volume Information`
+
+### Registry Keys
+**Persistence (Run Keys):**
+- `Software\Microsoft\Windows\CurrentVersion\Run`
+- `Software\Microsoft\Windows\CurrentVersion\RunOnce`
+- `SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices`
+
+**System Modification:**
+- `SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon` (especially Userinit, Shell)
+- `SYSTEM\CurrentControlSet\Services` - Service installation
+- `SOFTWARE\Microsoft\Windows\CurrentVersion\policies` - Policy changes
+
+### Commands and Scripts
+- PowerShell indicators:
+  - `-EncodedCommand` - Base64 encoded commands
+  - `-ExecutionPolicy Bypass` - Bypass script restrictions
+  - `-WindowStyle Hidden` - Hide execution
+  - `DownloadString`, `DownloadFile` - Download payloads
+  - `IEX` (Invoke-Expression) - Execute code
+  
+- CMD indicators:
+  - `cmd.exe /c` - Execute command
+  - `schtasks` - Task scheduling
+  - `reg add` - Registry manipulation
+  - `netsh` - Network/firewall changes
+  - `wmic` - WMI commands
+  - `rundll32` - Execute DLL functions
+
+### Encoding/Obfuscation
+- Base64 encoded strings (check for padding: `==`)
+- Hex encoded data
+- XOR key patterns
+- Reversed strings
+- Unicode/wide character strings
+
+### Cryptocurrency
+- Bitcoin addresses (start with 1, 3, or bc1)
+- Ethereum addresses (0x followed by 40 hex chars)
+- Monero addresses
+- Wallet-related terms: "wallet.dat", "cryptocurrency"
+
+### Ransomware Indicators
+- File extension strings: `.encrypted`, `.locked`, `.crypto`, etc.
+- Ransom note filenames: `README.txt`, `HOW_TO_DECRYPT.txt`
+- Payment terms: "bitcoin", "decrypt", "ransom", "payment"
+- Encryption terms: "AES", "RSA", "encrypted"
+
+## Suspicious File Characteristics
+
+### PE Header Anomalies
+- Compilation timestamp in the future
+- Compilation timestamp too old for file features
+- Mismatched architecture in headers
+- Unusual section names (normal: `.text`, `.data`, `.rdata`, `.rsrc`)
+- High entropy sections (>7.0 suggests encryption/packing)
+- Overlapping sections
+- Large overlay data
+- Missing or invalid digital signatures
+
+### Entropy Analysis
+- **Low entropy (0-3):** Likely unencrypted, readable data
+- **Medium entropy (3-5):** Typical compiled code
+- **High entropy (7-8):** Packed, encrypted, or compressed
+- Check individual PE sections for high entropy
+
+### Packer Signatures
+**Common packers:**
+- UPX (common, legitimate and malicious)
+- ASPack
+- PECompact
+- Themida/WinLicense (strong protection)
+- Armadillo
+- VMProtect
+- Enigma Protector
+- Custom/unknown packers (more suspicious)
+
+### File Size Oddities
+- Very small for claimed functionality (<10KB for complex malware)
+- Unusually large resources section
+- Significant overlay data
+- File size doesn't match claimed type
+
+## Behavioral Indicators
+
+### Anti-Analysis Behaviors
+- Checks for VM artifacts (VMware, VirtualBox, QEMU)
+- Looks for debugger presence
+- Timing checks (execution delays)
+- Checks for analysis tools (Process Monitor, Wireshark, IDA)
+- Sandbox detection (limited resources, username checks)
+- Parent process verification
+- Mouse movement monitoring
+- Checks for user interaction
+
+### Modern EDR/AV Evasion Techniques
+
+**ETW Patching:**
+- Overwrites the prologue of `EtwEventWrite` or `NtTraceEvent` with a `ret` instruction (0xC3) to suppress Event Tracing for Windows telemetry
+- Look for: `VirtualProtect` → `WriteProcessMemory`/`memcpy` targeting ntdll address space, followed by restoration of original page protections
+- Effect: EDR and ETW-based logging goes blind for the process lifetime
+
+**AMSI Bypass:**
+- Patches `AmsiScanBuffer` or `AmsiScanString` in amsi.dll to return S_OK (0) with `AMSI_RESULT_CLEAN` (0), or to return E_INVALIDARG so the caller treats the result as no threat; disables script content scanning
+- Look for: `LoadLibrary("amsi.dll")` + `GetProcAddress` + `VirtualProtect` + small write (1-8 bytes); or `AmsiInitialize` never called while PowerShell/script engine is used
+- Effect: Malicious PowerShell, VBScript, or JScript passes AMSI unchecked
+
+**Direct Syscalls / SysWhispers:**
+- Bypasses EDR hooks placed on ntdll.dll exports by issuing raw syscall/sysenter instructions with the correct System Service Number (SSN)
+- Look for: `syscall` or `sysenter` instructions in non-system modules (use `objdump`/`dumpbin`); runtime SSN resolution via ntdll stub scanning (Hell's Gate, Halo's Gate, Tartarus Gate patterns); absence of ntdll imports for expected operations (no `NtAllocateVirtualMemory` import but memory is allocated)
+- Common SSNs targeted: NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx, NtProtectVirtualMemory
+
+**PPID Spoofing:**
+- Creates a child process with a forged parent PID by passing a handle to the target parent via `UpdateProcThreadAttribute(PROC_THREAD_ATTRIBUTE_PARENT_PROCESS)` before calling `CreateProcess`
+- Look for: `OpenProcess` on an unrelated high-privilege process (e.g., explorer.exe, svchost.exe) immediately before `CreateProcess`; process tree in logs showing implausible parent-child relationships
+- Effect: Evades detections that trigger on suspicious parent-child pairs (e.g., Word spawning cmd.exe)
+
+**Module Stomping / DLL Hollowing:**
+- Loads a legitimate, signed DLL into memory then overwrites its `.text` section with malicious shellcode, so execution appears to originate from a trusted module
+- Look for: `LoadLibrary` on an unexpected DLL followed by `VirtualProtect(PAGE_EXECUTE_READWRITE)` and `WriteProcessMemory`/`memcpy` into that DLL's base address; signed DLL mapped but exports resolve to unexpected code
+- Distinguish from process hollowing: the host process is not suspended — the stomped DLL simply runs attacker code under a legitimate module name
+
+### Persistence Techniques
+- Registry Run key modification
+- Scheduled task creation
+- Service installation
+- WMI event subscriptions
+- DLL hijacking/search order hijacking
+- AppInit_DLLs registry key
+- Startup folder files
+- Browser extension installation
+
+### Network Patterns
+- Beaconing (regular C2 communication)
+- HTTP with suspicious User-Agents
+- Raw socket connections
+- IRC protocols
+- DNS tunneling (unusual DNS queries)
+- TOR usage
+- Fast flux domains
+
+### Data Exfiltration
+- Unusual outbound data volumes
+- Screenshots being taken
+- Credential harvesting
+- Browser data collection
+- Keylogger output transmission
+- File upload to external servers
+
+## Red Flags by File Type
+
+### Executable Files (.exe, .dll, .scr)
+- No digital signature or invalid signature
+- Packed/protected
+- Very few imports (possibly resolved at runtime)
+- Unusual compilation timestamp
+- Suspicious filename mimicking system files
+
+### Script Files (.ps1, .vbs, .js, .bat)
+- Heavy obfuscation
+- Base64 encoded sections
+- Download and execute patterns
+- WMI usage for execution
+- Registry manipulation
+
+### Office Documents (.doc, .xls, .docx, .xlsx)
+- Macros enabled
+- Auto-execute macro names (AutoOpen, Auto_Open, Workbook_Open)
+- External template references
+- Embedded objects
+- Suspicious OLE streams
+
+### Archive Files (.zip, .rar, .7z)
+- Executable files with misleading extensions
+- Multi-layer nested archives
+- Password-protected archives (especially with generic passwords)
+- Suspicious filenames inside
+
+## Quick Classification Patterns
+
+### Ransomware
+- File encryption APIs
+- Many file I/O operations
+- File extension changes
+- Ransom note creation
+- Cryptocurrency addresses
+- File deletion after encryption
+
+### Trojan/RAT
+- Network communication APIs
+- Remote control capabilities
+- Screen capture
+- File transfer
+- Command execution
+- Persistence mechanisms
+
+### Infostealer
+- Browser data access
+- Credential harvesting
+- Clipboard monitoring
+- Form grabbing
+- Cookie stealing
+- Cryptocurrency wallet targeting
+
+### Dropper/Loader
+- Embedded resources
+- Creates and executes files
+- Downloads additional payloads
+- Process injection
+- Minimal visible functionality
+
+### Cryptominer
+- High CPU usage
+- Mining pool connections
+- Cryptocurrency-related strings
+- GPU access APIs
+- Persistence with hidden processes
+
+## Tool Detection Strings
+
+Malware often checks for these analysis tools:
+
+**Debuggers:**
+- OllyDbg, x64dbg, IDA Pro, WinDbg
+- Immunity Debugger
+
+**Monitors:**
+- Process Monitor (procmon), Process Explorer
+- Wireshark, Fiddler
+- TCPView, RegShot
+
+**Sandboxes:**
+- Cuckoo, Joe Sandbox
+- Any.Run, Hybrid Analysis
+- VMRay, FireEye
+
+**VM Artifacts:**
+- "VMware", "VirtualBox", "QEMU", "Hyper-V"
+- "vmmouse", "vmhgfs", "vboxguest"
+- Registry keys related to VMs
+
+**Analysis Artifacts:**
+- Username: "sandbox", "malware", "virus", "sample"
+- Hostname: "VIRUS-PC", "MALWARE-ANALYSIS"
+- Limited resources (low RAM, CPU count)