'malware' 검색 결과

Investigate Windows malware that runs in memory or abuses legitimate system tools. Use logs, registry entries, and memory dumps to trace persistence, identify suspicious activity, and produce detection rules and an analysis report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious PowerShell activity
• Checking WMI persistence mechanisms
• Finding malicious code in memory dumps

Unwrap layers of obfuscated PowerShell malware to recover hidden commands, additional malicious code, and server addresses. Combines script structure analysis with execution tracing and decoding tools to support incident investigation and detection work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an obfuscated PowerShell script
• Recovering hidden commands and additional malicious code
• Extracting suspicious URLs, IP addresses, and file paths

Inspect suspicious PDFs without opening them in a reader. Use PDFiD, pdf-parser, and peepdf to examine internal objects, extract scripts, embedded files, and URLs, and document how the suspected attack works.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Triage suspicious PDF email attachments
• Investigate embedded JavaScript and automatic actions
• Extract embedded files and external URLs

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating malware that stays inactive in a sandbox
• Reviewing behavior reports for analysis evasion
• Developing detections for anti-analysis behavior

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyzes malicious Linux ELF (Executable and Linkable Format) binaries including botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure. Covers static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM ELF samples. Activates for requests involving Linux malware analysis, ELF binary investigation, Linux server compromise assessment, or container malware analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Analyze binaries, malware samples, memory dumps, and packet captures in sandboxed security challenges. Trace program behavior, investigate crashes, and verify exploit conditions while preserving original files, decoded artifacts, and observable evidence for reproducible findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reverse engineer a binary’s structure and behavior
• Unpack a malware sample and separate its components
• Investigate crashes and verify exploit conditions

Guide malware cleanup on infected Windows and Linux systems after containment and investigation. Covers removing malicious files and mechanisms that preserve attacker access, rotating credentials, patching entry points, and documenting validation results before recovery.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Cleaning infected systems after containment
• Removing mechanisms that preserve attacker access
• Rotating compromised credentials and fixing entry points

Build detections for fileless attacks on Windows using process activity, script logs, and endpoint monitoring. Investigate suspicious PowerShell, code injected into running processes, WMI persistence, and registry-based execution with logging guidance and detection query examples.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building detections for suspicious PowerShell activity
• Hunting for code injection into running processes
• Monitoring WMI persistence and registry-based execution

Identify and unpack malware compressed with UPX to prepare executable files for static analysis, which examines code without running it. The workflow covers altered header repair, debugger-based recovery, and validation before analysis in Ghidra or IDA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identifying suspected UPX-packed samples
• Investigating failed UPX decompression
• Recovering binaries with a debugger

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Examine suspicious Word, Excel, and PowerPoint documents by extracting macros and untangling code designed to hide its purpose. Identify download addresses, execution triggers, and attack steps, then document findings and indicators for detecting related threats.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious email attachments
• Finding download addresses hidden in VBA code
• Examining legacy Excel 4.0 macros

Analyze captured RAM with Volatility to investigate suspicious processes, injected code, network connections, and other evidence of compromise. The skill guides memory investigations and organizes findings into timelines and reports, including malware traces absent from disk.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating fileless malware after an endpoint alert
• Finding hidden processes and injected code
• Linking suspicious processes to network connections

Investigate malware hidden in boot records, UEFI firmware, or the operating system’s core. The skill guides evidence collection, boot integrity checks, firmware and memory analysis, and reporting of persistence mechanisms and remediation steps when compromise survives an OS reinstall.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating infections that survive an OS reinstall
• Examining unexplained Secure Boot integrity violations
• Finding hidden processes and suspicious kernel drivers

Write and review YARA-X rules, which identify malware through file patterns. Refine detection strings and conditions, check rule quality with included scripts, test against clean files, improve performance, and migrate rules from legacy YARA.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Write rules targeting a specific malware family
• Review false positives and slow detection rules
• Migrate existing YARA rules to YARA-X

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Static and dynamic malware analysis, YARA rule generation, sandbox configuration, behavioral profiling, and malware family classification

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Structures a clear, actionable malware analysis report covering summary, sample identity, capabilities, IOCs, ATT&CK mapping, and detection guidance for both technical and decision-making audiences. Activates for requests to write, structure, or review a malware analysis or reverse-engineering report.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.