analyzing-java-jar-malware

Name: analyzing-java-jar-malware
Author: meltedinhex

18stars5forks

How to install analyzing-java-jar-malware?

meltedinhex/analyst-ai-pack/analyzing-java-jar-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-java-jar-malware

Installs into the current project.

Summary

Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Java/JAR Malware
2
3	## When to Use
4
5	- You have a malicious or suspicious `.jar` (often a cross-platform RAT) and need to map its
6	structure, entry point, obfuscation, and capability surface before decompiling.
7	- You want to triage a Java payload without running the JVM.
8
9	Do not use `java -jar` to run it — that executes the malware. Treat the JAR as a ZIP and read
10	its contents statically.
11
12	## Prerequisites
13
14	- The JAR file, read inertly. Optional: a Java decompiler (CFR, Procyon) for the next stage.
15
16	## Safety & Handling
17
18	- Read the archive statically; never launch the JVM on the sample. Defang any URLs found.
19
20	## Workflow
21
22	### Step 1: Inventory the archive and entry point
23
24	```bash
25	python scripts/analyst.py inspect sample.jar
26	```
27
28	Lists `.class` files, embedded resources/payloads (nested JARs, scripts, encrypted blobs), and
29	reads `META-INF/MANIFEST.MF` for `Main-Class`/`Premain-Class`.
30
31	### Step 2: Detect obfuscation and packers
32
33	Flags obfuscator fingerprints (Allatori, ProGuard, Zelix), single-character class/package names,
34	and string-decryption indicators.
35
36	### Step 3: Flag capability classes
37
38	Surface dangerous API usage in strings/constant pools: `Runtime.exec`/`ProcessBuilder`,
39	`java.lang.reflect`, `URLClassLoader`, `javax.crypto`, `java.net.Socket`, registry/persistence
40	helpers.
41
42	### Step 4: Route to decompilation
43
44	Hand the key classes to a decompiler (CFR/Procyon) for source recovery; record IOCs.
45
46	## Validation
47
48	- The manifest entry point is read and reported.
49	- Embedded payloads/nested archives are enumerated.
50	- Capability flags are backed by concrete class/string evidence.
51
52	## Pitfalls
53
54	- String-encrypted samples where capability strings appear only after decryption.
55	- Multi-stage droppers that unpack a second JAR at runtime.
56	- Benign obfuscated commercial JARs — corroborate with capability and delivery context.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
61	- JVM/JAR format and ATT&CK T1027 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-java-jar-malware

18stars5forks

View on GitHub

How to install analyzing-java-jar-malware?

meltedinhex/analyst-ai-pack/analyzing-java-jar-malware

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-java-jar-malware

Installs into the current project.

Summary

Analyzes Java/JAR malware (such as Adwind/jRAT-class cross-platform RATs) by

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Java/JAR Malware
2
3	## When to Use
4
5	- You have a malicious or suspicious `.jar` (often a cross-platform RAT) and need to map its
6	structure, entry point, obfuscation, and capability surface before decompiling.
7	- You want to triage a Java payload without running the JVM.
8
9	Do not use `java -jar` to run it — that executes the malware. Treat the JAR as a ZIP and read
10	its contents statically.
11
12	## Prerequisites
13
14	- The JAR file, read inertly. Optional: a Java decompiler (CFR, Procyon) for the next stage.
15
16	## Safety & Handling
17
18	- Read the archive statically; never launch the JVM on the sample. Defang any URLs found.
19
20	## Workflow
21
22	### Step 1: Inventory the archive and entry point
23
24	```bash
25	python scripts/analyst.py inspect sample.jar
26	```
27
28	Lists `.class` files, embedded resources/payloads (nested JARs, scripts, encrypted blobs), and
29	reads `META-INF/MANIFEST.MF` for `Main-Class`/`Premain-Class`.
30
31	### Step 2: Detect obfuscation and packers
32
33	Flags obfuscator fingerprints (Allatori, ProGuard, Zelix), single-character class/package names,
34	and string-decryption indicators.
35
36	### Step 3: Flag capability classes
37
38	Surface dangerous API usage in strings/constant pools: `Runtime.exec`/`ProcessBuilder`,
39	`java.lang.reflect`, `URLClassLoader`, `javax.crypto`, `java.net.Socket`, registry/persistence
40	helpers.
41
42	### Step 4: Route to decompilation
43
44	Hand the key classes to a decompiler (CFR/Procyon) for source recovery; record IOCs.
45
46	## Validation
47
48	- The manifest entry point is read and reported.
49	- Embedded payloads/nested archives are enumerated.
50	- Capability flags are backed by concrete class/string evidence.
51
52	## Pitfalls
53
54	- String-encrypted samples where capability strings appear only after decryption.
55	- Multi-stage droppers that unpack a second JAR at runtime.
56	- Benign obfuscated commercial JARs — corroborate with capability and delivery context.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the inspector.
61	- JVM/JAR format and ATT&CK T1027 references (linked in frontmatter).

People who liked this also viewed

6 picks

Type