analyzing-loaders-and-droppers
starsforks
How to install analyzing-loaders-and-droppers?
meltedinhex/analyst-ai-pack/analyzing-loaders-and-droppers
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-loaders-and-droppersAnalyzes loader and dropper samples by identifying staging behavior — embedded or
SKILL.md
| 1 | # Analyzing Loaders and Droppers |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an |
| 6 | appended overlay, or a download URL. |
| 7 | - You need to identify the decode/decrypt routine and the execution mechanism (process creation, |
| 8 | injection, scheduled task, DLL side-loading). |
| 9 | |
| 10 | **Do not use** this to run the loader and fetch live stages — characterize staging statically and |
| 11 | retrieve next stages only in an isolated sandbox. |
| 12 | |
| 13 | ## Prerequisites |
| 14 | |
| 15 | - The loader/dropper sample (read inertly). |
| 16 | |
| 17 | ## Safety & Handling |
| 18 | |
| 19 | - Read bytes statically; defang download URLs; never execute to pull live payloads. |
| 20 | |
| 21 | ## Workflow |
| 22 | |
| 23 | ### Step 1: Locate staged payloads |
| 24 | |
| 25 | ```bash |
| 26 | python scripts/analyst.py stage sample.bin |
| 27 | ``` |
| 28 | |
| 29 | Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large |
| 30 | high-entropy blobs, and download URLs. |
| 31 | |
| 32 | ### Step 2: Identify decode/execution mechanism |
| 33 | |
| 34 | Scan imports/strings for decode APIs (`CryptDecrypt`, base64), download APIs (`URLDownloadToFile`, |
| 35 | `WinHttp`, `InternetReadFile`), and execution (`CreateProcess`, `ShellExecute`, `WinExec`, |
| 36 | side-loading hints). |
| 37 | |
| 38 | ### Step 3: Map the delivery chain |
| 39 | |
| 40 | Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK. |
| 41 | |
| 42 | ### Step 4: Defang and report |
| 43 | |
| 44 | Defang URLs and produce IOCs for the staging infrastructure. |
| 45 | |
| 46 | ## Validation |
| 47 | |
| 48 | - Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded. |
| 49 | - Download URLs and execution mechanism are identified from imports/strings. |
| 50 | - The multi-stage chain maps cleanly to ATT&CK techniques. |
| 51 | |
| 52 | ## Pitfalls |
| 53 | |
| 54 | - Treating a benign overlay (installer data, signature) as a payload without corroboration. |
| 55 | - Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded). |
| 56 | - Confusing the decode routine for the payload itself. |
| 57 | |
| 58 | ## References |
| 59 | |
| 60 | - See [`references/api-reference.md`](references/api-reference.md) for the stager. |
| 61 | - ATT&CK T1105 and T1140 (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
