Malware skills

Detecting Fileless Malware Techniques

mukul975

Identify and analyze fileless malware threats effectively.

Analyzing Command-and-Control Communication

mukul975

Deep dive into malware C2 communication analysis.

Extracting IOCs from Malware Samples

mukul975

Automate the extraction of threat indicators from malware.

Detecting Process Injection Techniques

mukul975

Identify and analyze malware process injections effectively.

Analyzing Ransomware Encryption Mechanisms

mukul975

Assess and reverse-engineer ransomware encryption schemes.

Deobfuscating JavaScript Malware

mukul975

Reveal the original logic behind obfuscated JavaScript malware.

Analyzing Bootkit and Rootkit Samples

mukul975

Detect and analyze advanced malware at the firmware level.

Detecting Rootkit Activity

mukul975

Identify hidden rootkits on compromised systems.

Analyzing Macro Malware

mukul975

Identify and analyze malicious VBA macros in Office documents.

Analyzing Network Traffic of Malware

mukul975

Identify and analyze malware network behavior effectively.

Analyzing Malware Behavior

mukul975

Dynamic analysis of malware using Cuckoo Sandbox.

Analyzing Android Malware

mukul975

Static analysis of Android APKs for malware detection.

Analyzes malicious PDF files using PDFiD, pdf-parser, and peepdf to identify embedded JavaScript, shellcode, exploits, and suspicious objects without opening the document. Determines the attack vector and extracts embedded payloads for further analysis. Activates for requests involving PDF malware analysis, malicious document analysis, PDF exploit investigation, or suspicious attachment triage.

Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.

Analyzes RAM memory dumps from compromised systems using the Volatility framework to identify malicious processes, injected code, network connections, loaded modules, and extracted credentials. Supports Windows, Linux, and macOS memory forensics. Activates for requests involving memory forensics, RAM analysis, volatile data examination, process injection detection, or memory-resident malware investigation.

Analyze malicious Linux ELF binaries — botnets, cryptominers, ransomware, and rootkits targeting Linux servers, containers, and cloud infrastructure — through static analysis, dynamic tracing, and reverse engineering of x86_64 and ARM samples. Use when investigating Linux malware, triaging a suspicious ELF binary, assessing a compromised Linux server, or analyzing container-targeted malware.