agentsclimarketplace

Analyzing loaders and droppers

Skill meltedinhex/analyst-ai-pack/skills/analyzing-loaders-and-droppers

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-loaders-and-droppers

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Analyzes loader and dropper samples by identifying staging behavior — embedded or downloaded next-stage payloads, decode/decrypt routines, and the execution mechanism used to run the next stage. Activates for requests to analyze a loader or dropper, find a staged payload, or map multi-stage delivery behavior.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

2.8 KB, as published. Nobody here has run it

Analyzing Loaders and Droppers

When to Use

  • You have a first-stage loader/dropper and need to find the next stage: an embedded resource, an appended overlay, or a download URL.
  • You need to identify the decode/decrypt routine and the execution mechanism (process creation, injection, scheduled task, DLL side-loading).

Do not use this to run the loader and fetch live stages — characterize staging statically and retrieve next stages only in an isolated sandbox.

Prerequisites

  • The loader/dropper sample (read inertly).

Safety & Handling

  • Read bytes statically; defang download URLs; never execute to pull live payloads.

Workflow

Step 1: Locate staged payloads

python scripts/analyst.py stage sample.bin

Detects embedded PE/archive signatures, an appended overlay beyond the PE's mapped size, large high-entropy blobs, and download URLs.

Step 2: Identify decode/execution mechanism

Scan imports/strings for decode APIs (CryptDecrypt, base64), download APIs (URLDownloadToFile, WinHttp, InternetReadFile), and execution (CreateProcess, ShellExecute, WinExec, side-loading hints).

Step 3: Map the delivery chain

Document stage-1 → decode → stage-2 → execution and map each step to ATT&CK.

Step 4: Defang and report

Defang URLs and produce IOCs for the staging infrastructure.

Validation

  • Embedded/overlay stages are confirmed by signature or entropy, with offsets recorded.
  • Download URLs and execution mechanism are identified from imports/strings.
  • The multi-stage chain maps cleanly to ATT&CK techniques.

Pitfalls

  • Treating a benign overlay (installer data, signature) as a payload without corroboration.
  • Missing stages fetched at runtime when no URL is in plaintext (obfuscated/encoded).
  • Confusing the decode routine for the payload itself.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.