malware-analysis-triage

Malware Analysis Triage (capa / FLOSS / ghidriff)

Overview

Three FLARE/Mandiant defensive CLIs that turn an unknown blob into actionable intelligence in seconds, before you sink hours into IDA/Ghidra:

• capa — what can this binary do? Static capability detection mapped to MITRE ATT&CK and MBC (persistence, C2, injection, anti-analysis, crypto).
• FLOSS — what is it hiding? Recovers stack / tight / decoded strings that plain strings cannot see (C2 URLs, keys, mutexes, config).
• ghidriff — what changed? Headless Ghidra binary diff between two builds, rendered as shareable markdown — for n-day / Patch-Tuesday research and variant hunting.

Framing: This is defensive triage and authorized RE. Use it on samples you are authorized to analyze (your own, quarantined, sandbox-detonated, CTF, or vendor patches). Every capability you find should feed a detection, not an attack — see the Defensive Pairing column below.

When to Use

• You have an unknown/suspicious executable and need a fast behavior summary.
• strings returned nothing useful but the sample is clearly doing something.
• You need MITRE ATT&CK technique IDs to write or validate Sigma/EDR/YARA rules.
• You want to know exactly which functions to reverse first (jump to addresses).
• A vendor shipped a patch and you need to find the fixed code path (n-day).

When NOT to use: dynamic/sandbox detonation (use CAPE/DRAKVUF/VMRay, then feed their JSON to capa); live debugging (use $reverse-engineering-toolkit);

Install (Windows, this workspace)

Quick Reference

Defensive Pairing (turn findings into detections)

Gotchas

Workflow

Related