mrphrazer

Agentic Malware Analysis — Research agent for Claude Code

Research community intermediate

Agentic malware analysis environment with MCP-connected disassemblers, RE tooling, and structured workflows for Claude Code and Codex CLI.

How to install Agentic Malware Analysis

This entry records only its repository, not the path inside it, so there is no exact command to give. Open mrphrazer/agentic-malware-analysis and copy the folder into ~/.claude/agents/.

What Agentic Malware Analysis does

Agentic malware analysis environment with MCP-connected disassemblers, RE tooling, and structured workflows for Claude Code and Codex CLI.

Alternatives in Research

CLI Explore Agent — Read-only code exploration via Bash + CLI semantic dual-source analysis, with schema-validated structured outp 530 ★
Contract Neutral Reviewer — Contract-neutral fallback reviewer 188 ★
Job Analysis — Job posting analyst that extracts structured metadata and job analysis for tailored applications 167 ★

README

Agentic Malware Analysis

Automated deep malware reverse engineering driven by AI agents. A Kali-based Docker environment pairs 50+ RE tools with MCP-connected disassembler backends ([Binary Ninja][binary-ninja-headless-mcp] or [Ghidra][ghidra-headless-mcp]) and a structured multi-phase orchestrator skill that turns a raw binary into a case directory of ranked evidence, validated hypotheses, component maps, and a prioritized deep-analysis plan -- with no human interaction required. Ready for [Claude Code][claude-code] and [Codex CLI][codex-cli].

See the companion blog post [Building a Pipeline for Agentic Malware Analysis][blog-post] for background, a case study, and evaluation.

Why

Initial malware analysis involves a number of routine steps: collecting hashes and compiler artifacts, extracting strings, inspecting imports, running YARA and capa, correlating the results, and identifying code areas for closer inspection. These steps provide the basis for deeper analysis, but they are often repetitive and time-consuming.

This repository automates much of that workflow. The orchestrator skill collects and organizes analysis artifacts, highlights relevant signals, generates evidence-backed hypotheses, builds a basic component model, and prepares a prioritized deep-analysis plan. All intermediate results are stored in a per-sample case directory on disk, making the workflow easier to resume and review.

Via MCP, the agent can also use Binary Ninja or Ghidra to inspect functions, follow cross-references, and tie findings to concrete code locations. The result is a structured starting point for follow-up analysis rather than ad hoc triage alone.

Features

Kali Linux container with 50+ RE and malware analysis tools
Automatic MCP backend selection (Binary Ninja or Ghidra)
malware-analysis-orchestrator skill for Claude Code and Codex CLI
Helper scripts for strings, imports, YARA, capa, signal ranking, hypothesis generation
Bundled YARA rules (crypto, anti-debug/anti-VM, capabilities, packer -- from [Yara-Rules/rules][yara-rules], GPL-2.0)
Wrapper scripts for Claude Code and Codex with aggressive defaults
Persistent state across container rebuilds (BN license, Claude auth, Codex auth)
PE, ELF, and Mach-O support
Content-hash-based image caching

Prerequisites

Docker with buildx
Anthropic API key or Claude account (for Claude Code) or OpenAI API key (for Codex)
Recommended: Binary Ninja Linux zip with a headless-capable license (see Setup below)

Quick Start

**Important:** `run_docker.sh` mounts your current working directory into the container at `/agent`. The agent wrappers run with full permissions (`--dangerously-skip-permissions` / `--dangerously-bypass-approvals-and-sandbox`) by design, so the agent can read, write, and execute anything in that directory. Clone the repository into a dedicated directory and place only the files you want the agent to access there.