Name: malware-genome
Author: M-Inc-lab

Imported from M-Inc-lab/BugCrusher (Skills/malware-genome/SKILL.md). Install upstream with npx skills add M-Inc-lab/BugCrusher --skill malware-genome. Copyright stays with the author.

MALWARE GENOME ENGINE

Rule #1: Every malware family has a signature. Find it.

MALWARE TAXONOMY

Tier 1 — Autonomous Spreaders

AI Worms: Self-replicating via LLM prompts, agentic tool abuse, context poisoning
Classic Worms: MS08-067, EternalBlue, SMB exploits, email propagation
Botnets: Mirai-style IoT, TrickBot, Emotet propagation

Tier 2 — Persistence + Stealth

Rootkits: DKOM, bootkits, UEFI firmware rootkits
Trojans: Remote Access Trojans (RATs), banking trojans, droppers
Spyware: Keyloggers, screen capture, clipboard theft

Tier 3 — Impact + Ransom

Ransomware: File encryption (Locky, Ryuk, REvil), Galph
Cryptominers: XMRig, coinhive clones, browser-based miners
Wipers: NotPetya, WhisperGate, acid wiping

Tier 4 — Nation-State Toolkits

C2 Frameworks: Cobalt Strike, Metasploit, Covenant, Sliver
Exfiltration Kits: ARCHTIC, TURBINE, SECONDDATE
Lateral Movement: Pass-the-Hash, Golden Ticket, Kerberoasting

DETECTION SIGNATURES

AI Worm DNA Markers

RECURSIVE_LOOP: tool_call_depth > 5 in same session
CONTEXT_POISON: system_prompt_length delta > 20%
SEMANTIC_DRIFT: output_topic_correlation < 0.3 from previous 10 calls
PROXY_ACTIVITY: unexpected file_write in /home/workspace during agent task

Ransomware Behavioral Fingerprints

FILE_CHURN: >50 new files created in 60 seconds
EXTENSION_SWEEP: mass rename to .encrypted, .locked, .crypto
SHADOW_DELETE: vssadmin delete /all on Windows
SCHEDULE_CLEAR: atq / crontab purge
NETWORK_ERUPTION: unusual outbound port 3333, 4444, 5555

Cryptominer Patterns

CPU_SPIKE: >80% CPU for >10 min on idle system
POOL_CONNECT: long-lived connection to port 3333, 4444, 9999
STRATUM_MINER: XMRig-style user-agent
WALLET_REACH: outbound to known miner pool domains

MUTATION CHAIN TRACKING

Each malware specimen gets a Genome ID:

GENOME:
  family: [EMOTET|TRICKBOT|...]
  variant: [v1|v2|v3]
  mut_signature: SHA256(first 8 bytes + behavior_hash)
  lineage: [parent_genome_ids]
  capability_tags: [keylog, spread, persist, c2, ...]
  detection_age: days_since_first_seen
  active_c2: [list of IPs/domains]

EVOLUTION ENGINE

Mutation Vectors

1. Code-Level Mutation

Binary patching: NOP slides, jump modifications
Packer variation: UPX壳层替换
Crypto mutation: XOR key rotation, algorithm swap

2. Behavioral Mutation

Sleep obfuscation: timing variance to evade sandbox
Environment detection: VM-aware branching
Anti-analysis: debugger detection, timing checks

3. Delivery Mutation

C2 rotation: fast-flux DNS, domain shadowing
Phishing template variation: HTML smuggling, doc macro mutation
Exploit kit flux: landing page rotation

Attribution Engine

attribution_score = {
    'code_similarity': 0.4,      # Binary diff score
    'c2_infrastructure': 0.25,   # IP/domain overlap
    'target_selection': 0.2,     # Victim profile match
    'timing_pattern': 0.15      # Campaign timing correlation
}

USAGE

Classify a specimen

Classify the file at /tmp/suspicious_binary
Extract: genome_id, family, capabilities, lineage

Track mutation chain

Reconstruct the mutation chain for genome G:abc123
Map: parent → mutations → current strain

Generate detection signatures

For AI worm family "MORPHISM-1": 
  Generate YARA + Snort rules
  Output: detection_logic, evasion_resistance_score

{ "ocm": "1", "id": "m-inc-lab-bugcrusher-malware-genome", "kind": "skill", "name": "malware-genome", "description": "Comprehensive malware classification, behavioral fingerprinting, and family attribution system. Covers ransomware, trojans, worms, bots, rootkits, spyware, cryptominers, APT toolkits, and self-mutating strains. Tracks mutation chains and attribution across malware families.", "publisher": "M-Inc-lab", "version": "1.0.0", "capabilities": { "domains": [ "general" ], "tags": [ "skill-md", "github" ], "languages": [ "en" ] }, "quality_prior": 0.6, "examples": [ "Comprehensive malware classification, behavioral fingerprinting, and family attribution system. Covers ransomware, trojans, worms, bots, rootkits, spyware, cryptominers, APT toolkits, and self-mutating strains. Tracks mutation chains and attribution across malware families." ], "primary": false, "metadata": { "source": { "provider": "github", "repository": "https://github.com/M-Inc-lab/BugCrusher", "path": "Skills/malware-genome/SKILL.md", "ref": "eb2842c2f1007d9e67c5288f9287d148617b9db6", "url": "https://github.com/M-Inc-lab/BugCrusher/blob/eb2842c2f1007d9e67c5288f9287d148617b9db6/Skills/malware-genome/SKILL.md", "key": "M-Inc-lab/BugCrusher/Skills/malware-genome/SKILL.md" }, "compatibility": "Created for Zo Computer" }, "instructions": "# MALWARE GENOME ENGINE\n\n**Rule #1: Every malware family has a signature. Find it.**\n\n---\n\n## MALWARE TAXONOMY\n\n### Tier 1 — Autonomous Spreaders\n- **AI Worms**: Self-replicating via LLM prompts, agentic tool abuse, context poisoning\n- **Classic Worms**: MS08-067, EternalBlue, SMB exploits, email propagation\n- **Botnets**: Mirai-style IoT, TrickBot, Emotet propagation\n\n### Tier 2 — Persistence + Stealth\n- **Rootkits**: DKOM, bootkits, UEFI firmware rootkits\n- **Trojans**: Remote Access Trojans (RATs), banking trojans, droppers\n- **Spyware**: Keyloggers, screen capture, clipboard theft\n\n### Tie", "cost": { "context_tokens": 874 } }

malware-genome

About