Skip to content
Get packs

Linux ELF Malware Analysis

Guides an agent through triaging and analyzing suspicious Linux ELF malware samples

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent follows a structured playbook for examining suspicious Linux program files (ELF binaries) that may be botnets, cryptominers, ransomware or rootkits. It walks through identifying the file's properties and hashes, pulling out strings that hint at network addresses or persistence tricks, watching system calls in an isolated lab, and reverse engineering the code with tools like Ghidra. It also includes a Python script that computes hashes, entropy and basic ELF header details.

Great for

  • Incident responders investigating a compromised Linux server or container
  • Malware analysts triaging suspicious ELF files in an isolated lab VM
  • Security students learning Linux malware analysis workflows

Skip it if

  • Running unknown samples on a production or personal machine, because the workflow involves executing malware under strace, ltrace and GDB and could cause harm if isolation fails
  • Windows PE malware, which the skill itself says to handle with other tools such as PEStudio, Ghidra or IDA

Try asking

  • “Triage this suspicious ELF binary found in /tmp on our web server and tell me if it looks like a miner”
  • “Compute the hashes and entropy of this sample and list any high-entropy sections”
  • “Search the strings from this binary for C2 domains, IPs and persistence paths”
  • “Outline how to trace system calls for this botnet sample in an isolated VM”
Step-by-step guide: how to use Linux ELF Malware AnalysisInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-linux-elf-malware.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-linux-elf-malware.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-linux-elf-malware.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only run samples inside an isolated, snapshotted VM without access to your production network or credentials
  • Ask the agent to start with static analysis (hashes, headers, strings) before any dynamic execution
  • Keep the script's output and your notes so findings can be reproduced and shared with your IR team

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.