Malware Sandbox Evasion Analyzer

What it does

This skill teaches an AI agent to review behavioral reports from malware sandboxes (Cuckoo Sandbox or AnyRun) and look for signs that a suspicious program is trying to detect the analysis environment and hide its real behavior. It checks for timing tricks, virtual machine artifacts such as VMware or VirtualBox registry keys and process names, user-activity checks like mouse or keyboard polling, and long sleeps meant to outwait the sandbox. The agent then maps findings to MITRE ATT&CK sub-techniques and produces a JSON report with a sophistication score for a human analyst to review.

Try asking

• “Review this Cuckoo JSON report and tell me which sandbox evasion techniques the sample uses, with MITRE mappings”Copy
• “Check this AnyRun export for VM artifact queries and sleep inflation”Copy
• “Score the evasion sophistication of this sample based on its API call sequence”Copy

Get better results

• Provide exported JSON reports rather than raw malware samples; the script parses reports and does not need the binary
• Run the bundled script in an isolated environment, since it executes local Python on files you supply, and review the parser's full source first because the excerpt provided was truncated
• Treat the score as a triage aid and confirm key findings manually before drawing conclusions

What's inside

• references/api-reference.md
• scripts/agent.py
• SKILL.md