A high-performance malware analysis skill for REMnux designed to identify payloads, extract indicators of compromise (IOCs), and generate professional triage reports.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install remnux-malware-triage
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install remnux-malware-triage using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is REMnux Malware Triage?
This Openclaw Skills extension empowers AI agents to perform triage-first malware investigations directly within a REMnux environment. By focusing on rapid identification and extraction over deep reverse engineering, it ensures analysts get the most critical data first. The skill handles a wide variety of artifacts, including PE files, ELFs, malicious scripts, and mobile APKs, while maintaining a strict security posture against hostile code.
Built for speed and technical accuracy, this skill streamlines the intake of suspicious files, hashes, or attachments. It leverages the robust REMnux toolchain to separate observed indicators from inferred data, providing a clear picture of a sample's likely intent and infrastructure without unnecessary resource consumption.
REMnux Malware Triage Use Cases
- Rapidly identifying the real payload hidden inside malicious archives, disk images, or installers.
- Extracting and normalizing high-value IOCs such as C2 domains, IPs, file hashes, and registry keys.
- Analyzing suspicious PDF or Office documents for embedded macros, scripts, and remote templates.
- Performing infrastructure hunting to identify first-party backend hosts, Firebase configs, and campaign identifiers.
- Generating standardized markdown triage reports for security operations center (SOC) documentation and incident response.
How REMnux Malware Triage Works
- Intake and Scoping: The skill identifies the true file type, computes hashes, and inventories containers like archives to select the primary payload.
- First-Pass Triage: Executes high-yield static analysis tools tailored to the artifact type, such as header analysis for EXEs or deobfuscation for scripts.
- IOC and Infrastructure Extraction: Automatically pulls, normalizes, and deduplicates indicators, distinguishing between static, runtime, and externally claimed data.
- Network Activity Analysis: Investigates potential beaconing behavior, recovers communication parameters, and identifies backend API paths.
- Reporting: Produces a concise chat summary and a detailed markdown report using standardized templates stored in the output directory.
REMnux Malware Triage Setup
To integrate this skill into your Openclaw Skills workflow, ensure your environment is configured correctly:
# Ensure the output directory exists on your REMnux host
mkdir -p /home/remnux/files/output
# Verify that your agent has access to the local reference playbooks
ls /home/remnux/skills/remnux-malware-triage/references/
No additional software installation is required if you are already running a standard REMnux distribution.
REMnux Malware Triage Data Schema & Taxonomy
The skill organizes analysis data and metadata using a structured taxonomy to ensure consistency across investigations:
| Data Category | Output Type | Default Path |
|---|---|---|
| Triage Reports | Markdown (.md) | /home/remnux/files/output/<sample>_triage.md |
| Deep Analysis | Markdown (.md) | /home/remnux/files/output/<sample>_deep_dive.md |
| IOCs | Normalized List | Included in Reports & Chat Summary |
| Playbooks | Reference MD | {baseDir}/references/ |
All IOCs are categorized as either observed (directly found in the sample) or inferred (suggested by external intelligence or logic).
REMnux Malware Triage Advanced Features
- Automated Escalation Gates: Only triggers deep static reversing or dynamic analysis when specific evidence thresholds are met or requested.
- Multi-Artifact Handling: Detects split archives and multi-part installers, triaging each component based on risk level.
- Mobile Backend Extraction: Specialized logic for Android APKs to recover Firebase project IDs, OAuth client IDs, and push provider configurations.
- Hostile Code Awareness: Implements strict rules to never follow instructions embedded in malware and treats all extracted text as hostile strings.
- Token-Efficient Workflow: Prioritizes high-yield steps and reuses prior results to maintain efficiency within Openclaw Skills sessions.
SKILL.md
Loading
Related Openclaw Skills
Salary Intelligence
A specialized labor market intelligence tool providing granular EU salary data and OECD-backed AI job displacement risk indicators.
Customs Analytics
A high-performance data analytics skill providing granular access to 3.8GB of Latvia customs declarations and KN8-level product trends.
NexPix Cloudflare Image Generation
NexPix is a high-performance AI image generation skill that leverages Cloudflare Workers AI for free tier production with premium fallback options.
Staking Analysis Skill
A professional CLI-driven skill for analyzing blockchain staking operations, evaluating protocol security, and managing on-chain data entries.
Exuvia
Exuvia is a specialized research ecosystem that enables AI agents to collaborate, peer-review, and maintain persistent knowledge across sessions.
Session Daily Backup - Obsidian
A professional backup utility that syncs Openclaw Skills chat logs directly to your Obsidian Vault with beautiful formatting and automated monitoring.
Featured*
