[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ESNEJ1HTNZTV3A7PDMJ5BP":3,"skill-same:01M6ESNEJ1HTNZTV3A7PDMJ5BP":124},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":52,"linkOnly":53,"markdownContent":54,"markdownBody":55,"frontMatter":56,"refName":73,"commitSha":74,"skillDirectory":75,"forksCount":14,"repositoryHtmlUrl":76,"repositoryHomepageUrl":77,"ownerHtmlUrl":78,"ownerBlogUrl":6,"ownerDescription":79,"updatedAt":80,"install":81,"resources":94},"01M6ESNEJ1HTNZTV3A7PDMJ5BP","analyzing-malware-family-relationships-with-malpedia",null,"Use the Malpedia platform and API to research malware family relationships, track variant evolution, link families to threat actors, and integrate YARA rules for detection across malware lineages.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51],"with","malware","malpedia","analyzing malware family relationships with malpedia","analyzing","relationships","family","api","id","platform","across","cm","use","Rules","cybersecurity","analysis","malware-family","threat-intelligence","threat-actor","research","2026-11-10 10:12:30",false,"---\nname: analyzing-malware-family-relationships-with-malpedia\ndescription: Use the Malpedia platform and API to research malware family relationships,\n  track variant evolution, link families to threat actors, and integrate YARA rules\n  for detection across malware lineages.\ndomain: cybersecurity\nsubdomain: threat-intelligence\ntags:\n- malpedia\n- malware-family\n- yara\n- threat-actor\n- malware-tracking\n- threat-intelligence\n- variant-analysis\n- malware-intelligence\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- ID.RA-01\n- ID.RA-05\n- DE.CM-01\n- DE.AE-02\nmitre_attack:\n- T1587.001\n- T1027\n- T1071\n---\n# Analyzing Malware Family Relationships with Malpedia\n\n## Overview\n\nMalpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware family relationships with malpedia\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `yara-python`, `stix2` libraries\n- Malpedia API key (register at https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002F)\n- Understanding of malware classification and naming conventions\n- Familiarity with YARA rule syntax for detection\n- Access to malware samples for validation (optional)\n\n## Key Concepts\n\n### Malpedia Data Model\n\nMalpedia organizes malware into Families (e.g., \"win.cobalt_strike\"), each containing: aliases (vendor-specific names like \"Beacon\", \"CobaltStrike\"), YARA rules (community and vendor-contributed), actor associations (threat groups using the family), reference reports (CTI reports documenting the family), and sample hashes (representative samples for each variant).\n\n### Malware Family Naming\n\nMalpedia uses the format `platform.family_name` (e.g., `win.emotet`, `elf.mirai`, `apk.flubot`). Platforms include win (Windows), elf (Linux), apk (Android), osx (macOS), and py (Python). This standardized naming resolves the \"many names\" problem where different vendors assign different names to the same malware.\n\n### Family Relationships\n\nMalware families have relationships including: parent-child (code reuse, forks), loader-payload (Emotet loads TrickBot loads Ryuk), shared authorship (same threat actor develops multiple tools), and infrastructure sharing (common C2 frameworks).\n\n## Workflow\n\n### Step 1: Query Malpedia API for Malware Families\n\n```python\nimport requests\nimport json\nfrom collections import defaultdict\n\nclass MalpediaClient:\n    BASE_URL = \"https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fapi\"\n\n    def __init__(self, api_key):\n        self.headers = {\"Authorization\": f\"apitoken {api_key}\"}\n\n    def get_family_list(self):\n        \"\"\"Get list of all malware families.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Flist\u002Ffamilies\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            families = resp.json()\n            print(f\"[+] Malpedia: {len(families)} malware families\")\n            return families\n        return {}\n\n    def get_family_info(self, family_name):\n        \"\"\"Get detailed information about a malware family.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Ffamily\u002F{family_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            info = resp.json()\n            print(f\"[+] Family: {family_name}\")\n            print(f\"    Aliases: {info.get('alt_names', [])}\")\n            print(f\"    Actors: {[a.get('value', '') for a in info.get('attribution', [])]}\")\n            print(f\"    URLs: {len(info.get('urls', []))} references\")\n            return info\n        print(f\"[-] Family not found: {family_name}\")\n        return None\n\n    def get_family_yara(self, family_name):\n        \"\"\"Get YARA rules for a malware family.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Fyara\u002F{family_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            rules = resp.json()\n            rule_count = sum(len(v) for v in rules.values()) if isinstance(rules, dict) else 0\n            print(f\"[+] YARA rules for {family_name}: {rule_count} rules\")\n            return rules\n        return {}\n\n    def get_actor_families(self, actor_name):\n        \"\"\"Get malware families associated with a threat actor.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Factor\u002F{actor_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            data = resp.json()\n            families = data.get(\"families\", {})\n            print(f\"[+] {actor_name}: {len(families)} malware families\")\n            return data\n        return {}\n\n    def search_families(self, keyword):\n        \"\"\"Search families by keyword.\"\"\"\n        all_families = self.get_family_list()\n        matches = {\n            name: info for name, info in all_families.items()\n            if keyword.lower() in name.lower()\n            or keyword.lower() in str(info.get(\"alt_names\", [])).lower()\n        }\n        print(f\"[+] Search '{keyword}': {len(matches)} matches\")\n        return matches\n\nclient = MalpediaClient(\"YOUR_MALPEDIA_API_KEY\")\nfamilies = client.get_family_list()\nemotet_info = client.get_family_info(\"win.emotet\")\n```\n\n### Step 2: Map Malware Family Relationships\n\n```python\nclass MalwareFamilyMapper:\n    def __init__(self, malpedia_client):\n        self.client = malpedia_client\n        self.relationship_graph = defaultdict(list)\n\n    def map_actor_ecosystem(self, actor_name):\n        \"\"\"Map the malware ecosystem used by a threat actor.\"\"\"\n        actor_data = self.client.get_actor_families(actor_name)\n        families = actor_data.get(\"families\", {})\n\n        ecosystem = {\n            \"actor\": actor_name,\n            \"families\": [],\n            \"family_count\": len(families),\n        }\n\n        for family_name in families:\n            info = self.client.get_family_info(family_name)\n            if info:\n                ecosystem[\"families\"].append({\n                    \"name\": family_name,\n                    \"aliases\": info.get(\"alt_names\", []),\n                    \"description\": info.get(\"description\", \"\")[:200],\n                    \"shared_actors\": [\n                        a.get(\"value\", \"\")\n                        for a in info.get(\"attribution\", [])\n                    ],\n                    \"reference_count\": len(info.get(\"urls\", [])),\n                })\n\n        print(f\"\\n=== {actor_name} Malware Ecosystem ===\")\n        for fam in ecosystem[\"families\"]:\n            shared = [a for a in fam[\"shared_actors\"] if a != actor_name]\n            print(f\"  {fam['name']}\")\n            print(f\"    Aliases: {fam['aliases'][:5]}\")\n            if shared:\n                print(f\"    Also used by: {shared}\")\n\n        return ecosystem\n\n    def find_shared_tooling(self, actor_names):\n        \"\"\"Find malware families shared between threat actors.\"\"\"\n        actor_families = {}\n        for actor in actor_names:\n            data = self.client.get_actor_families(actor)\n            actor_families[actor] = set(data.get(\"families\", {}).keys())\n\n        # Find overlaps\n        shared = {}\n        for i, actor1 in enumerate(actor_names):\n            for actor2 in actor_names[i+1:]:\n                common = actor_families[actor1] & actor_families[actor2]\n                if common:\n                    shared[f\"{actor1} \u003C-> {actor2}\"] = sorted(common)\n\n        print(f\"\\n=== Shared Tooling Analysis ===\")\n        for pair, families in shared.items():\n            print(f\"  {pair}: {len(families)} shared families\")\n            for f in families[:5]:\n                print(f\"    - {f}\")\n\n        return shared\n\n    def build_loader_payload_chain(self, family_name):\n        \"\"\"Build the loader-payload delivery chain for a family.\"\"\"\n        info = self.client.get_family_info(family_name)\n        if not info:\n            return {}\n\n        chain = {\n            \"family\": family_name,\n            \"description\": info.get(\"description\", \"\"),\n            \"known_loaders\": [],\n            \"known_payloads\": [],\n        }\n\n        # Common known delivery chains\n        known_chains = {\n            \"win.emotet\": {\"loaders\": [\"email\u002Fmacro\"], \"payloads\": [\"win.trickbot\", \"win.qakbot\", \"win.cobalt_strike\"]},\n            \"win.trickbot\": {\"loaders\": [\"win.emotet\"], \"payloads\": [\"win.ryuk\", \"win.conti\", \"win.cobalt_strike\"]},\n            \"win.qakbot\": {\"loaders\": [\"email\u002Fmacro\", \"win.emotet\"], \"payloads\": [\"win.cobalt_strike\", \"win.blackbasta\"]},\n            \"win.cobalt_strike\": {\"loaders\": [\"win.emotet\", \"win.trickbot\", \"win.qakbot\"], \"payloads\": [\"ransomware\"]},\n        }\n\n        if family_name in known_chains:\n            chain[\"known_loaders\"] = known_chains[family_name][\"loaders\"]\n            chain[\"known_payloads\"] = known_chains[family_name][\"payloads\"]\n\n        return chain\n\nmapper = MalwareFamilyMapper(client)\necosystem = mapper.map_actor_ecosystem(\"Wizard Spider\")\nshared = mapper.find_shared_tooling([\"Wizard Spider\", \"FIN7\", \"Lazarus Group\"])\nchain = mapper.build_loader_payload_chain(\"win.emotet\")\n```\n\n### Step 3: Extract and Compile YARA Rules\n\n```python\ndef compile_yara_ruleset(client, family_names, output_file=\"malware_yara_rules.yar\"):\n    \"\"\"Compile YARA rules for multiple malware families.\"\"\"\n    all_rules = []\n    for family in family_names:\n        yara_data = client.get_family_yara(family)\n        if isinstance(yara_data, dict):\n            for source, rules in yara_data.items():\n                if isinstance(rules, list):\n                    for rule in rules:\n                        all_rules.append(f\"\u002F\u002F Source: {source} - Family: {family}\\n{rule}\")\n                elif isinstance(rules, str):\n                    all_rules.append(f\"\u002F\u002F Source: {source} - Family: {family}\\n{rules}\")\n\n    with open(output_file, \"w\") as f:\n        f.write(f\"\u002F\u002F Malpedia YARA Rules - {len(all_rules)} rules\\n\")\n        f.write(f\"\u002F\u002F Families: {', '.join(family_names)}\\n\\n\")\n        for rule in all_rules:\n            f.write(rule + \"\\n\\n\")\n\n    print(f\"[+] Compiled {len(all_rules)} YARA rules to {output_file}\")\n    return all_rules\n\ncompile_yara_ruleset(client, [\"win.emotet\", \"win.trickbot\", \"win.cobalt_strike\"])\n```\n\n## Validation Criteria\n\n- Malpedia API queried successfully for malware families\n- Family information retrieved with aliases, actors, and references\n- Actor-family relationships mapped correctly\n- Shared tooling between actors identified\n- YARA rules extracted and compiled for detection\n- Loader-payload chains documented for threat intelligence\n\n## References\n\n- [Malpedia Platform](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002F)\n- [Malpedia API Documentation](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fusage\u002Fapi)\n- [Malpedia Research Paper](https:\u002F\u002Fwww.botconf.eu\u002Fwp-content\u002Fuploads\u002Fformidable\u002F2\u002F2017-DanielPlohmann-Malpedia.pdf)\n- [YARA Rules Project](https:\u002F\u002Fgithub.com\u002FYara-Rules\u002Frules)\n- [malwoverview Multi-Platform Tool](https:\u002F\u002Fgithub.com\u002Falexandreborges\u002Fmalwoverview)\n- [CyberAtlas: Malpedia Integration](https:\u002F\u002Fwww.cyberatlas.io\u002Fmalpedia)\n","# Analyzing Malware Family Relationships with Malpedia\n\n## Overview\n\nMalpedia is a collaborative platform maintained by Fraunhofer FKIE that catalogs malware families with their aliases, YARA rules, threat actor associations, and reference reports. With over 2,600 malware families documented, it serves as the definitive resource for understanding malware lineages, tracking variant evolution, and linking malware to specific threat groups. This skill covers querying the Malpedia API, mapping malware family relationships, extracting YARA rules for detection, and building intelligence on malware ecosystems used by adversaries.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing malware family relationships with malpedia\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- Python 3.9+ with `requests`, `yara-python`, `stix2` libraries\n- Malpedia API key (register at https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002F)\n- Understanding of malware classification and naming conventions\n- Familiarity with YARA rule syntax for detection\n- Access to malware samples for validation (optional)\n\n## Key Concepts\n\n### Malpedia Data Model\n\nMalpedia organizes malware into Families (e.g., \"win.cobalt_strike\"), each containing: aliases (vendor-specific names like \"Beacon\", \"CobaltStrike\"), YARA rules (community and vendor-contributed), actor associations (threat groups using the family), reference reports (CTI reports documenting the family), and sample hashes (representative samples for each variant).\n\n### Malware Family Naming\n\nMalpedia uses the format `platform.family_name` (e.g., `win.emotet`, `elf.mirai`, `apk.flubot`). Platforms include win (Windows), elf (Linux), apk (Android), osx (macOS), and py (Python). This standardized naming resolves the \"many names\" problem where different vendors assign different names to the same malware.\n\n### Family Relationships\n\nMalware families have relationships including: parent-child (code reuse, forks), loader-payload (Emotet loads TrickBot loads Ryuk), shared authorship (same threat actor develops multiple tools), and infrastructure sharing (common C2 frameworks).\n\n## Workflow\n\n### Step 1: Query Malpedia API for Malware Families\n\n```python\nimport requests\nimport json\nfrom collections import defaultdict\n\nclass MalpediaClient:\n    BASE_URL = \"https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fapi\"\n\n    def __init__(self, api_key):\n        self.headers = {\"Authorization\": f\"apitoken {api_key}\"}\n\n    def get_family_list(self):\n        \"\"\"Get list of all malware families.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Flist\u002Ffamilies\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            families = resp.json()\n            print(f\"[+] Malpedia: {len(families)} malware families\")\n            return families\n        return {}\n\n    def get_family_info(self, family_name):\n        \"\"\"Get detailed information about a malware family.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Ffamily\u002F{family_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            info = resp.json()\n            print(f\"[+] Family: {family_name}\")\n            print(f\"    Aliases: {info.get('alt_names', [])}\")\n            print(f\"    Actors: {[a.get('value', '') for a in info.get('attribution', [])]}\")\n            print(f\"    URLs: {len(info.get('urls', []))} references\")\n            return info\n        print(f\"[-] Family not found: {family_name}\")\n        return None\n\n    def get_family_yara(self, family_name):\n        \"\"\"Get YARA rules for a malware family.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Fyara\u002F{family_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            rules = resp.json()\n            rule_count = sum(len(v) for v in rules.values()) if isinstance(rules, dict) else 0\n            print(f\"[+] YARA rules for {family_name}: {rule_count} rules\")\n            return rules\n        return {}\n\n    def get_actor_families(self, actor_name):\n        \"\"\"Get malware families associated with a threat actor.\"\"\"\n        resp = requests.get(f\"{self.BASE_URL}\u002Fget\u002Factor\u002F{actor_name}\",\n                           headers=self.headers, timeout=30)\n        if resp.status_code == 200:\n            data = resp.json()\n            families = data.get(\"families\", {})\n            print(f\"[+] {actor_name}: {len(families)} malware families\")\n            return data\n        return {}\n\n    def search_families(self, keyword):\n        \"\"\"Search families by keyword.\"\"\"\n        all_families = self.get_family_list()\n        matches = {\n            name: info for name, info in all_families.items()\n            if keyword.lower() in name.lower()\n            or keyword.lower() in str(info.get(\"alt_names\", [])).lower()\n        }\n        print(f\"[+] Search '{keyword}': {len(matches)} matches\")\n        return matches\n\nclient = MalpediaClient(\"YOUR_MALPEDIA_API_KEY\")\nfamilies = client.get_family_list()\nemotet_info = client.get_family_info(\"win.emotet\")\n```\n\n### Step 2: Map Malware Family Relationships\n\n```python\nclass MalwareFamilyMapper:\n    def __init__(self, malpedia_client):\n        self.client = malpedia_client\n        self.relationship_graph = defaultdict(list)\n\n    def map_actor_ecosystem(self, actor_name):\n        \"\"\"Map the malware ecosystem used by a threat actor.\"\"\"\n        actor_data = self.client.get_actor_families(actor_name)\n        families = actor_data.get(\"families\", {})\n\n        ecosystem = {\n            \"actor\": actor_name,\n            \"families\": [],\n            \"family_count\": len(families),\n        }\n\n        for family_name in families:\n            info = self.client.get_family_info(family_name)\n            if info:\n                ecosystem[\"families\"].append({\n                    \"name\": family_name,\n                    \"aliases\": info.get(\"alt_names\", []),\n                    \"description\": info.get(\"description\", \"\")[:200],\n                    \"shared_actors\": [\n                        a.get(\"value\", \"\")\n                        for a in info.get(\"attribution\", [])\n                    ],\n                    \"reference_count\": len(info.get(\"urls\", [])),\n                })\n\n        print(f\"\\n=== {actor_name} Malware Ecosystem ===\")\n        for fam in ecosystem[\"families\"]:\n            shared = [a for a in fam[\"shared_actors\"] if a != actor_name]\n            print(f\"  {fam['name']}\")\n            print(f\"    Aliases: {fam['aliases'][:5]}\")\n            if shared:\n                print(f\"    Also used by: {shared}\")\n\n        return ecosystem\n\n    def find_shared_tooling(self, actor_names):\n        \"\"\"Find malware families shared between threat actors.\"\"\"\n        actor_families = {}\n        for actor in actor_names:\n            data = self.client.get_actor_families(actor)\n            actor_families[actor] = set(data.get(\"families\", {}).keys())\n\n        # Find overlaps\n        shared = {}\n        for i, actor1 in enumerate(actor_names):\n            for actor2 in actor_names[i+1:]:\n                common = actor_families[actor1] & actor_families[actor2]\n                if common:\n                    shared[f\"{actor1} \u003C-> {actor2}\"] = sorted(common)\n\n        print(f\"\\n=== Shared Tooling Analysis ===\")\n        for pair, families in shared.items():\n            print(f\"  {pair}: {len(families)} shared families\")\n            for f in families[:5]:\n                print(f\"    - {f}\")\n\n        return shared\n\n    def build_loader_payload_chain(self, family_name):\n        \"\"\"Build the loader-payload delivery chain for a family.\"\"\"\n        info = self.client.get_family_info(family_name)\n        if not info:\n            return {}\n\n        chain = {\n            \"family\": family_name,\n            \"description\": info.get(\"description\", \"\"),\n            \"known_loaders\": [],\n            \"known_payloads\": [],\n        }\n\n        # Common known delivery chains\n        known_chains = {\n            \"win.emotet\": {\"loaders\": [\"email\u002Fmacro\"], \"payloads\": [\"win.trickbot\", \"win.qakbot\", \"win.cobalt_strike\"]},\n            \"win.trickbot\": {\"loaders\": [\"win.emotet\"], \"payloads\": [\"win.ryuk\", \"win.conti\", \"win.cobalt_strike\"]},\n            \"win.qakbot\": {\"loaders\": [\"email\u002Fmacro\", \"win.emotet\"], \"payloads\": [\"win.cobalt_strike\", \"win.blackbasta\"]},\n            \"win.cobalt_strike\": {\"loaders\": [\"win.emotet\", \"win.trickbot\", \"win.qakbot\"], \"payloads\": [\"ransomware\"]},\n        }\n\n        if family_name in known_chains:\n            chain[\"known_loaders\"] = known_chains[family_name][\"loaders\"]\n            chain[\"known_payloads\"] = known_chains[family_name][\"payloads\"]\n\n        return chain\n\nmapper = MalwareFamilyMapper(client)\necosystem = mapper.map_actor_ecosystem(\"Wizard Spider\")\nshared = mapper.find_shared_tooling([\"Wizard Spider\", \"FIN7\", \"Lazarus Group\"])\nchain = mapper.build_loader_payload_chain(\"win.emotet\")\n```\n\n### Step 3: Extract and Compile YARA Rules\n\n```python\ndef compile_yara_ruleset(client, family_names, output_file=\"malware_yara_rules.yar\"):\n    \"\"\"Compile YARA rules for multiple malware families.\"\"\"\n    all_rules = []\n    for family in family_names:\n        yara_data = client.get_family_yara(family)\n        if isinstance(yara_data, dict):\n            for source, rules in yara_data.items():\n                if isinstance(rules, list):\n                    for rule in rules:\n                        all_rules.append(f\"\u002F\u002F Source: {source} - Family: {family}\\n{rule}\")\n                elif isinstance(rules, str):\n                    all_rules.append(f\"\u002F\u002F Source: {source} - Family: {family}\\n{rules}\")\n\n    with open(output_file, \"w\") as f:\n        f.write(f\"\u002F\u002F Malpedia YARA Rules - {len(all_rules)} rules\\n\")\n        f.write(f\"\u002F\u002F Families: {', '.join(family_names)}\\n\\n\")\n        for rule in all_rules:\n            f.write(rule + \"\\n\\n\")\n\n    print(f\"[+] Compiled {len(all_rules)} YARA rules to {output_file}\")\n    return all_rules\n\ncompile_yara_ruleset(client, [\"win.emotet\", \"win.trickbot\", \"win.cobalt_strike\"])\n```\n\n## Validation Criteria\n\n- Malpedia API queried successfully for malware families\n- Family information retrieved with aliases, actors, and references\n- Actor-family relationships mapped correctly\n- Shared tooling between actors identified\n- YARA rules extracted and compiled for detection\n- Loader-payload chains documented for threat intelligence\n\n## References\n\n- [Malpedia Platform](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002F)\n- [Malpedia API Documentation](https:\u002F\u002Fmalpedia.caad.fkie.fraunhofer.de\u002Fusage\u002Fapi)\n- [Malpedia Research Paper](https:\u002F\u002Fwww.botconf.eu\u002Fwp-content\u002Fuploads\u002Fformidable\u002F2\u002F2017-DanielPlohmann-Malpedia.pdf)\n- [YARA Rules Project](https:\u002F\u002Fgithub.com\u002FYara-Rules\u002Frules)\n- [malwoverview Multi-Platform Tool](https:\u002F\u002Fgithub.com\u002Falexandreborges\u002Fmalwoverview)\n- [CyberAtlas: Malpedia Integration](https:\u002F\u002Fwww.cyberatlas.io\u002Fmalpedia)\n",{"name":5,"tags":57,"author":62,"domain":46,"license":15,"version":63,"nist_csf":64,"subdomain":49,"description":7,"mitre_attack":69},[34,48,58,50,59,49,60,61],"yara","malware-tracking","variant-analysis","malware-intelligence","mahipal","1.0",[65,66,67,68],"ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02",[70,71,72],"T1587.001","T1027","T1071","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":82,"prompt":92,"zipAvailable":93},[83,86,89],{"tool":84,"command":85},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-family-relationships-with-malpedia",{"tool":87,"command":88},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-family-relationships-with-malpedia",{"tool":90,"command":91},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-malware-family-relationships-with-malpedia","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia\u002FSKILL.md",true,[95,100,106,110,114,118],{"path":96,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia\u002FLICENSE",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"references\u002Fapi-reference.md","REFERENCE","参考文档",1449,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia\u002Freferences\u002Fapi-reference.md",{"path":107,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002FcomponentWillMount.md",3776,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T140243Z\u002Fsource\u002Fskills\u002Freact18-lifecycle-patterns\u002Freferences\u002FcomponentWillMount.md",{"path":111,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002FcomponentWillReceiveProps.md",5085,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T140243Z\u002Fsource\u002Fskills\u002Freact18-lifecycle-patterns\u002Freferences\u002FcomponentWillReceiveProps.md",{"path":115,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002FcomponentWillUpdate.md",4789,"https:\u002F\u002Fgithub.com\u002FTorchiaHub\u002FSkills\u002Fblob\u002Fmaster\u002F01-Inbox\u002Fdownloads\u002Fgithub-awesome-copilot\u002F20260429T140243Z\u002Fsource\u002Fskills\u002Freact18-lifecycle-patterns\u002Freferences\u002FcomponentWillUpdate.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",5489,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-malware-family-relationships-with-malpedia\u002Fscripts\u002Fagent.py",[125,163,172,181,203,228],{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":144,"publishedAt":52},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[132,135,138,141],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":142,"categoryName":143,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000034","行政与办公人员",[127,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,32],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube",{"skillNo":164,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":52},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":29,"taxonomyTypeDesc":30},[127,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,32],{"skillNo":173,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":180,"publishedAt":52},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[176,177,178,179],{"categoryNo":133,"categoryName":134,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":139,"categoryName":140,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":142,"categoryName":143,"taxonomyType":29,"taxonomyTypeDesc":30},[127,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,32],{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":187,"publishedAt":52},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[188,189,190,191,192,193,194,195,196,197,198,199,200,201,202],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":204,"name":205,"nameZh":6,"description":206,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":207,"categories":208,"keywords":210,"publishedAt":52},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[209],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[211,212,213,214,215,216,47,217,218,219,220,156,157,221,222,223,224,225,226,227],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":229,"name":230,"nameZh":6,"description":231,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":129,"licenseFileUrl":6,"sourceHtmlUrl":232,"categories":233,"keywords":244,"publishedAt":52},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[234,237,240,241],{"categoryNo":235,"categoryName":236,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":238,"categoryName":239,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":242,"categoryName":243,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000036","内容创作者",[245,246,51,247,248,249,250,251,153,252,156,157,158,253,254,255,256,257,202,258],"templates","venue templates","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]