Analyzing Golang Malware with Ghidra
Guides an agent through reverse engineering Go-compiled malware in Ghidra, recovering function names and dependencies.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 7 files
What it does
This skill teaches an AI agent a structured method for examining Go-compiled malware samples. Go binaries are large and often stripped or obfuscated, so the agent is guided to read Go's built-in metadata (build info, the pclntab function table, and module paths) to recover function names and third-party dependencies that hint at what the malware does. It also includes helper Python scripts that scan a binary and produce a summary report of suspicious strings, dependencies and hashes.
Great for
- Malware analysts or reverse engineers examining a Go-language sample in an isolated lab
- Incident responders who need a quick triage of a stripped or garble-packed Go executable
- Students learning how Go binary structure affects reverse engineering
Skip it if
- Running the analysis on a live production or personal machine, since the samples are malicious and the bundled scripts read and process untrusted binaries; use an isolated analysis VM
- Non-Go binaries, because the pattern matching and metadata checks assume Go compilation
- Expecting a complete decompilation result from the scripts alone, since they use regex heuristics and the pclntab magic values listed are approximate across Go versions
Try asking
- “Analyze this Go binary sample and list the third-party modules it depends on”
- “Help me find function names in this garble-obfuscated Go executable using the pclntab”
- “Write a Ghidra workflow to triage this suspicious Go malware and extract interesting strings”
- “Run the Go malware analyzer script on this file and summarize the indicators in a report”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.
analyzing-golang-malware-with-ghidra.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-golang-malware-with-ghidra.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-golang-malware-with-ghidra.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Run the bundled scripts only inside an isolated VM with no network access, because the target is malware.
- Verify the Go version and pclntab detection output manually, since the magic-byte heuristics may misidentify versions.
- Use the recovered module paths as leads, then confirm capabilities by inspecting the actual functions in Ghidra.
What's inside
- assets/template.md
- references/api-reference.md
- references/standards.md
- references/workflows.md
- scripts/agent.py
- scripts/process.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.