Malpedia Malware Family Lookup
Look up malware family aliases, YARA rules, threat actor links and family relationships via the Malpedia API.
- Repository
- mukul975/Anthropic-Cybersecurity-Skills
- Stars
- 35,430
- Licence
- Apache-2.0
- Files
- 3 files
What it does
Once installed, the agent can query Malpedia, a public catalogue of malware families run by Fraunhofer FKIE, to find what other names a piece of malware goes by, which threat groups are linked to it, and which community or vendor detection rules (YARA) exist for it. It can also sketch how families relate to each other, such as loaders that deliver other malware or tools written by the same actor. The skill includes a Python script that calls the Malpedia API to automate these lookups.
Great for
- Threat intelligence analysts researching a malware family's aliases or lineage
- Detection engineers who need existing YARA rules for a known family
- Security teams mapping which threat actors use a given malware
Skip it if
- Analysing a live infection or raw samples: the skill only queries public catalogue data, not files on your machine, and it does not replace sandboxing or reverse engineering
- Users without a Malpedia account: the API requires a personal API key, so the lookups will fail without one
Try asking
- “Look up the aliases and naming for win.emotet and list the threat actors linked to it”
- “Pull the community YARA rules for win.cobalt_strike so I can review them for detection”
- “Map the malware ecosystem used by a named threat actor and summarise the families”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.
analyzing-malware-family-relationships-with-malpedia.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip analyzing-malware-family-relationships-with-malpedia.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip analyzing-malware-family-relationships-with-malpedia.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Store your Malpedia API key in an environment variable rather than pasting it into prompts or code, since the scripts take it as a parameter
- Check the script's network calls and the Malpedia terms of use before running it on sensitive investigations, since queries reveal what families you are investigating
- Verify aliases and actor attributions against primary reports, as community-contributed data can be incomplete or contested
What's inside
- references/api-reference.md
- scripts/agent.py
- SKILL.md
Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.