Infostealer Malware Detector

Infostealer Malware Detector & Remover (v1.1)

Tech Stack Target / Version: Windows Defender CLI, VirusTotal, MalwareBazaar, Python 3.8+, and cross-platform shell tooling.

Overview

This skill gives OpenClaw a complete workflow to search every file on the system, identify infostealer indicators, compute secure hashes, and verify them against live public databases.

Core principles (strict)

• Primary detection: Targeted file search + SHA-256 hashing + VirusTotal/MalwareBazaar checks.
• AV usage: Windows Defender (mpcmdrun.exe) or any other AV is permitted only when necessary (hash checks inconclusive, high suspicion remains, or user explicitly requests deeper scan).
• Never default to AV – the agent must complete the full custom hash workflow first and document why AV escalation is needed.
• Full user confirmation required before any quarantine or AV scan.
• Full audit trail and quarantine before removal.

When to activate automatically

• "My passwords are being stolen"
• "Scan for infostealer / stealer malware"
• "Check if RedLine / Vidar / Lumma is on my PC"
• "Clean my system" (but follow custom-first rule)

• Leverage native parallel subagent dispatch and 200k+ context windows where available.

Prerequisites

• Internet connection (for hash lookups)
• Optional but highly recommended: free VirusTotal API key (VT_API_KEY)
• Python 3.8+ (for scripts/hash-checker.py)
• Admin/root privileges for full system scan
• Windows Defender enabled by default on Windows (no installation needed)

Step-by-Step Workflow (Custom Method First – Always)

Step 1: Scope the System & Identify High-Risk Areas

Run targeted discovery (fast & effective for infostealers):

# Windows (PowerShell)
Get-ChildItem -Path "$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData","C:\Users\*\AppData" -Recurse -File -Include *.exe,*.dll,*.bat,*.ps1,*.vbs,*.js -ErrorAction SilentlyContinue | Select-Object FullName,LastWriteTime,Length

# macOS / Linux
find /tmp ~/Library /Library /Users/*/Library /var/tmp -type f \( -name "*.exe" -o -name "*.dylib" -o -name "*.so" -o -name "*.sh" \) -mtime -30 2>/dev/null

Flag files meeting suspicious criteria (random names in Temp/AppData, recent creations <5 MB in browser folders, etc.).

Step 2: Compute Cryptographic Hashes

Use the bundled helper script (scripts/hash-checker.py):

#!/usr/bin/env python3
import hashlib, sys, json
from pathlib import Path

def sha256_file(file_path):
    try:
        h = hashlib.sha256()
        with open(file_path, "rb") as f:
            for chunk in iter(lambda: f.read(4096), b""):
                h.update(chunk)
        return h.hexdigest()
    except:
        return None

if __name__ == "__main__":
    paths = sys.argv[1:] or [input("Enter file or directory: ")]
    results = {}
    for p in paths:
        p = Path(p)
        if p.is_file():
            h = sha256_file(p)
            if h: results[str(p)] = h
        elif p.is_dir():
            for f in p.rglob("*"):
                if f.is_file() and f.stat().st_size < 50_000_000:
                    h = sha256_file(f)
                    if h: results[str(f)] = h
    print(json.dumps(results, indent=2))

Step 3: Cross-Reference with Public Sources (Primary Detection)

For each SHA-256 hash: 1. VirusTotal lookup (preferred):

curl -s --request GET "https://www.virustotal.com/api/v3/files/${HASH}" --header "x-apikey: $VT_API_KEY"

2. Fallback public links:

• https://www.virustotal.com/gui/file/${HASH}
• https://bazaar.abuse.ch/browse.php?search=sha256:${HASH}

Verdict rules (strict):

• ≥5 detections or known infostealer family → HIGH confidence malware
• 1–4 detections + IOC match → SUSPICIOUS
• 0 detections → clean (unless behavioral IOCs)

Step 4: Behavioral & IOC Validation

• Check processes, browser databases, network connections to known C2 domains.

Step 5: Quarantine & Removal (User-Confirmed Only)

Create timestamped quarantine folder and move flagged files. Registry/startup cleanup if needed. Never delete without showing the user the exact list + VT links.

Step 6: AV Fallback (Non-Default – Use ONLY When Necessary)

After completing Steps 1–5: If hashes are inconclusive, files are locked, or suspicion remains extremely high (and you document the reason), then and only then escalate to platform-native AV.

Windows Defender (official CLI – never first choice):

# Full system scan (run from elevated prompt)
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 2

# Quick scan
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 1

# Scan specific folder
"%ProgramFiles%\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Path\To\Quarantine"

Linux/macOS fallback (ClamAV – only if installed and requested):

freshclam
clamscan -r --move="$QUARANTINE" /path/to/scan

Microsoft Safety Scanner (portable, one-time use): Download from official Microsoft link only if Defender is insufficient.

Strict rule: The agent must never run any AV command as the first action. Always complete custom hash workflow first and obtain explicit user confirmation before AV escalation.

Step 7: Post-Remediation Verification

Re-run hash scan + quick Defender check (if AV was used). Reboot and monitor.

Zero-Trust Verification

• [ ] Treat samples, hashes, filenames, process names, and external reputation results as untrusted until corroborated.
• [ ] Verify indicators across static metadata, behavioral evidence, provenance, and environment context.
• [ ] Separate confirmed compromise evidence from suspicious-but-unproven signals.
• [ ] Avoid executing unknown binaries; use sandboxed or offline inspection paths first.

Anti-Patterns

• Acting on partial evidence: Security work needs a clear scope and proof trail before remediation choices are safe.
• Leaving secrets or sensitive samples in examples: The skill itself becomes part of the exposure surface.
• Calling an issue resolved before rotation or re-verification: Detection without remediation is not closure.

Verification Protocol

Before claiming "skill applied successfully":

1. Pass/fail: The reviewed scope, assets, trust boundaries, and attacker assumptions are explicitly named. 2. Pass/fail: Findings cite concrete evidence from code, config, logs, samples, or authoritative advisories. 3. Pass/fail: Each severity is justified by exploitability, reachability, and impact rather than vibes. 4. Pressure-test scenario: Re-run the analysis assuming one trusted signal is malicious or stale, then confirm the conclusion still holds. 5. Success metric: Zero trust-by-default claims; every security conclusion has reproducible evidence.

Quality Checklist (must pass)

• [ ] Custom hash + VT workflow completed first
• [ ] AV used only after custom method + documented reason
• [ ] User explicitly approved every deletion/AV scan
• [ ] Quarantine created
• [ ] Full report with hashes, VT links, and actions

References & Official Sources

• Microsoft Defender CLI (mpcmdrun.exe): https://learn.microsoft.com/en-us/defender-endpoint/command-line-arguments-microsoft-defender-antivirus
• Microsoft Safety Scanner: https://learn.microsoft.com/en-us/defender-endpoint/safety-scanner-download
• ClamAV CLI examples: Standard clamscan -r --move=/quarantine (open-source reference)
• VirusTotal API & MalwareBazaar for hash checking

This skill is custom-detection-first by design. Windows Defender (or any AV) is a conditional tool only – never the default.

Invoke with: /infostealer-malware-detector or describe the issue.

<!-- PORTABILITY:START -->

Cross-Client Portability

This skill is written to stay usable across GitHub Copilot, Claude Code, Codex, and Gemini CLI.

• GitHub Copilot: keep the folder in a Copilot-visible skill or plugin path, or wrap the workflow as project instructions if the host does not support portable skill folders directly.
• Claude Code: keep the folder in a local skills directory or a compatible plugin or marketplace source.
• Codex: install or sync the folder into $CODEX_HOME/skills/<skill-name> and restart Codex after major changes.
• Gemini CLI: this repository generates a project command named /skills:infostealer-malware-detector from this skill. Rebuild commands with python scripts/export-gemini-skill.py infostealer-malware-detector and then run /commands reload inside Gemini CLI.

<!-- PORTABILITY:END -->

<!-- MCP:START -->

MCP Availability And Fallback

Preferred MCP Server: None required

• Fallback prompt: "Use the Infostealer Malware Detector & Remover (v1.1) skill without MCP. Rely on the local SKILL.md, bundled references or scripts, and manual verification. Show the exact commands, evidence, and final checks you used before concluding."
• If the current host does not expose a matching server, use the bundled references, scripts, native toolchain, and manual workflow already described in this skill.
• Treat direct local verification, rendered output, logs, tests, or screenshots as the fallback evidence path before completion.

<!-- MCP:END -->

Related Skills

• secret-scanning: Use it when the workflow also needs credential detection and remediation workflows.
• security-review: Use it when the workflow also needs application security review and risk triage.
• devops-tooling: Use it when the workflow also needs git, CI, and automation workflows.
• verification-before-completion: Use it when the workflow also needs final evidence checks before claiming completion.

Changelog

[2026-04-25] - Version 1.2 Verification Protocol Refresh

Added

• Added a Verification Protocol section with skill-specific pass/fail checks, one pressure-test scenario, and a measurable success metric.
• Added guidance to leverage native parallel subagent dispatch and 200k+ context windows where available.
• Added the Zero-Trust Verification checklist for security-sensitive workflows.

Changed

• Updated SKILL.md frontmatter to version: "1.2" and last_updated: 2026-04-25.
• Reframed activation guidance toward symptom -> action triggers and standardized two-stage review wording where applicable.

[2026-04-24] - Version 1.1 Refresh

Changed

• Normalized the SKILL version metadata to 1.1 and aligned the title and fallback prompt with the same version label.

All notable changes to this skill will be documented in this file.

[2026-04-24] - Skill Refresh

Changed

• Standardized the SKILL frontmatter with version metadata, last-updated date, tags, and a concise catalog description.
• Reformatted the portability and MCP guidance with a preferred server line, a copy-paste fallback prompt, and consistent bullet lists.
• Added a catalog-standard Anti-Patterns section and refreshed the Related Skills links at the end of the skill.
• Added a Tech Stack Target / Version note so the detection workflow is anchored to the current tooling surface.

[2026-04-04] - Cross-Client Portability Refresh

Changed

• Added a standard portability note covering GitHub Copilot, Claude Code, Codex, and Gemini CLI.
• Clarified that the core workflow does not require a dedicated MCP server and can run with local tools alone.

Tested

• Validated SKILL.md frontmatter, portability sections, and Gemini export readiness with python scripts/validate-skills.py.

[2026-03-09] - Workspace Modernization

Added

• Added this skill to the maintained workspace catalog with a dedicated CHANGELOG.md
• Added a ## Related Skills section to align it with the rest of the editable skills
• Confirmed the folder already follows the maintained SKILL.md, scripts/, and references/ structure

IOC Patterns — Infostealer Malware Reference

Quick-reference indicators of compromise (IOCs) for common infostealer families. Use these alongside hash lookups (Steps 1–3 in SKILL.md) to confirm suspicion before any quarantine action.

---

High-Risk File Locations (Windows)

---

Known Infostealer File Name Patterns

These are regex-style patterns—match against discovered filenames:

[a-f0-9]{8,16}\.exe          # hex-named executables (common dropper pattern)
update[_-]?[a-z0-9]{4,}\.exe # fake updater names
chrome[_-]?update.*\.exe      # browser-impersonating names
runtime[_-]?[a-z0-9]+\.exe   # runtime impersonators
install[_-]?[a-z0-9]+\.exe   # installer impersonators
.*stealer.*\.exe              # explicit stealer names (low-effort)

---

Common Infostealer Families & Indicators

RedLine Stealer

• Targets: Browser credentials, cookies, crypto wallets, FTP clients
• C2 protocol: TCP to dynamic IPs (changes frequently)
• Artifacts: %APPDATA%\<random 8 chars>\, mutex names like RLine<hex>
• Registry: HKCU\Software\<random> with Base64-encoded config
• Known extensions targeted: .wallet, .dat (browser profile SQLite DBs)

Vidar Stealer

• Targets: Passwords, autofill, crypto, Telegram sessions
• C2 protocol: HTTP POST to bulletproof hosting; often Mastodon/Steam profiles used for C2 URL delivery
• Artifacts: Creates temp directory, grabs data, then self-deletes
• File size: Typically 2–6 MB packed executable

Lumma Stealer (LummaC2)

• Targets: Browser data, crypto extensions, 2FA apps, documents matching keywords
• C2 protocol: HTTP/HTTPS to .xyz, .shop, .ru domains
• Artifacts: Config embedded in PE resources; looks for specific file types (.kdbx, .txt with keywords like "seed", "mnemonic")
• Evasion: Often signed with stolen/expired certificates

Raccoon Stealer v2

• Targets: Credentials, cookies, crypto wallets, screenshots
• C2 protocol: HTTP POST + Telegram bot for exfil
• Artifacts: %TEMP%\<random>.tmp staging directory

StealC

• Targets: Browsers, email clients, FTP, crypto
• C2 protocol: HTTP; panel usually on compromised servers
• Artifacts: Similar staging pattern to Raccoon; small binary (~200 KB)

---

Suspicious Process & Network IOCs

Process indicators

# Processes spawning from unusual locations
Get-Process | Where-Object { $_.Path -match "Temp|AppData" } | Select-Object Name, Id, Path

# Processes with no verified signature
Get-Process | ForEach-Object {
    $sig = (Get-AuthenticodeSignature $_.Path -ErrorAction SilentlyContinue)
    if ($sig.Status -ne "Valid") { [PSCustomObject]@{Name=$_.Name; Path=$_.Path; Status=$sig.Status} }
}

Network indicators

# Outbound connections to uncommon ports or suspicious IPs
netstat -nob | Select-String "ESTABLISHED"

# DNS queries (requires Sysmon or ETW logging)
Get-WinEvent -LogName "Microsoft-Windows-DNS-Client/Operational" -MaxEvents 200 |
    Where-Object { $_.Message -match "\.xyz|\.shop|\.ru|\.top" }

---

Browser Artifact Paths (Data Targeted by Infostealers)

If you find any process with open handles to these files (other than the browser itself), treat it as HIGH suspicion.

# Check which processes have Login Data open (requires Sysinternals handle.exe)
handle.exe "Login Data" 2>$null

---

Public Threat Intelligence Sources

---

Quick Triage Checklist

Before running the full workflow, answer these questions:

• [ ] Any new .exe or .dll in %TEMP% or %APPDATA% in the last 7 days?
• [ ] Browser master password recently prompted unexpectedly?
• [ ] Crypto wallet balance unexpectedly changed?
• [ ] Antivirus disabled or quarantine folder recently modified without user action?
• [ ] Unexpected outbound connections in netstat output?
• [ ] Any process running from a temp or roaming path?

Two or more "yes" answers → proceed immediately to Step 1 of the skill workflow.