Wrote reusable Codex CLI skills for malware unpacking and IOC extraction in FLARE-VM

What was done

Codex CLI ran inside an isolated FLARE-VM guest against four known malware samples; iterating on two skills cut one skill's commands from 31 to 9 and errors from 20 to 4.

Where the human stepped in

Early runs failed on missing tools, PowerShell quoting and treating ripgrep's no-match exit code as an error. IOC output included noisy URLs. The author added preflight checks, 'no invention' rules and pauses before any execution.

Related projects

mfc42ul.dll (publicly documented trojan sample)Built a structured agentic malware-analysis pipeline and tested it on a known government trojan Malware samples (lab analysis)Tested GPT and Claude models as malware analysts with Ghidra, x64dbg and REMnux MCP servers Malware samplesLive VIBE RE: testing MCP plugins for IDA and Ghidra on real samples

Malware (defensive)Research

Target: Malware samples (Cerber, Hydra, NetWire, PolyRansom)

Wrote reusable Codex CLI skills for malware unpacking and IOC extraction in FLARE-VM

by J.W. McKiddyRead the writeup

What was done

Codex CLI ran inside an isolated FLARE-VM guest against four known malware samples; iterating on two skills cut one skill's commands from 31 to 9 and errors from 20 to 4.

Where the human stepped in