Malware triage

Triage suspicious files with static analysis only: one read-only agent per sample, each producing indicators of compromise and a summary, then one agent consolidates them for your detection tooling.

warning

Never execute samples. Work in a dedicated VM or isolated machine, keep samples in password-protected archives until analysis, and tell every agent not to run, open, install or upload them anywhere. Static analysis only.

Set up the workspace

~/triage/2026-10-01/
  samples/   # one file per sample, renamed with a .bin extension

beswarm workspace add --name triage --path ~/triage/2026-10-01

One agent per sample

Start these from a terminal in the triage workspace:

beswarm agent start --name s1 --agent claude --group malware \
  --prompt "Static analysis only of samples/s1.bin: don't execute, open in an app, install, or upload it. Use file, strings, hashing and header parsing. Report SHA-256, file type, likely family or behavior, embedded URLs, domains and IPs, persistence or registry strings, and your confidence. Defang every indicator (hxxp, [.]). Write to reports/s1.md."
beswarm agent start --name s2 --agent codex --group malware \
  --prompt "Same task for samples/s2.bin. Write to reports/s2.md."

Any agent that wants to run a sample or "just test it" should be refused. Answer permission prompts yourself, and say no to anything that would execute.

Consolidate the indicators

beswarm agent start --name iocs --agent claude --group malware \
  --prompt "Merge reports/s*.md into reports/iocs.md: a summary per sample, then one de-duplicated, defanged table of hashes, domains, IPs and URLs with which samples they came from. Note shared infrastructure between samples." \
  --wait --timeout 1200

Hand off

Use reports/iocs.md to check hashes and indicators against your threat intelligence sources, and to block or hunt in your EDR. Refang indicators only inside the tool that needs them.

Close the group with beswarm agent close --group malware.