neptune analyze-malware
Malware triage with YARA scanning, capa detection, and behavior hypothesis generation
neptune analyze-malware
Runs malware triage on a binary sample. Produces YARA scan results, capa ATT&CK/MBC mappings, ranked signals, behavior hypotheses, and a structured case directory.
Usage
neptune analyze-malware <BINARY> [OPTIONS]Arguments
| Argument | Description |
|---|---|
<BINARY> | Path to the binary sample |
Options
| Flag | Default | Description |
|---|---|---|
-o, --output <DIR> | . | Output directory for case artifacts |
-a, --arch <ARCH> | auto-detect | Override architecture detection |
--no-yara | Skip YARA scanning | |
--no-capa | Skip capa scanning | |
--sandbox | Run analysis on an AgentComputer cloud VM |
Examples
# Full malware triage
neptune analyze-malware sample.bin --output ./cases
# Skip capa (YARA only)
neptune analyze-malware sample.dll --no-capa --output ./cases
# Run on a remote sandbox
neptune analyze-malware sample.bin --sandbox --output ./casesOutput
Neptune creates a case directory containing:
| Artifact | Description |
|---|---|
| YARA matches | Matched rules across crypto, anti-debug, capabilities, and packer signature rulesets |
| capa results | ATT&CK techniques and MBC behaviors detected in the binary |
| Signal ranking | Prioritized list of interesting signals found during triage |
| Hypotheses | Generated behavior hypotheses based on combined analysis signals |