# Hash Investigation

> Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.

- **Type:** Skill
- **Install:** `agentstack add skill-liberty91ltd-cti-skills-hash-investigation`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [Liberty91LTD](https://agentstack.voostack.com/s/liberty91ltd)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** https://github.com/Liberty91LTD/cti-skills/tree/main/skills/hash-investigation
- **Website:** https://liberty91.com/cti-skills

## Install

```sh
agentstack add skill-liberty91ltd-cti-skills-hash-investigation
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# hash-investigation

Investigate a file hash end-to-end. Chain lookups, surface malware family attribution, prioritize infrastructure pivots, and decide whether deeper malware analysis is warranted.

**This skill invokes:** `/lookup-virustotal`, `/lookup-otx`, optionally `/lookup-reversinglabs` (vendor-authoritative classification + MITRE ATT&CK + sandbox), optionally `/lookup-crowdstrike` (Falcon Intel verdict + actor/malware attribution), optionally `/lookup-misp` and/or `/lookup-opencti` (internal correlation), optionally `/malware-analysis`, then `/source-assessment`, `/tlp-guide`, `/confidence-levels`.

## When to invoke

- User asks to check a hash, identify malware, or enrich a sample
- Another skill surfaces a hash during investigation (e.g., `/ip-investigation` found communicating files)
- User asks "what is this malware" with a hash as input

## Inputs

```yaml
indicator: 
context: 
tlp_ceiling: 
request_malware_analysis: 
```

## Procedure

### 1. Validate

- Confirm the hash is a valid length (MD5=32, SHA-1=40, SHA-256=64 hex chars)
- Reject if not; route to correct skill if it looks like a different indicator type

### 2. Parallel lookups

**Always run** (free / commonly available):
```
/lookup-virustotal hash     # detection stats, family, behavior tags
/lookup-otx hash            # community pulses, campaign attribution
```

**Add to the same parallel batch if credentials are configured** — don't demote these to "later, maybe":
```
/lookup-reversinglabs hash  --av-scanners --ticloud   # if $REVERSINGLABS_USER is set. Vendor-authoritative verdict + threat name + AV detection ratio. RL is the strongest single-source verdict on a hash; run it whenever available, not just when VT signal is thin.
/lookup-crowdstrike indicator                         # if $CROWDSTRIKE_CLIENT_ID is set. Falcon Intel verdict — malicious confidence + the threat actors and malware families CrowdStrike links to this hash + report refs. One API call.
/lookup-misp search-attributes --value                # if $MISP_URL + $MISP_KEY are set. Internal correlation against your own catalogued events.
/lookup-opencti lookup                                # if $OPENCTI_URL + $OPENCTI_TOKEN are set. Internal correlation against your OpenCTI knowledge base (observables + indicators in one call).
```

**Escalation lookup** (run sequentially after the parallel batch only if the call below is warranted):
```
/lookup-reversinglabs report  --detailed              # when you need MITRE ATT&CK mapping, sandbox detonation output, or networkthreatintelligence (C2 indicators extracted from the sample). Heavier than `hash` — use when classification alone is not enough.
```

### 3. Check if known-benign

If VirusTotal detection ratio is 0/Y with Y>30, AND OTX has no pulses, AND the file has standard legit characteristics (signed by major vendor, common packaging), treat as likely-benign. Stop and summarize. Don't spend analyst time.

### 4. Consolidate

```yaml
indicator: 
type: hash
hash_type: md5 | sha1 | sha256
consolidated_verdict: malicious | suspicious | clean | unknown
detection_stats:
  vt_ratio: 
  first_seen: 
  last_analysis: 
  names: []
classification:
  malware_family: 
  tags: []
  attributed_actor: 
file_details:
  type: 
  size: 
  packers: []
  signed: 
  signer: 
behavior_summary:
  sandbox_verdicts: 
  notable_behaviors: []
  mitre_techniques: []
community_context:
  otx_pulse_count: 
  campaign_references: []
pivot_candidates:
  - type: ip
    value: 
    reason: c2_comm
  - type: domain
    value: 
    reason: c2_comm
  - type: hash
    value: 
    reason: child_parent
```

### 5. Prioritize pivots

1. **C2 IPs / domains from communicating_files / contacted_domains** — active infrastructure
2. **Parent hashes** (droppers / packers) — same campaign lineage
3. **Dropped hashes** (payloads) — behavioral family
4. **YARA rule matches** (if VT exposes them) — strong family clustering
5. **Command-line strings** — targeting / configuration hints

### 6. Decide on deeper analysis

If detection ratio is high and malware family is known, the lookup may be sufficient. If the hash is novel (low VT detection, recent first_seen, no known family), invoke `/malware-analysis` for a structural and behavioral review.

Also invoke `/malware-analysis` if:
- User explicitly asked for analysis (`request_malware_analysis: true`)
- This is part of a targeted incident response, not routine IOC triage

### 7. Apply rigor

Chain:
- `/source-assessment`
- `/tlp-guide`
- `/confidence-levels`

### 8. Return

```yaml
title: "Hash Investigation: "
tlp: AMBER
confidence: 
summary: 
verdict: 
detection_stats: 
classification: 
file_details: 
behavior_summary: 
community_context: 
pivot_candidates: 
source_ratings: 
investigation_date: 
recommended_next_steps:
  - 
```

## Special cases

- **Hash not found in VT** — doesn't mean clean. Could be very new, rare, or deleted. Check OTX; escalate to `/malware-analysis` if user has the sample.
- **VT detection very low (1-2 engines)** — often false positive or generic heuristic. Downgrade source rating; don't alarm the user without corroboration.
- **Signed by legit vendor but flagged** — possible supply-chain scenario. Flag for special review.

## Related skills

- `/ip-investigation`, `/domain-investigation`, `/url-investigation`
- `/malware-analysis` — for novel or targeted samples
- `/yara-writing` — if the sample should produce a detection rule
- `/indicator-pivoting` — multi-hop IOC graphing
- `/cti-orchestrator`

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [Liberty91LTD](https://github.com/Liberty91LTD)
- **Source:** [Liberty91LTD/cti-skills](https://github.com/Liberty91LTD/cti-skills)
- **License:** MIT
- **Homepage:** https://liberty91.com/cti-skills

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-liberty91ltd-cti-skills-hash-investigation
- Seller: https://agentstack.voostack.com/s/liberty91ltd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.