competition-malware-config

What problem does it solve?

This skill helps security analysts extract and reconstruct hidden malware configuration data, staging layers, and beacon parameters from sandboxed samples after the $ctf-sandbox-orchestrator has established context.

Core Features & Use Cases

• Downstream specialization after $ctf-sandbox-orchestrator is active, enabling recovery of hidden configuration fields, staging payloads, and related artifacts.
• Reconstruct decode chains to map config fields to observed behavior, correlating with PCAPs, process trees, or stage2 strings.
• Tie recovered config fields to behavior such as beacon routes, persistence names, or tasking decisions, facilitating reproducible investigation workflows.

Quick Start

Preserve the original sample before unpacking or patching.