What problem does it solve? Recovering a malware sample's hidden configuration—C2 addresses, bot IDs, campaign IDs, mutexes, and decode keys—is often the decisive step in CTF and sandbox analysis, but the config is usually buried behind layered encoding, encryption, and staged payloads. This Skill provides a structured methodology to locate the config boundary, reconstruct the full decode chain, and tie each recovered field to observable behavior. ## Core Features & Use Cases - Config Boundary Discovery: Systematically inspect sections, resources, overlays, embedded archives, registry seeds, and stage2 memory to find where configuration data lives and when it becomes plaintext. - Decode Chain Reconstruction: Recover the transform chain in order (container, compression, encoding, XOR/masks, crypto, parsing) while preserving offsets, hashes, keys, and IVs as evidence. - Behavior Correlation: Map each recovered field (beacon path, mutex, wallet, bot ID, campaign ID) to the branch or network behavior it controls, validated against PCAPs and process trees. - Use Case: During a CTF malware challenge, you receive a packed sample that beacons to an unknown host. Use this Skill to unpack the staged payload, decode the embedded config blob, and extract the C2 URL and campaign ID with a fully documented evidence trail. ## Quick Start After the ctf-sandbox-orchestrator has established sandbox assumptions, ask it to recover the malware config and decode the C2 beacon fields from the provided sample.
