ctf-malware

Analyze malware artifacts and extract indicators from CTF challenges.

1|Updated Feb 6, 2026
One-click install
npx skills add https://github.com/ramzxy/CTF --skill ctf-malware
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: ctf-malware
Source: https://github.com/ramzxy/CTF/tree/main/.agents/skills/ctf-malware
Command: npx skills add https://github.com/ramzxy/CTF --skill ctf-malware

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps security teams analyze malware artifacts and extract actionable indicators from CTF challenges.

Core Features & Use Cases

  • Obfuscated Script Analysis: guidance to deobfuscate and trace execution flow.
  • Network & C2 Pattern Detection: identify beaconing, DNS queries, and unusual ports in PCAPs.
  • Malware Configuration & Payload Extraction: locate embedded configs and extract indicators for reporting.
  • Forensic Workflow: step-by-step approach for triage, hypothesis testing, and documentation in a competition or incident drill.

Quick Start

Use the ctf-malware skill to analyze the provided sample payload, deobfuscate code, and extract C2 indicators, then document findings.

Frequently Asked Questions about ctf-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze malware artifacts and extract indicators from CTF challenges?

To analyze malware artifacts and extract indicators from CTF challenges, use structured workflows to deobfuscate scripts, inspect PCAPs for C2 traffic, and locate embedded configurations. This process yields actionable indicators for competition reporting.

What is the best way to detect C2 traffic and custom protocols in a PCAP?

Detecting C2 traffic and custom protocols in a PCAP requires identifying beaconing patterns, analyzing DNS queries, and isolating unusual ports. This network analysis uncovers malicious communication channels within captured environments.

How do I deobfuscate malicious scripts and trace their execution flow?

Deobfuscating malicious scripts involves applying structured analysis techniques to unpack the code and trace its execution flow. This process reveals the true logic of obfuscated scripts and exposes hidden payload delivery mechanisms.

Can I use this malware analysis workflow for both CTF competitions and incident drills?

Yes, you can use this malware analysis workflow for both CTF competitions and incident drills. It provides a step-by-step forensic approach for triage, hypothesis testing, and documentation across live environments and captured artifacts.

How do I extract embedded malware configurations and payloads for reporting?

Extracting embedded malware configurations involves locating hidden payloads and unpacking embedded data structures. This extraction process isolates specific indicators and configuration details required for comprehensive threat reporting.

What steps are needed to triage malware samples during a forensic investigation?

Triageing malware samples during a forensic investigation requires a structured workflow for initial assessment, hypothesis testing, and documentation. This approach systematically processes malicious packages and artifacts to derive actionable results.