skills.rest
3xecutablefile
3xecutablefileCOMMUNITY
Explore all skills by this author →
GitHub

ctf-malware

Recover decrypted indicators, C2 traffic structure, and embedded configurations from CTF malware samples.

Updated Aug 27, 2026
Search Tags:#volatility#deobfuscation#malware analysis#anti-analysis#c2 traffic#pcap forensics#yara rules
One-click install
npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ctf-malware-3xecutablefile
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-malware
Source: https://github.com/3xecutablefile/opencode-rev-forensics/tree/main/skills/ctf-malware
Command: npx skills add https://github.com/3xecutablefile/opencode-rev-forensics --skill ctf-malware-3xecutablefile

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It eliminates the manual, guesswork-heavy process of analyzing malware samples and their network behavior in CTF-style challenges, helping you quickly recover indicators, decrypted traffic, and configuration values.

Core Features & Use Cases

  • Malware triage & obfuscation handling: Convert indicators into actionable hypotheses for deobfuscation and payload extraction, including JavaScript/PowerShell decoding and junk-code spotting.
  • C2 and crypto protocol reconstruction: Identify and decrypt common C2 patterns (RC4 WebSocket, AES-CBC, rotating passwords, Telegram bot exfil paths) and custom protocol flows.
  • Artifact extraction from binaries and memory: Analyze PE/.NET samples, then use memory-forensics workflows (Volatility 3 malfind, netscan, filescan, dumps) to recover injected code and malware configuration evidence.
  • Anti-analysis support: Recognize and bypass sandbox/VM checks (timing, environment checks, API hashing, injection-aware behavior) to reach the real challenge logic.

Quick Start

Ask an AI agent to analyze your challenge sample by running static checks for indicators, then pivot into C2 and crypto workflow, and finally validate findings with memory-forensics commands if a dump or PCAP is available.

Frequently Asked Questions about ctf-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I reconstruct C2 traffic from a malware PCAP file?▼

Malware C2 traffic reconstruction from PCAP files involves identifying custom protocol flows and decrypting embedded communications, such as RC4 WebSocket or AES-CBC traffic, to recover decrypted indicators and configuration values.

How do I deobfuscate malicious JavaScript or PowerShell scripts?▼

Deobfuscating malicious JavaScript or PowerShell scripts requires spotting junk code and decoding embedded payloads to convert hidden indicators into actionable hypotheses for payload extraction and further analysis.

Can I use Volatility 3 to extract injected code from a malware memory dump?▼

Yes, you can use Volatility 3 to extract injected code from malware memory dumps by running malfind, netscan, and filescan plugins to recover malware configuration evidence and injected artifacts.

How do I bypass anti-analysis checks in a malware sample?▼

Bypassing anti-analysis checks in malware involves recognizing and evading sandbox or VM detections, such as timing checks, environment checks, and API hashing, to reach the real challenge logic.

What is the best way to extract embedded configurations from PE and .NET binaries?▼

Extracting embedded configurations from PE and .NET binaries requires static analysis of the samples to identify indicators, pivoting into crypto workflow to decrypt values, and validating findings with memory-forensics commands.

Do I need a memory dump to analyze malware beaconing behavior?▼

No, a memory dump is optional for analyzing malware beaconing behavior; you can reconstruct beacons from PCAP network captures, but memory forensics helps recover injected code if available.

Related Skills

Explore More Education & Research Skills→
langbyyilangbyyi
96

ctf-malware

Analyze obfuscated malware and decrypt C2 traffic for CTF challenges.

Community
Advanced
balic-AI-ML-R-D-Resourcesbalic-AI-ML-R-D-Resources

yara-authoring

Write and test YARA rules to detect malware samples and threats.

Official
Intermediate
ekremmkasapekremmkasap

memory-forensics

Extracts forensic artifacts from Windows, Linux, macOS memory dumps using Volatility 3.

Community
Advanced
RazonIn4KRazonIn4K
2

ai-ctf-generic

Execute AI security CTF challenges with adaptable attack workflows.

Community
Intermediate