skills.rest
ljagiello
ljagielloCOMMUNITY
Explore all skills by this author →
𝕏@lcfplGitHub

ctf-malware

Identify malware behavior and network indicators in CTF challenges.

3.0k|346|Updated Feb 1, 2026
Search Tags:#ctf#malware#forensics#deobfuscation#pcap#network-analysis#c2-traffic
One-click install
npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-malware-ljagiello
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: ctf-malware
Source: https://github.com/ljagiello/ctf-skills/tree/main/ctf-malware
Command: npx skills add https://github.com/ljagiello/ctf-skills --skill ctf-malware-ljagiello

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill enables focused malware and network analysis in CTF contexts, guiding practitioners through obfuscated scripts, C2 traffic, and forensic artefacts to identify threats and indicators.

Core Features & Use Cases

  • Obfuscated script analysis, PCAP interpretation, and malware configuration extraction to map attack patterns.
  • Comprehensive guidance for deobfuscation, static/dynamic analysis, and C2 traffic detection across Windows and Linux targets.
  • Use cases include triage of suspicious binaries, extraction of IOCs, and reconstruction of attacker infrastructure for learning and defense.

Quick Start

Analyze a provided malware sample or PCAP capture to identify the C2 channel and deobfuscation steps.

Frequently Asked Questions about ctf-malware

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I analyze C2 traffic from a PCAP capture during a CTF?▼

To analyze C2 traffic from a PCAP capture, this Skill guides you through network artifact extraction and step-by-step triage to identify threat indicators and reconstruct attacker infrastructure.

What is the best way to deobfuscate malicious scripts for malware analysis?▼

Deobfuscating malicious scripts involves applying static and dynamic analysis techniques to map attack patterns. This Skill provides practical guidance for deobfuscation and extracting malware configurations.

Can I extract IOCs and malware configurations from suspicious binaries in a CTF?▼

Yes, you can extract IOCs and malware configurations from suspicious binaries. The Skill supports triage of Windows and Linux targets to identify behavior and map attack patterns.

Does this malware analysis approach work on both Windows and Linux targets?▼

Yes, this malware analysis approach works on both Windows and Linux targets. It provides comprehensive guidance for static and dynamic analysis across both operating systems.

How do I perform step-by-step triage on obfuscated malware samples?▼

Performing step-by-step triage on obfuscated malware samples requires structured deobfuscation and network artifact extraction. This Skill outlines the triage process to identify threats and indicators.

Related Skills

Explore More Software Engineering Skills→
langbyyilangbyyi
96

ctf-malware

Analyze obfuscated malware and decrypt C2 traffic for CTF challenges.

Community
Advanced
jassicsjassics
6

ioc-enrichment

Enrich indicators of compromise with context, relationships, and confidence assessment.

Community
Advanced
djacobsmeyerdjacobsmeyer
3

sandbox-manager

Configure Claude Code sandbox policies in settings.json for secure code execution.

Community
Advanced
asdfgh1445asdfgh1445
735

ctf-malware

Reverse engineer and decrypt malware samples from CTF challenges.

Community
Advanced