CTF Malware & Network Analysis
Paste the following prompt into your AI chat to install this skill:
Please follow https://skillhub.cn/install/skillhub.md to install @user_257ad2a8/ctf-malware to your AI assistant.
About this skill
Problem
In CTF malware challenges, samples are rarely readable binaries. Scripts may hide code behind eval, base64, or IEX; C2 may use custom crypto, odd ports, DNS tunneling, or beaconing; PE/.NET payloads may combine obfuscation, sandbox evasion, and encrypted configuration. The hard part is not running one tool, but knowing which indicators to check first and in what order.
How It Works
ctf malware turns this into a structured workflow. For network-heavy samples, it starts with strings, grep, PCAP review, and C2 patterns such as DGA, DNS tunneling, and encoded HTTP payloads. For scripts, it replaces eval, console.log, or IEX with output, then decodes base64, atob(), String.fromCharCode(), PowerShell -enc, and custom alphabet rotations. For protocol analysis, it highlights RC4 WebSocket, AES-CBC, ChaCha20 keystream extraction, null-byte probes, and time-ordered payload concatenation. PE/.NET coverage includes dnSpy, pe-sieve, AsmResolver, LimeRAT configuration, PyInstaller/PyArmor unpacking, YARA rules, Unicorn/Capstone shellcode analysis, and Volatility 3 malfind memory checks.
Boundaries
Use it when the sample has malware behavior. If the task is a plain crackme, packed binary, or custom VM, switch to /ctf-reverse. If the main work is disk carving, network reconstruction, or host artifact recovery, switch to /ctf-forensics. If the challenge centers on attribution or infrastructure tracing, switch to /ctf-osint.
Use Cases
- Triage a JavaScript malware sample wrapped in eval and base64 to recover the real payload and C2 domain.
- Inspect a PCAP for anomalous C2 traffic, extracting beaconing, DNS tunneling, or WebSocket indicators.
- Extract C2 configuration and keys from a .NET PE sample using dnSpy, pe-sieve, or AsmResolver.
- Hunt injected code in a memory image with Volatility 3 malfind and YARA string matching.
Best For
- CTF security competitors who need a fast triage path for malicious scripts, C2 traffic, and PE configuration.
- Malware analysis engineers who need to turn PCAP, PE, and memory image clues into reproducible steps.
- Security detection engineers who need YARA rules for shellcode, base64 payloads, and PowerShell obfuscation.
- Blue-team analysts doing post-incident review who need to confirm injection, sandbox evasion, and C2 decryption logic.
Related Skills
Detects AI-generated images from Stable Diffusion, Midjourney, and GPT-4o via Tencent Cloud image moderation and returns risk scores.
Comprehensive network engineering skill covering fault troubleshooting, technical consulting, and architecture design across routing and switching, wireless, security, cloud computing, and optical transport.
Provides 9 application modules based on GB/T 33000-2025 and DuPont safety methodologies for diagnosing, standardizing, and building culture in enterprise safety management systems.
Detects PII, API keys, tokens, and blockchain credentials at the message entry, applies reversible masking, and flags prompt injection or dangerous commands locally.