ctf-malware
ctf malware
What it does
- dnSpy — GitHub, .NET decompiler (Windows)
- If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to /ctf-reverse.
- If the main job is network reconstruction, disk carving, or host artifact recovery, switch to /ctf-forensics.
- If the challenge turns into public attribution or infrastructure tracing, switch to /ctf-osint.
- Replace eval/bash with echo to print underlying code; extract base64/hex blobs and analyze with file. See scripts-and-obfuscation.md.
- JS: Replace eval with console.log, decode unescape(), atob(), String.fromCharCode().
- PowerShell: Decode -enc base64, replace IEX with output. See scripts-and-obfuscation.md.
Requirements & configuration
- Use bot token from malware source to call getUpdates and getFile APIs. See c2-and-protocols.md.
Derived from the skill's own SKILL.md documentation · extracted 2026-07-23
ctf-malware FAQ
What does the ctf-malware skill do?
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise. dnSpy — GitHub, .NET decompiler (Windows) If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to /ctf-reverse.
What does ctf-malware require?
Use bot token from malware source to call getUpdates and getFile APIs. See c2-and-protocols.md.
How do I install ctf-malware?
Run: npx -y skills add https://github.com/ljagiello/ctf-skills --skill ctf-malware --agent claude-code — the source lives at github.com/ljagiello/ctf-skills.
Maintain ctf-malware?
Let people know it's listed here — add the badge (live metrics, light/dark aware) or a plain link to your README or docs.
[](https://getagentictools.com/skills/ljagiello-ctf-skills-ctf-malware?ref=badge) npx agentictools info skills/ljagiello-ctf-skills-ctf-malware The second line is the CLI lookup for this page — handy in READMEs and docs.
