Ctf Malware
Provides malware analysis and network traffic techniques for CTF challenges.
Install
npx skills add ljagiello/ctf-skills --skill ctf-malware -g -a claude-code -y- Repository
- ljagiello/ctf-skills3.6k
- Category
- Security
- Updated
- 5d ago
- License
- MIT
- Context cost
- Mediumabout 2,061 tokens
- Runs scripts
- No, instructions only
What it does
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.
CTF Malware & Network Analysis
Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
Prerequisites
Python packages (all platforms):
pip install yara-python pefile capstone oletools unicorn pycryptodome \
volatility3 dissect.cobaltstrike
Linux (apt):
apt install strace ltrace tshark binwalk binutils
macOS (Homebrew):
brew install wireshark binwalk binutils ghidra
Manual install:
- dnSpy, GitHub, .NET decompiler (Windows)
MCP servers (optional): IDA Pro MCP / Ghidra MCP (unpacking, config extraction), WinDbg MCP (svnscha/mcp-windbg) for dynamic analysis, JADX MCP for Android, see tools-mcp.md. Run malware only in an isolated, disposable VM.
