# Ctf Malware

Provides malware analysis and network traffic techniques for CTF challenges.

- Repository: https://github.com/ljagiello/ctf-skills (3598 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-30
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add ljagiello/ctf-skills --skill ctf-malware -g -a claude-code -y`
Codex: `npx skills add ljagiello/ctf-skills --skill ctf-malware -g -a codex -y`
Cursor: `npx skills add ljagiello/ctf-skills --skill ctf-malware -g -a cursor -y`
Gemini CLI: `npx skills add ljagiello/ctf-skills --skill ctf-malware -g -a gemini-cli -y`

## Description

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

## Prerequisites

**Python packages (all platforms):**
```bash
pip install yara-python pefile capstone oletools unicorn pycryptodome \
  volatility3 dissect.cobaltstrike
```

**Linux (apt):**
```bash
apt install strace ltrace tshark binwalk binutils
```

**macOS (Homebrew):**
```bash
brew install wireshark binwalk binutils ghidra
```

**Manual install:**
- dnSpy, [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows)

**MCP servers (optional):** IDA Pro MCP / Ghidra MCP (unpacking, config extraction), WinDbg MCP ([svnscha/mcp-windbg](https://github.com/svnscha/mcp-windbg)) for dynamic analysis, JADX MCP for Android, see [tools-mcp.md](tools-mcp.md). Run malware only in an isolated, disposable VM.

## Additional Resources

The rest: https://github.com/ljagiello/ctf-skills/blob/HEAD/ctf-malware/SKILL.md