Ctf Malware

This is a compact reference for malware analysis CTF challenges, covering everything from deobfuscating PowerShell and JavaScript to extracting C2 configs from PE and .NET binaries. You get practical patterns for custom crypto protocols (RC4 WebSocket C2, ChaCha20 keystream extraction), anti-analysis techniques like API hashing and VM detection, and forensics tooling around Volatility, YARA, and shellcode emulation with Unicorn. The supporting files include real examples like trojanized plugin analysis with custom alphabet rotation and Telegram bot token recovery. Useful when you're past basic reversing and dealing with actual malicious behavior, encrypted comms, or sandbox evasion. If it's just a crackme or packed binary with no C2 activity, you're better off with ctf-reverse instead.

skills.sh installs: 9.3K
GitHub stars: 3.7K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add ljagiello/ctf-skills --skill ctf-malware --agent claude-code

Installs into .claude/skills of the current project.

Files

CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Prerequisites

Python packages (all platforms):

pip install yara-python pefile capstone oletools unicorn pycryptodome \
  volatility3 dissect.cobaltstrike

Linux (apt):

apt install strace ltrace tshark binwalk binutils

macOS (Homebrew):

brew install wireshark binwalk binutils ghidra

Manual install:

dnSpy — GitHub, .NET decompiler (Windows)

MCP servers (optional): IDA Pro MCP / Ghidra MCP (unpacking, config extraction), WinDbg MCP (svnscha/mcp-windbg) for dynamic analysis, JADX MCP for Android — see tools-mcp.md. Run malware only in an isolated, disposable VM.