malware-ctf

name	malware-ctf
description	Lab/CTF: malware-analysis challenges; obfuscated scripts, PE/.NET/ELF, shellcode artifacts, memory/PCAP, configs, encrypted traffic.
license	MIT
compatibility	AgentSkills-compatible agents; local challenge artifacts; authorized training and lab environments.
metadata	{"author":"AeonDave","version":"1.0","category":"ctf-solving"}

Malware CTF

Goal: solve malware-analysis challenge solving tasks with professional offensive methodology, preserved imported technique coverage, and reproducible evidence.

When this skill applies

• obfuscated scripts, PE/.NET/ELF samples, shellcode, injected memory, malware PCAPs, C2 configs, or encrypted protocol traffic
• config extraction, unpacking, API hashing, C2 reconstruction, memory dumping, or network-protocol decoding

Operating model

1. Classify the dominant artifact, primitive, or objective.
2. Load the closest offensive-techniques methodology before selecting tools.
3. Load debrandized imported references only for deep technique details.
4. Choose the smallest tool chain that can produce a validation signal.
5. Record the exact proof path and stop once the objective is reproducible.

Technique integration

Primary methodology to load:

• reversing-technique
• forensic-technique
• network-technique
• crypto-technique

Use these as decision engines. This skill adds challenge-oriented triage, time-boxing, and preserved specialized patterns from the imported corpus.

Tool routing

Prefer these tool families when the corresponding signal appears:

• capa
• yara
• volatility3
• ghidra
• x64dbg
• frida
• wireshark

Tool syntax belongs in the tool skills. This skill decides when a tool family fits and what output should validate progress.

Solving patterns

• Favor artifact-first triage, shortest reproducible path, and explicit validation signal before pivoting.
• Record failed hypotheses with evidence so an agent does not repeat expensive dead paths.
• Prefer category-specific tools after surface classification instead of running every scanner or brute-forcer by habit.
• End with a replayable proof: recovered secret, local verification, exploit output, decoded artifact, or correlated evidence chain.

Category-specific quick pivots

• Static triage before execution: file type, entropy, imports, strings, capabilities, embedded blobs.
• Run dynamic analysis only in isolation and record file, process, registry, and network effects.
• Treat encrypted configs and C2 protocols as crypto/protocol-reversing subproblems.

Quality gates

• No claim without a validation signal: recovered secret, replayed exploit, decoded artifact, reproduced model behavior, or corroborated evidence.
• Do not brute force before representation, constraints, and success oracle are known.
• Keep a pivot ledger: hypothesis, evidence, result, next shortest path.
• Keep challenge/platform/competition names out of notes and generated reports.

Resources

• references/c2-and-protocols.md — preserved, debrandized imported technique material.
• references/pe-and-dotnet.md — PE/NET static analysis patterns, config extraction, sandbox evasion signatures, DNS C2.
• references/scripts-and-obfuscation.md — preserved, debrandized imported technique material.
• references/static-and-dynamic-triage.md — Load for systematic malware triage: file ID → strings → capa → PE header → import analysis → packing/obfuscation resolution → dynamic analysis and validation.