Ctf Malware

1---2name: ctf-malware3description: Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.4license: MIT5compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation.6allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch7metadata:8  user-invocable: "false"9---10 11# CTF Malware & Network Analysis12 13Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.14 15## Prerequisites16 17**Python packages (all platforms):**18```bash19pip install yara-python pefile capstone oletools unicorn pycryptodome \20  volatility3 dissect.cobaltstrike21```22 23**Linux (apt):**24```bash25apt install strace ltrace tshark binwalk binutils26```27 28**macOS (Homebrew):**29```bash30brew install wireshark binwalk binutils ghidra31```32 33**Manual install:**34- dnSpy — [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows)35 36## Additional Resources37 38- [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection), trojanized plugin analysis with custom alphabet C2 decoding39- [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption40- [pe-and-dotnet.md](pe-and-dotnet.md) - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor41 42---43 44## When to Pivot45 46- If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to `/ctf-reverse`.47- If the main job is network reconstruction, disk carving, or host artifact recovery, switch to `/ctf-forensics`.48- If the challenge turns into public attribution or infrastructure tracing, switch to `/ctf-osint`.49 50## Quick Start Commands51 52```bash53# Static analysis54file suspicious_file55strings -n 8 suspicious_file | head -5056xxd suspicious_file | head -2057 58# PE analysis59python3 -c "import pefile; pe=pefile.PE('mal.exe'); print(pe.dump_info())" | head60peframe mal.exe61 62# Dynamic analysis (sandboxed!)63strace -f -s 200 ./suspicious 2>&1 | head -10064ltrace ./suspicious 2>&1 | head -5065 66# Network indicators67strings suspicious_file | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'68strings suspicious_file | grep -iE 'http|ftp|ws://'69 70# YARA scan71yara -r rules.yar suspicious_file72```73 74## Obfuscated Scripts75 76- Replace `eval`/`bash` with `echo` to print underlying code; extract base64/hex blobs and analyze with `file`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).77 78## JavaScript & PowerShell Deobfuscation79 80- JS: Replace `eval` with `console.log`, decode `unescape()`, `atob()`, `String.fromCharCode()`.81- PowerShell: Decode `-enc` base64, replace `IEX` with output. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).82 83## Junk Code Detection84 85- NOP sleds, push/pop pairs, dead writes, unconditional jumps to next instruction. Filter to extract real `call` targets. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).86 87## PCAP & Network Analysis88 89```bash90tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload91```92 93Look for C2 on unusual ports. Extract IPs/domains with `strings | grep`. See [c2-and-protocols.md](c2-and-protocols.md).94 95## Custom Crypto Protocols96 97- Stream ciphers share keystream state for both directions; concatenate ALL payloads chronologically.98- ChaCha20 keystream extraction: send nullbytes (0 XOR anything = anything). See [c2-and-protocols.md](c2-and-protocols.md).99 100## C2 Traffic Patterns101 102- Beaconing, DGA, DNS tunneling, HTTP(S) with custom headers, encoded payloads. See [c2-and-protocols.md](c2-and-protocols.md).103 104## RC4-Encrypted WebSocket C2105 106- Remap port with `tcprewrite`, add RSA key for TLS decryption, find RC4 key in binary. See [c2-and-protocols.md](c2-and-protocols.md).107 108## Identifying Encryption Algorithms109 110- AES: `0x637c777b` S-box; ChaCha20: `expand 32-byte k`; TEA/XTEA: `0x9E3779B9`; RC4: sequential S-box init. See [c2-and-protocols.md](c2-and-protocols.md).111 112## AES-CBC in Malware113 114- Key = MD5/SHA256 of hardcoded string; IV = first 16 bytes of ciphertext. See [c2-and-protocols.md](c2-and-protocols.md).115 116## PE Analysis117 118```bash119peframe malware.exe      # Quick triage120pe-sieve                 # Runtime analysis121pestudio                 # Static analysis (Windows)122```123 124See [pe-and-dotnet.md](pe-and-dotnet.md).125 126## .NET Malware Analysis127 128- Use dnSpy/ILSpy for decompilation; AsmResolver for programmatic analysis. LimeRAT C2: AES-256-ECB with MD5-derived key. See [pe-and-dotnet.md](pe-and-dotnet.md).129 130## Malware Configuration Extraction131 132- Check .data section, PE/.NET resources, registry keys, encrypted config files. See [pe-and-dotnet.md](pe-and-dotnet.md).133 134## Sandbox Evasion Checks135 136- VM detection, debugger detection, timing checks, environment checks, analysis tool detection. See [pe-and-dotnet.md](pe-and-dotnet.md).137 138## Anti-Analysis Techniques139 140VM detection (CPUID, MAC prefix, registry, disk size), timing evasion (sleep/RDTSC sandbox detection), API hashing (ROR13/DJB2/CRC32 + hashdb lookup), process injection (hollowing, APC, CreateRemoteThread), environment checks. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#anti-analysis-techniques).141 142## Trojanized Plugin Analysis143 144Diff malicious plugin against official release to find injected code in try/except blocks. Custom alphabet rotation (`C[(C.index(ch) - offset) % len(C)]`) decodes C2 domain, XOR decodes endpoint path. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#trojanized-plugin-analysis-with-custom-alphabet-c2-decoding-inshack-2018).145 146## PyInstaller + PyArmor Unpacking147 148- `pyinstxtractor.py` to extract, PyArmor-Unpacker for protected code. See [pe-and-dotnet.md](pe-and-dotnet.md).149 150## Telegram Bot Evidence Recovery151 152- Use bot token from malware source to call `getUpdates` and `getFile` APIs. See [c2-and-protocols.md](c2-and-protocols.md).153 154## Debian Package Analysis155 156```bash157ar -x package.deb && tar -xf control.tar.xz  # Check postinst scripts158```159 160See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).161 162## YARA Rules for Malware Detection163 164Write YARA rules to match byte patterns, strings, and regex against files or memory dumps. Detect XOR loops (`{31 ?? 80 ?? ?? 4? 75}`), base64 blobs, encoded PowerShell. Use `yarac` to compile for faster scanning. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#yara-rules-for-malware-detection).165 166## Shellcode Analysis167 168Disassemble with `objdump -b binary -m i386:x86-64`, emulate with Unicorn Engine (hook syscalls safely), or use Capstone for programmatic disassembly. Look for XOR decoder stubs. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#shellcode-analysis).169 170## Memory Forensics for Malware171 172`vol3 windows.malfind` detects injected code (PAGE_EXECUTE_READWRITE without mapped file). `windows.pstree` reveals suspicious parent-child relationships. YARA scan memory with `yarascan.YaraScan`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#memory-forensics-for-malware).173 174## Network Indicators Quick Reference175 176```bash177strings malware | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'178tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u179```