competition-malware-config
Helps your agent recover malware configurations. Useful for understanding how malicious software operates and communicates.
What it does
This tool helps find and understand the hidden configurations of malicious software (malware). It extracts important information like communication parameters and secret data, which are crucial for understanding how the malware operates.
When to use it
- ✓When you need to discover how malware communicates with its control server.
- ✓When you want to extract hidden information from a malicious program.
- ✓When you need to understand the technical details of malware found in a safe environment.
Example of what to ask your AI
“Recover the malware configuration and decode the beacon parameters.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
The tool analyzes the malicious program to find where configurations are hidden, how they are protected (e.g., encrypted), and how to reveal them. It then links these configurations to the actions the malware performs.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add zhaoxuya520/reverse-skill --skill competition-malware-configOr download just the file:
curl -L https://raw.githubusercontent.com/zhaoxuya520/reverse-skill/main/CTF-Sandbox-Orchestrator/competition-malware-config/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Competition Malware Config
Use this skill only as a downstream specialization after $ctf-sandbox-orchestrator is already active and has established sandbox assumptions, node ownership, and evidence priorities. If that has not happened yet, return to $ctf-sandbox-orchestrator first.
Use this skill when the decisive value is not just "what the sample does," but which config fields, stages, or network parameters the sample hides and when they become plaintext.
Reply in Simplified Chinese unless the user explicitly requests English.
Quick Start
- Preserve the original sample before unpacking or patching.
- Separate loader, payload, config blob, and post-decode behavior.
- Rank candidate config blobs by entropy, field shape, nearby strings, and decode helpers.
- Record the exact transform chain for each recovered field.
- Reproduce the decoded config or beacon parameters from the smallest possible path.
Workflow
1. Find The Config Boundary
- Inspect sections, resources, embedded archives, strings, imports, and decode helpers.
- Identify where config is stored: resource, overlay, encrypted blob, registry seed, network bootstrap, or stage2 memory.
- Keep one note of when each value becomes plaintext.
2. Reconstruct The Decode Chain
- Recover the chain in order: container -> compression -> encoding -> xor/substitution -> crypto -> parse.
- Group all config fields from the same chain together instead of treating them as unrelated clues.
- Preserve hashes, offsets, keys, IVs, masks, and parsed fields in one compact evidence block.
3. Tie Config To Behavior
- Show which field affects which branch: beacon path, mutex, wallet, bot id, campaign, tasking route, persistence name, or process target.
- Correlate decoded config with PCAPs, process trees, or stage2 strings when possible.
Read This Reference
- Load
references/malware-config.mdfor the config-hunting checklist, staged-sample checklist, and evidence packaging rules.
What To Preserve
- Original artifact, unpacked layer, dumped stage, and parsed config as separate artifacts
- Offsets, hashes, decode helpers, keys, masks, and field names
- The branch or protocol step each recovered field actually influences
FAQ
What are 'beacon parameters'?
These are the pieces of information malware uses to communicate with its command server, like a signal to 'check in' and receive instructions.
What does 'unpack staged payloads' mean?
Malware often uses a small initial piece of code to download and run larger, more complex parts called 'payloads'. Unpacking means revealing these parts.
What are 'IOCs'?
IOCs stand for 'Indicators of Compromise'. These are digital clues (like network addresses or specific files) that show a system has been attacked by malware.
Details
Original description by the author
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for malware configuration recovery, staged payload boundaries, beacon parameter extraction, and IOC decoding. Use when the user asks to recover a malware config, decode C2 or beacon fields, unpack staged payloads, extract bot or campaign IDs, or tie recovered config to observed protocol behavior under sandbox assumptions.
Popularity
- GitHub stars
- 42k
- Ranking position
- #4727
- License
- MIT
- Updated
- 9/22/2026
Comments
- …
More skills from this repository
competition-ad-certificate-abuse
Helps your agent analyze attacks on digital certificate systems. It investigates how certificates can be misused to gain access.
zhaoxuya520/reverse-skill
competition-agent-cloud
Helps your agent analyze security challenges in AI and cloud systems. It investigates how prompts, tools, and the cloud can be exploited.
zhaoxuya520/reverse-skill
competition-android-hooking
Helps your agent investigate Android applications. It analyzes how apps work internally and how they might be modified or exploited.
zhaoxuya520/reverse-skill
competition-browser-persistence
Helps your agent analyze how websites store information in your browser. It investigates cookies and other data to understand how sessions work.
zhaoxuya520/reverse-skill
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC