ctf-malware
涵盖YARA、PE/.NET、内存取证等实用技巧，适合逆向与红队。
包含可能运行或分析恶意样本的工具，须在隔离环境中使用。
用于CTF中恶意软件与网络流量的分析技巧和工具集合。
面向 CTF 的恶意软件与网络流量分析速查：包含对混淆脚本、恶意包、PE/.NET 二进制、RC4/AES 通信、YARA 规则、shellcode、内存取证等的常用分析手法。在拿到可疑样本、抓包或需要提取配置与 IOC 时派上用场。特点是把静态、动态和内存分析流程与常用工具（Volatility、pefile、capstone 等）整合成实战步骤。
▸ 展开 SKILL.md 英文原文
Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion, API hashing, process injection, environment checks), or extracting malware configurations and indicators of compromise.
帮我安装这个 skill：https://raw.githubusercontent.com/ljagiello/ctf-skills/main/ctf-malware/SKILL.mdcurl -fsSL "https://raw.githubusercontent.com/ljagiello/ctf-skills/main/ctf-malware/SKILL.md"# CTF Malware & Network Analysis Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code. ## Prerequisites **Python packages (all platforms):** ```bash pip install yara-python pefile capstone oletools unicorn pycryptodome \ volatility3 dissect.cobaltstrike ``` **Linux (apt):** ```bash apt install strace ltrace tshark binwalk binutils ``` **macOS (Homebrew):** ```bash brew install wireshark binwalk binutils ghidra ``` **Manual install:** - dnSpy — [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows) ## Additional Resources - [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - Java