Ctf malware

Skill MateoBogo/CLEAVE/skills/ctf-malware

CLEAVE: skills-based CTF agents for mechanics-first challenge triage and exploit orchestration.

Install

npx -y skills add MateoBogo/CLEAVE --skill ctf-malware

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
4 stars4 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Malware & network analysis: obfuscated JS/PowerShell/VBA, PE/.NET analysis, PyInstaller/PyArmor, custom C2 protocols (RC4, AES, DNS), YARA rules, shellcode, memory-forensics IOCs, anti-sandbox/anti-VM bypass.

The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.6 KB, as published. Nobody here has run it

CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Additional Resources

scripts-and-obfuscation.md - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection)
c2-and-protocols.md - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
pe-and-dotnet.md - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor

Pattern Recognition Index

Dispatch on byte/file signals, never the sample's reputation.

Signal	Technique → file
File starts with `PK` + contains `package.json` + `.vsix` extension	VSCode extension activation-event exfil → scripts-and-obfuscation.md
High-entropy `extension.js`/`index.js` > 50 KB with `child_process`	JS obfuscator.io / JSFuck deobfuscation → scripts-and-obfuscation.md
PowerShell `-enc <b64>` or IEX in parent process logs	PS script decode + reflection assembly → scripts-and-obfuscation.md
PCAP with custom TCP port, payload bytes distributed uniformly	Custom crypto / RC4 / AES session key recovery → c2-and-protocols.md
PCAP with `DNS TXT` records carrying base32/64 blobs	DNS-based C2 exfil → c2-and-protocols.md
PCAP where specific User-Agent receives non-default responses	UA-gated C2 path-hex-XOR → (see ctf-forensics/network-advanced.md)
PE32/PE64 with `.text` sections having packer signatures (UPX, VMProtect, Themida)	Unpacking + dump-after-decrypt → pe-and-dotnet.md
.NET assembly with obfuscated strings + reflection calls	dnSpy + de4dot + string decryption → pe-and-dotnet.md
PyInstaller binary (`MEIPASS`, `_MEIxxxx` strings)	pyinstxtractor + pycdc → pe-and-dotnet.md
Process-injection IoCs in memory dump (`RWX` allocations, `NtUnmapViewOfSection`)	Volatility `malfind` + process hollowing detection → scripts-and-obfuscation.md
Anti-VM checks (`cpuid` hypervisor bit, RDTSC timing, specific drivers)	VM-detection bypass in analysis sandbox → scripts-and-obfuscation.md
WebSocket frame with visible RC4 key-setup or KSA signatures	RC4 WebSocket reversing → c2-and-protocols.md

Recognize the artefact or protocol pattern. The sample's name is not a signal.