ctf-malware

# CTF Malware & Network Analysis Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code. ## Prerequisites **Python packages (all platforms):** ```bash pip install yara-python pefile capstone oletools unicorn pycryptodome \ volatility3 dissect.cobaltstrike ``` **Linux (apt):** ```bash apt install strace ltrace tshark binwalk binutils ``` **macOS (Homebrew):** ```bash brew install wireshark binwalk binutils ghidra ``` **Manual install:** - dnSpy — [GitHub](https://github.com/dnSpy/dnSpy), .NET decompiler (Windows) ## Additional Resources - [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection), trojanized plugin analysis with custom alphabet C2 decoding - [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption - [p...