Skip to content
Get packs

Malware Config Recovery

Guides an agent through recovering malware configs and C2 beacon fields inside a CTF sandbox workflow.

Source Download skill
Repository
zhaoxuya520/reverse-skill
Stars
43,969
Licence
MIT
Files
3 files

What it does

This skill is a specialist playbook for analysing malware samples in a capture-the-flag or sandbox setting. Once installed, the agent knows how to locate where a sample hides its configuration, follow the decoding steps (unpacking, decompression, XOR, crypto) to recover fields such as beacon paths, bot or campaign IDs, and C2 parameters, and link those fields to the network or process behaviour they control. It is explicitly a downstream skill: it tells the agent to return to a parent orchestrator skill first to establish sandbox assumptions, and to reply in Simplified Chinese unless English is requested.

Great for

  • Students or competitors working on CTF malware reverse-engineering challenges
  • Security analysts who already run an isolated sandbox and want a structured config-extraction checklist

Skip it if

  • Analysing live malware on a production or personal machine, since the skill assumes an isolated sandbox and does not enforce that itself
  • Users who expect a standalone tool: it depends on the separate ctf-sandbox-orchestrator skill being active and provides no scripts of its own

Try asking

  • “Recover the C2 beacon fields from this packed sample in my CTF sandbox challenge”
  • “Decode the config blob in this stage2 payload and tell me the XOR key and bot ID”
  • “Map each recovered config field to the branch of code it controls”
Step-by-step guide: how to use Malware Config RecoveryInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the MIT licence and an attribution note.

    competition-malware-config.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip competition-malware-config.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip competition-malware-config.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run the skill only after the ctf-sandbox-orchestrator skill has set up sandbox assumptions, as the instructions require.
  • Keep the original sample untouched and work on copies, following the skill's preservation rules.
  • Analyse samples only inside an isolated, offline lab environment.

What's inside

  • agents/openai.yaml
  • references/malware-config.md
  • SKILL.md

Redistributed unmodified from zhaoxuya520/reverse-skill under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.