Sato Hub
← Skills

ctf-malwareskills.sh · ljagiello

8,436 installs

Provides malware analysis and network traffic techniques for CTF challenges. Use when analyzing obfuscated scripts, malicious packages, custom crypto protocols, C2 traffic, PE/.NET binaries, RC4/AES encrypted communications, YARA rules, shellcode analysis, memory forensics for malware (Volatility malfind, process injection detection), anti-analysis techniques (VM/sandbox detection, timing evasion,

Executes fetched or decoded codeGenerates or handles private keys
Hosts contacted: api.telegram.org
Evidence lines
  • executes_fetched_code — SKILL.md: - [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex paylo
  • executes_fetched_code — SKILL.md: - Replace `eval`/`bash` with `echo` to print underlying code; extract base64/hex blobs and analyze with `file`. See [scripts-and-obfuscation.md](scripts-and-obf
  • executes_fetched_code — SKILL.md: - JS: Replace `eval` with `console.log`, decode `unescape()`, `atob()`, `String.fromCharCode()`.
  • executes_fetched_code — scripts-and-obfuscation.md: - Replace `eval`/`bash` with `echo` to print underlying code
  • executes_fetched_code — scripts-and-obfuscation.md: // Replace eval with console.log
  • generates_or_handles_keys — scripts-and-obfuscation.md: if instr.mnemonic == 'call' and not is_junk_target(instr.operand):
  • generates_or_handles_keys — scripts-and-obfuscation.md: print(f'{i.address:#x}: {i.mnemonic} {i.op_str}')

Our disclosure is a static description of what the skill declares and does; it is not a safety verdict. Source record: www.skills.sh/ljagiello/ctf-skills/ctf-malware.

Install

npx skills add ljagiello/ctf-skills@ctf-malware

Copied from the registry's documented install form. Read the disclosure above first; it is the whole point of this page.

Observed record

First seen 2026-10-19. The weekly re-scan will record install growth and any change to the skill's content hash; one observation so far.

Cite this page

Sato Hub. "ctf-malware — skill disclosure on Sato Hub." Sato Hub, updated 2026-10-23, accessed 2026-10-23. https://satohub.ai/skills/skillssh%3Aljagiello%2Fctf-skills%2Fctf-malware

Data last refreshed 2026-10-23; this page is rebuilt daily. Citations carry the date so a reader can tell which snapshot a claim came from. Catalog data is licensed CC-BY-4.0.