Security audit

Ctf Malware

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent CTF malware-analysis reference skill, but it gives under-scoped instructions for running malware samples and using recovered Telegram bot tokens.

Install only if you will use it in a disposable, isolated CTF or malware lab. Do not run unknown samples on your normal machine, do not use recovered real-world credentials without explicit authorization, and pin or isolate tool installations in a virtual environment or container.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Risk
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts-and-obfuscation.md:84
Finding: Malware Samples Are Executed Without Enforced Isolation
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: c2-and-protocols.md:105
Finding: Recovered Telegram Bot Credentials Are Used to Access Remote Data Without an Authorization Guard
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.
rep Task WebFetch WebSearch metadata: user-invocable: "false"

CTF Malware & Network Analysis

Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.

Prerequisites

Python packages (all platforms):

bash
pip install yara-python pefile capstone oletools unicorn pycryptodome \ volatility3 dissect.cobaltstrike

Linux (apt):

bash
apt install strace ltrace tshark binwalk binutils

macOS (Homebrew):

bash
brew install wireshark binwalk binutils ghidra

Manual install:

dnSpy — GitHub, .NET decompiler (Windows)

Additional Resources

scripts-and-obfuscation.md - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sand

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

Critical

Category: YARA Match
Confidence: 85% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · c2-and-protocols.md (reported line 221)May include surrounding context.
/dpixel (default URIs)

- Cookie contains base64-encoded metadata

- Regular check-in intervals (default: 60s sleep)

- User-Agent matches common Malleable C2 profiles

Wireshark filters for CS traffic:

http.request.uri contains "submit.php" or http.request.uri contains "__utm"

http.cookie contains base64 pattern

Decode beacon config from captured DLL/shellcode:

pip install dissect.cobaltstrike

python3 -c " from dissect.cobaltstrike import beacon for config in beacon.iter_beacons(open('beacon.bin', 'rb')): print(config) # Shows: C2 server, sleep time, jitter, URI paths, user-agent, watermark "

Extract beacon from PCAP:

tshark -r capture.pcap -Y "http.response" -T fields -e http.file_data | xxd -r -p > payload.bin

Then analyze with dissect.cobaltstrike or CobaltStrikeParser

text
**Key insight:** Cobalt Strike uses "Malleable C2" profiles that customize HTTP indicators, but the underlying beacon protocol structure is consistent. Look for regular-interval HTTP

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs users to use a recovered malware Telegram bot token to call getUpdates and getFile APIs, which involves interacting with a live third-party service using credentials extracted from malware. That can trigger unauthorized access, privacy violations, evidence tampering, or contact with attacker-controlled infrastructure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill includes dynamic-analysis commands that execute suspicious binaries (strace, ltrace, running ./suspicious) and other workflows that may interact with potentially malicious samples, but it provides only a brief parenthetical note rather than concrete safety constraints. In an agent context with filesystem, bash, and internet access, this can lead to accidental execution of malware outside a properly isolated sandbox.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · c2-and-protocols.md (reported line 134)May include surrounding context.
md
TOKEN = "bot_token_here" # Get updates (message history) r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates") # Download files sent to bot file_id = "..." r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · c2-and-protocols.md (reported line 137)May include surrounding context.
md
TOKEN = "bot_token_here" # Get updates (message history) r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates") # Download files sent to bot file_id = "..." r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · c2-and-protocols.md (reported line 139)May include surrounding context.
md
TOKEN = "bot_token_here" # Get updates (message history) r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates") # Download files sent to bot file_id = "..." r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts-and-obfuscation.md (reported line 99)May include surrounding context.
md
# Network monitoring during execution # Terminal 1: capture traffic sudo tcpdump -i any -w malware_traffic.pcap & # Terminal 2: DNS monitoring sudo tcpdump -i any port 53 -l | tee dns_queries.log & # Terminal 3: run sample

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · scripts-and-obfuscation.md (reported line 101)May include surrounding context.
md
# Network monitoring during execution # Terminal 1: capture traffic sudo tcpdump -i any -w malware_traffic.pcap & # Terminal 2: DNS monitoring sudo tcpdump -i any port 53 -l | tee dns_queries.log & # Terminal 3: run sample

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

rep Task WebFetch WebSearch metadata: user-invocable: "false"

CTF Malware & Network Analysis

Prerequisites

Additional Resources

YARA rule 'c2_framework_indicators': Command-and-control framework indicators (Cobalt Strike, Metasploit, Sliver, etc.) [malware]

- Cookie contains base64-encoded metadata

- Regular check-in intervals (default: 60s sleep)

- User-Agent matches common Malleable C2 profiles

Wireshark filters for CS traffic:

http.request.uri contains "submit.php" or http.request.uri contains "__utm"

http.cookie contains base64 pattern

Decode beacon config from captured DLL/shellcode:

pip install dissect.cobaltstrike

Extract beacon from PCAP:

Then analyze with dissect.cobaltstrike or CobaltStrikeParser

Missing User Warnings

Missing User Warnings

External Transmission

External Transmission

External Transmission

Sudo/Root Execution

Sudo/Root Execution

Static analysis