What problem does it solve? When analyzing a malware sample in a CTF or sandbox setting, the decisive value is often not just what the sample does but which config fields, staging layers, and network parameters it hides. This Skill provides a repeatable workflow for locating the config boundary, reconstructing the decode chain, and tying recovered fields to observed behavior. ## Core Features & Use Cases - Config Boundary Discovery: Locate where configuration is stored, whether in resources, overlays, encrypted blobs, registry seeds, bootstrap responses, or stage2 memory. - Decode Chain Reconstruction: Recover the full transform chain in order (container, compression, encoding, XOR or substitution, crypto, final parse) and group fields from the same chain together. - Behavior Correlation: Map each recovered field (beacon path, mutex, bot ID, campaign ID, wallet, persistence name) to the branch or protocol step it actually influences. - Use Case: Given a packed sample with an encrypted config blob, use this Skill to rank candidate blobs by entropy and nearby strings, recover the XOR key and decode helpers, and produce a compact evidence block of offsets, hashes, keys, and parsed fields. ## Quick Start After the ctf-sandbox-orchestrator skill is active, ask it to recover the hidden config, staging layers, bot IDs, or beacon parameters from the current sample.
