extracting-config-from-a-running-sample

Name: extracting-config-from-a-running-sample
Author: meltedinhex

18stars5forks

How to install extracting-config-from-a-running-sample?

meltedinhex/analyst-ai-pack/extracting-config-from-a-running-sample

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-config-from-a-running-sample

Installs into the current project.

Summary

Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from

Files · 1

View on GitHub

SKILL.md

1	# Extracting Config From a Running Sample
2
3	## When to Use
4
5	- You have a process memory dump of a detonated sample whose config is decrypted in memory.
6	- You need to recover C2 endpoints, ports, campaign/botnet IDs, mutexes, and keys.
7
8	Do not use this to detonate the sample — it consumes a dump already captured in an isolated
9	sandbox. For static-only config decryption, use the dedicated config-decryptor workflow.
10
11	## Prerequisites
12
13	- A process memory dump (`.dmp`/raw region) captured after the config was decrypted.
14
15	## Safety & Handling
16
17	- Treat the dump as malicious data; read it inertly and defang recovered endpoints.
18
19	## Workflow
20
21	### Step 1: Hunt config indicators
22
23	```bash
24	python scripts/analyst.py hunt process.dmp
25	```
26
27	Scans for URLs, IPv4:port pairs, mutex-like tokens, base64 blobs, and printable key/value
28	candidates in decrypted regions.
29
30	### Step 2: Decode obfuscation layers
31
32	For candidate blobs, try common transforms (single-byte XOR brute force, base64) and re-scan the
33	decoded output for endpoints.
34
35	### Step 3: Structure and validate the config
36
37	Assemble recovered fields into a structured config and sanity-check (valid hosts, plausible
38	ports, consistent campaign IDs).
39
40	### Step 4: Defang and report
41
42	Defang hosts/URLs and document the offsets where the config was recovered.
43
44	## Validation
45
46	- Recovered endpoints are real, parseable hosts/ports — not random byte noise.
47	- XOR/base64 decode is confirmed by the decoded output containing new endpoints/strings.
48	- The final config is defanged before sharing.
49
50	## Pitfalls
51
52	- Mistaking unrelated in-memory URLs (browser, OS) for C2 — corroborate with the sample's region.
53	- Single-byte XOR brute force producing coincidental strings; require multiple corroborating hits.
54	- Reporting raw, live C2 endpoints without defanging.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the hunter/decoder.
59	- ATT&CK T1140 and T1027 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026471k1.3k
azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026470k1.3k
azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026466k1.3k
better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 202678k203
firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 202676k386
audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 202665k85

extracting-config-from-a-running-sample

18stars5forks

View on GitHub

How to install extracting-config-from-a-running-sample?

meltedinhex/analyst-ai-pack/extracting-config-from-a-running-sample

$npx -y skills add meltedinhex/analyst-ai-pack --skill extracting-config-from-a-running-sample

Installs into the current project.

Summary

Extracts an embedded malware configuration (C2 hosts, ports, campaign IDs, keys) from

Files · 1

View on GitHub

SKILL.md

1	# Extracting Config From a Running Sample
2
3	## When to Use
4
5	- You have a process memory dump of a detonated sample whose config is decrypted in memory.
6	- You need to recover C2 endpoints, ports, campaign/botnet IDs, mutexes, and keys.
7
8	Do not use this to detonate the sample — it consumes a dump already captured in an isolated
9	sandbox. For static-only config decryption, use the dedicated config-decryptor workflow.
10
11	## Prerequisites
12
13	- A process memory dump (`.dmp`/raw region) captured after the config was decrypted.
14
15	## Safety & Handling
16
17	- Treat the dump as malicious data; read it inertly and defang recovered endpoints.
18
19	## Workflow
20
21	### Step 1: Hunt config indicators
22
23	```bash
24	python scripts/analyst.py hunt process.dmp
25	```
26
27	Scans for URLs, IPv4:port pairs, mutex-like tokens, base64 blobs, and printable key/value
28	candidates in decrypted regions.
29
30	### Step 2: Decode obfuscation layers
31
32	For candidate blobs, try common transforms (single-byte XOR brute force, base64) and re-scan the
33	decoded output for endpoints.
34
35	### Step 3: Structure and validate the config
36
37	Assemble recovered fields into a structured config and sanity-check (valid hosts, plausible
38	ports, consistent campaign IDs).
39
40	### Step 4: Defang and report
41
42	Defang hosts/URLs and document the offsets where the config was recovered.
43
44	## Validation
45
46	- Recovered endpoints are real, parseable hosts/ports — not random byte noise.
47	- XOR/base64 decode is confirmed by the decoded output containing new endpoints/strings.
48	- The final config is defanged before sharing.
49
50	## Pitfalls
51
52	- Mistaking unrelated in-memory URLs (browser, OS) for C2 — corroborate with the sample's region.
53	- Single-byte XOR brute force producing coincidental strings; require multiple corroborating hits.
54	- Reporting raw, live C2 endpoints without defanging.
55
56	## References
57
58	- See [`references/api-reference.md`](references/api-reference.md) for the hunter/decoder.
59	- ATT&CK T1140 and T1027 (linked in frontmatter).

People who liked this also viewed

6 picks

Type