[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZPTQJX6S7WF67E2Z7THPR":3,"skill-same:01M6GZPTQJX6S7WF67E2Z7THPR":87},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":55,"install":56,"resources":69},"01M6GZPTQJX6S7WF67E2Z7THPR","reverse-engineering-malware-with-ghidra",null,"Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.","micsapp\u002Fmicstec-skills","micsapp","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F82411001?v=4","01M6GWCFQ6D3PV8EHNY62NN5VW","01M6GWCFVE1PA5HG0DKC7AMFJ3",4,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"engineering","malware","ghidra","reverse","reverse engineering","with","reverse engineering malware with ghidra","decompilation","for","techniques","at","binary analysis","assembly","routines","evasion","analysis","disassembly","reverse-engineering","protocols","cybersecurity","2026-11-10 10:12:30",false,"---\nname: reverse-engineering-malware-with-ghidra\ndescription: >\n  Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to\n  understand internal logic, cryptographic routines, C2 protocols, and evasion techniques\n  at the assembly and pseudo-C level. Activates for requests involving malware reverse\n  engineering, disassembly analysis, decompilation, binary analysis, or understanding\n  malware internals.\ndomain: cybersecurity\nsubdomain: malware-analysis\ntags: [malware, reverse-engineering, Ghidra, disassembly, decompilation]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Reverse Engineering Malware with Ghidra\n\n## When to Use\n\n- Static and dynamic analysis have identified suspicious functionality that requires deeper code-level understanding\n- You need to reverse engineer C2 communication protocols, encryption algorithms, or custom obfuscation\n- Understanding the exact exploit mechanism or vulnerability targeted by a malware sample\n- Extracting hardcoded configuration data (C2 addresses, encryption keys, campaign IDs) embedded in compiled code\n- Developing precise YARA rules or detection signatures based on unique code patterns\n\n**Do not use** for initial triage of unknown samples; perform static analysis with PEStudio and behavioral analysis with Cuckoo first.\n\n## Prerequisites\n\n- Ghidra 11.x installed (download from https:\u002F\u002Fghidra-sre.org\u002F) with JDK 17+\n- Analysis VM isolated from production network (Windows or Linux host)\n- Familiarity with x86\u002Fx64 assembly language and Windows API conventions\n- PDB symbol files for Windows system DLLs to improve decompilation accuracy\n- Ghidra scripts repository (ghidra_scripts) for automated analysis tasks\n- Secondary reference: IDA Free or Binary Ninja for cross-validation of analysis results\n\n## Workflow\n\n### Step 1: Create Project and Import Binary\n\nSet up a Ghidra project and import the malware sample:\n\n```\n1. Launch Ghidra: ghidraRun (Linux) or ghidraRun.bat (Windows)\n2. File -> New Project -> Non-Shared Project -> Select directory\n3. File -> Import File -> Select malware binary\n4. Ghidra auto-detects format (PE, ELF, Mach-O) and architecture\n5. Accept default import options (or specify base address if known)\n6. Double-click imported file to open in CodeBrowser\n7. When prompted, run Auto Analysis with default analyzers enabled\n```\n\n**Headless analysis for automation:**\n```bash\n# Run Ghidra headless analysis with decompiler\n\u002Fopt\u002Fghidra\u002Fsupport\u002FanalyzeHeadless \u002Ftmp\u002Fghidra_project MalwareProject \\\n  -import suspect.exe \\\n  -postScript ExportDecompilation.py \\\n  -scriptPath \u002Fopt\u002Fghidra\u002Fscripts\u002F \\\n  -deleteProject\n```\n\n### Step 2: Identify Key Functions and Entry Points\n\nNavigate the binary to locate critical code sections:\n\n```\nNavigation Strategy:\n━━━━━━━━━━━━━━━━━━━\n1. Start at entry point (OEP) - follow execution from _start\u002FWinMain\n2. Check Symbol Tree for imported functions (Window -> Symbol Tree)\n3. Search for cross-references to suspicious APIs:\n   - VirtualAlloc\u002FVirtualAllocEx (memory allocation for injection)\n   - CreateRemoteThread (remote thread injection)\n   - CryptEncrypt\u002FCryptDecrypt (encryption operations)\n   - InternetOpen\u002FHttpSendRequest (C2 communication)\n   - RegSetValueEx (persistence via registry)\n4. Use Search -> For Strings to find embedded URLs, IPs, and paths\n5. Check the Functions window sorted by size (large functions often contain core logic)\n```\n\n**Ghidra keyboard shortcuts for efficient navigation:**\n```\nG         - Go to address\nCtrl+E    - Search for strings\nX         - Show cross-references to current location\nCtrl+Shift+F - Search memory for byte patterns\nL         - Rename label\u002Ffunction\n;         - Add comment\nT         - Retype variable\nCtrl+L    - Retype return value\n```\n\n### Step 3: Analyze Decompiled Code\n\nUse Ghidra's decompiler to understand function logic:\n\n```c\n\u002F\u002F Example: Ghidra decompiler output for a decryption routine\n\u002F\u002F Analyst renames variables and adds types for clarity\n\nvoid decrypt_config(BYTE *encrypted_data, int data_len, BYTE *key, int key_len) {\n    \u002F\u002F XOR decryption with rolling key\n    for (int i = 0; i \u003C data_len; i++) {\n        encrypted_data[i] = encrypted_data[i] ^ key[i % key_len];\n    }\n    return;\n}\n\n\u002F\u002F Analyst actions in Ghidra:\n\u002F\u002F 1. Right-click parameters -> Retype to correct types (BYTE*, int)\n\u002F\u002F 2. Right-click variables -> Rename to meaningful names\n\u002F\u002F 3. Add comments explaining the algorithm\n\u002F\u002F 4. Set function signature to propagate types to callers\n```\n\n### Step 4: Trace C2 Communication Logic\n\nFollow the network communication code path:\n\n```\nAnalysis Steps for C2 Protocol Reverse Engineering:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Find InternetOpenA\u002FWinHttpOpen call -> trace to wrapper function\n2. Follow data flow from encrypted config -> URL construction\n3. Identify HTTP method (GET\u002FPOST), headers, and body format\n4. Locate response parsing logic (JSON parsing, custom binary protocol)\n5. Map the C2 command dispatcher (switch\u002Fcase or jump table)\n6. Document the command set (download, execute, exfiltrate, update, uninstall)\n```\n\n**Ghidra Script for extracting C2 configuration:**\n```python\n# Ghidra Python script: extract_c2_config.py\n# Run via Script Manager in Ghidra\n\nfrom ghidra.program.model.data import StringDataType\nfrom ghidra.program.model.symbol import SourceType\n\n# Search for XOR decryption patterns\nlisting = currentProgram.getListing()\nmemory = currentProgram.getMemory()\n\n# Find references to InternetOpenA\nsymbol_table = currentProgram.getSymbolTable()\nfor symbol in symbol_table.getExternalSymbols():\n    if \"InternetOpen\" in symbol.getName():\n        refs = getReferencesTo(symbol.getAddress())\n        for ref in refs:\n            print(\"C2 init at: {}\".format(ref.getFromAddress()))\n```\n\n### Step 5: Analyze Encryption and Obfuscation\n\nIdentify and document cryptographic routines:\n\n```\nCommon Malware Encryption Patterns:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nXOR Cipher:     Loop with XOR operation, often single-byte or rolling key\nRC4:            Two loops (KSA + PRGA), 256-byte S-box initialization\nAES:            Look for S-box constants (0x63, 0x7C, 0x77...) or calls to CryptEncrypt\nBase64:         Lookup table with A-Za-z0-9+\u002F= characters\nCustom:         Combination of arithmetic operations (ADD, SUB, ROL, ROR with XOR)\n\nIdentification Tips:\n- Search for constants: AES S-box, CRC32 table, MD5 init values\n- Look for loop structures operating on byte arrays\n- Check for Windows Crypto API usage (CryptAcquireContext -> CryptCreateHash -> CryptEncrypt)\n- FindCrypt Ghidra plugin automatically identifies crypto constants\n```\n\n### Step 6: Document Findings and Create Detection Signatures\n\nProduce actionable intelligence from reverse engineering:\n\n```bash\n# Generate YARA rule from unique code patterns found in Ghidra\ncat \u003C\u003C 'EOF' > malware_family_x.yar\nrule MalwareFamilyX_Decryptor {\n    meta:\n        description = \"Detects MalwareX decryption routine\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n    strings:\n        \u002F\u002F XOR decryption loop with hardcoded key\n        $decrypt = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 }\n        \u002F\u002F C2 URL pattern after decryption\n        $c2_pattern = \"\u002Fgate.php?id=\" ascii\n    condition:\n        uint16(0) == 0x5A4D and $decrypt and $c2_pattern\n}\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Disassembly** | Converting machine code bytes into human-readable assembly language instructions; Ghidra's Listing view shows disassembled code |\n| **Decompilation** | Lifting assembly code to pseudo-C representation for easier analysis; Ghidra's Decompile window provides this view |\n| **Cross-Reference (XREF)** | Reference showing where a function or data address is called from or used; essential for tracing code execution flow |\n| **Control Flow Graph (CFG)** | Visual representation of all possible execution paths through a function; reveals branching logic and loops |\n| **Original Entry Point (OEP)** | The actual start address of the malware code after unpacking; packers redirect execution through an unpacking stub first |\n| **Function Signature** | The return type, name, and parameter types of a function; applying correct signatures improves decompiler output quality |\n| **Ghidra Script** | Python or Java automation script executed within Ghidra to perform batch analysis, pattern searching, or data extraction |\n\n## Tools & Systems\n\n- **Ghidra**: NSA's open-source software reverse engineering suite with disassembler, decompiler, and scripting support for multiple architectures\n- **IDA Pro\u002FFree**: Industry-standard interactive disassembler; IDA Free provides x86\u002Fx64 cloud-based decompilation\n- **Binary Ninja**: Commercial reverse engineering platform with modern UI and extensive API for plugin development\n- **x64dbg**: Open-source x64\u002Fx32 debugger for Windows used alongside Ghidra for dynamic debugging of malware\n- **FindCrypt (Ghidra Plugin)**: Plugin that identifies cryptographic constants and algorithms in binary code\n\n## Common Scenarios\n\n### Scenario: Reversing Custom C2 Protocol\n\n**Context**: Behavioral analysis shows encrypted traffic to an external IP on a non-standard port. Network signatures cannot detect variants because the protocol is proprietary. Deep reverse engineering is needed to understand the protocol structure.\n\n**Approach**:\n1. Import the unpacked sample into Ghidra and run full auto-analysis\n2. Locate socket\u002FWinHTTP API calls and trace backwards to the calling function\n3. Identify the encryption routine called before data is sent (follow data flow from send\u002FHttpSendRequest)\n4. Reverse the encryption (XOR key extraction, RC4 key derivation, AES key location)\n5. Map the command structure by analyzing the response parsing function (switch\u002Fcase on command IDs)\n6. Document the protocol format (header structure, command bytes, encryption method)\n7. Create a protocol decoder script for network monitoring tools\n\n**Pitfalls**:\n- Not running the full auto-analysis before starting manual analysis (missing function boundaries and type propagation)\n- Ignoring indirect calls through function pointers or vtables (use cross-references to data holding function addresses)\n- Spending time on library code that Ghidra's Function ID (FID) or FLIRT signatures should have identified\n- Not saving Ghidra project progress frequently (analysis state can be lost on crashes)\n\n## Output Format\n\n```\nREVERSE ENGINEERING ANALYSIS REPORT\n=====================================\nSample:           unpacked_payload.exe\nSHA-256:          abc123def456...\nArchitecture:     x86 (32-bit PE)\nGhidra Project:   MalwareX_Analysis\n\nFUNCTION MAP\n0x00401000  main()              - Entry point, initializes config\n0x00401200  decrypt_config()    - XOR decryption with 16-byte key\n0x00401400  init_c2()           - WinHTTP initialization, URL construction\n0x00401800  c2_beacon()         - HTTP POST beacon with system info\n0x00401C00  cmd_dispatcher()    - Switch on 12 command codes\n0x00402000  inject_process()    - Process hollowing into svchost.exe\n0x00402400  persist_registry()  - HKCU Run key persistence\n0x00402800  exfil_data()        - File collection and encrypted upload\n\nC2 PROTOCOL\nMethod:           HTTPS POST to \u002Fgate.php\nEncryption:       RC4 with derived key (MD5 of bot_id + campaign_key)\nBot ID Format:    MD5(hostname + username + volume_serial)\nBeacon Interval:  60 seconds with 10% jitter\nCommand Set:\n  0x01 - Download and execute file\n  0x02 - Execute shell command\n  0x03 - Upload file to C2\n  0x04 - Update configuration\n  0x05 - Uninstall and remove traces\n\nENCRYPTION DETAILS\nAlgorithm:        RC4\nKey Derivation:   MD5(bot_id + \"campaign_2025_q3\")\nHardcoded Seed:   \"campaign_2025_q3\" at offset 0x00405A00\n\nEXTRACTED IOCs\nC2 URLs:          hxxps:\u002F\u002Fupdate.malicious[.]com\u002Fgate.php\n                  hxxps:\u002F\u002Fbackup.evil[.]net\u002Fgate.php (failover)\nCampaign ID:      campaign_2025_q3\nRC4 Key Material: [see encryption details above]\n```\n","# Reverse Engineering Malware with Ghidra\n\n## When to Use\n\n- Static and dynamic analysis have identified suspicious functionality that requires deeper code-level understanding\n- You need to reverse engineer C2 communication protocols, encryption algorithms, or custom obfuscation\n- Understanding the exact exploit mechanism or vulnerability targeted by a malware sample\n- Extracting hardcoded configuration data (C2 addresses, encryption keys, campaign IDs) embedded in compiled code\n- Developing precise YARA rules or detection signatures based on unique code patterns\n\n**Do not use** for initial triage of unknown samples; perform static analysis with PEStudio and behavioral analysis with Cuckoo first.\n\n## Prerequisites\n\n- Ghidra 11.x installed (download from https:\u002F\u002Fghidra-sre.org\u002F) with JDK 17+\n- Analysis VM isolated from production network (Windows or Linux host)\n- Familiarity with x86\u002Fx64 assembly language and Windows API conventions\n- PDB symbol files for Windows system DLLs to improve decompilation accuracy\n- Ghidra scripts repository (ghidra_scripts) for automated analysis tasks\n- Secondary reference: IDA Free or Binary Ninja for cross-validation of analysis results\n\n## Workflow\n\n### Step 1: Create Project and Import Binary\n\nSet up a Ghidra project and import the malware sample:\n\n```\n1. Launch Ghidra: ghidraRun (Linux) or ghidraRun.bat (Windows)\n2. File -> New Project -> Non-Shared Project -> Select directory\n3. File -> Import File -> Select malware binary\n4. Ghidra auto-detects format (PE, ELF, Mach-O) and architecture\n5. Accept default import options (or specify base address if known)\n6. Double-click imported file to open in CodeBrowser\n7. When prompted, run Auto Analysis with default analyzers enabled\n```\n\n**Headless analysis for automation:**\n```bash\n# Run Ghidra headless analysis with decompiler\n\u002Fopt\u002Fghidra\u002Fsupport\u002FanalyzeHeadless \u002Ftmp\u002Fghidra_project MalwareProject \\\n  -import suspect.exe \\\n  -postScript ExportDecompilation.py \\\n  -scriptPath \u002Fopt\u002Fghidra\u002Fscripts\u002F \\\n  -deleteProject\n```\n\n### Step 2: Identify Key Functions and Entry Points\n\nNavigate the binary to locate critical code sections:\n\n```\nNavigation Strategy:\n━━━━━━━━━━━━━━━━━━━\n1. Start at entry point (OEP) - follow execution from _start\u002FWinMain\n2. Check Symbol Tree for imported functions (Window -> Symbol Tree)\n3. Search for cross-references to suspicious APIs:\n   - VirtualAlloc\u002FVirtualAllocEx (memory allocation for injection)\n   - CreateRemoteThread (remote thread injection)\n   - CryptEncrypt\u002FCryptDecrypt (encryption operations)\n   - InternetOpen\u002FHttpSendRequest (C2 communication)\n   - RegSetValueEx (persistence via registry)\n4. Use Search -> For Strings to find embedded URLs, IPs, and paths\n5. Check the Functions window sorted by size (large functions often contain core logic)\n```\n\n**Ghidra keyboard shortcuts for efficient navigation:**\n```\nG         - Go to address\nCtrl+E    - Search for strings\nX         - Show cross-references to current location\nCtrl+Shift+F - Search memory for byte patterns\nL         - Rename label\u002Ffunction\n;         - Add comment\nT         - Retype variable\nCtrl+L    - Retype return value\n```\n\n### Step 3: Analyze Decompiled Code\n\nUse Ghidra's decompiler to understand function logic:\n\n```c\n\u002F\u002F Example: Ghidra decompiler output for a decryption routine\n\u002F\u002F Analyst renames variables and adds types for clarity\n\nvoid decrypt_config(BYTE *encrypted_data, int data_len, BYTE *key, int key_len) {\n    \u002F\u002F XOR decryption with rolling key\n    for (int i = 0; i \u003C data_len; i++) {\n        encrypted_data[i] = encrypted_data[i] ^ key[i % key_len];\n    }\n    return;\n}\n\n\u002F\u002F Analyst actions in Ghidra:\n\u002F\u002F 1. Right-click parameters -> Retype to correct types (BYTE*, int)\n\u002F\u002F 2. Right-click variables -> Rename to meaningful names\n\u002F\u002F 3. Add comments explaining the algorithm\n\u002F\u002F 4. Set function signature to propagate types to callers\n```\n\n### Step 4: Trace C2 Communication Logic\n\nFollow the network communication code path:\n\n```\nAnalysis Steps for C2 Protocol Reverse Engineering:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n1. Find InternetOpenA\u002FWinHttpOpen call -> trace to wrapper function\n2. Follow data flow from encrypted config -> URL construction\n3. Identify HTTP method (GET\u002FPOST), headers, and body format\n4. Locate response parsing logic (JSON parsing, custom binary protocol)\n5. Map the C2 command dispatcher (switch\u002Fcase or jump table)\n6. Document the command set (download, execute, exfiltrate, update, uninstall)\n```\n\n**Ghidra Script for extracting C2 configuration:**\n```python\n# Ghidra Python script: extract_c2_config.py\n# Run via Script Manager in Ghidra\n\nfrom ghidra.program.model.data import StringDataType\nfrom ghidra.program.model.symbol import SourceType\n\n# Search for XOR decryption patterns\nlisting = currentProgram.getListing()\nmemory = currentProgram.getMemory()\n\n# Find references to InternetOpenA\nsymbol_table = currentProgram.getSymbolTable()\nfor symbol in symbol_table.getExternalSymbols():\n    if \"InternetOpen\" in symbol.getName():\n        refs = getReferencesTo(symbol.getAddress())\n        for ref in refs:\n            print(\"C2 init at: {}\".format(ref.getFromAddress()))\n```\n\n### Step 5: Analyze Encryption and Obfuscation\n\nIdentify and document cryptographic routines:\n\n```\nCommon Malware Encryption Patterns:\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nXOR Cipher:     Loop with XOR operation, often single-byte or rolling key\nRC4:            Two loops (KSA + PRGA), 256-byte S-box initialization\nAES:            Look for S-box constants (0x63, 0x7C, 0x77...) or calls to CryptEncrypt\nBase64:         Lookup table with A-Za-z0-9+\u002F= characters\nCustom:         Combination of arithmetic operations (ADD, SUB, ROL, ROR with XOR)\n\nIdentification Tips:\n- Search for constants: AES S-box, CRC32 table, MD5 init values\n- Look for loop structures operating on byte arrays\n- Check for Windows Crypto API usage (CryptAcquireContext -> CryptCreateHash -> CryptEncrypt)\n- FindCrypt Ghidra plugin automatically identifies crypto constants\n```\n\n### Step 6: Document Findings and Create Detection Signatures\n\nProduce actionable intelligence from reverse engineering:\n\n```bash\n# Generate YARA rule from unique code patterns found in Ghidra\ncat \u003C\u003C 'EOF' > malware_family_x.yar\nrule MalwareFamilyX_Decryptor {\n    meta:\n        description = \"Detects MalwareX decryption routine\"\n        author = \"analyst\"\n        date = \"2025-09-15\"\n    strings:\n        \u002F\u002F XOR decryption loop with hardcoded key\n        $decrypt = { 8A 04 0E 32 04 0F 88 04 0E 41 3B CA 7C F3 }\n        \u002F\u002F C2 URL pattern after decryption\n        $c2_pattern = \"\u002Fgate.php?id=\" ascii\n    condition:\n        uint16(0) == 0x5A4D and $decrypt and $c2_pattern\n}\nEOF\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Disassembly** | Converting machine code bytes into human-readable assembly language instructions; Ghidra's Listing view shows disassembled code |\n| **Decompilation** | Lifting assembly code to pseudo-C representation for easier analysis; Ghidra's Decompile window provides this view |\n| **Cross-Reference (XREF)** | Reference showing where a function or data address is called from or used; essential for tracing code execution flow |\n| **Control Flow Graph (CFG)** | Visual representation of all possible execution paths through a function; reveals branching logic and loops |\n| **Original Entry Point (OEP)** | The actual start address of the malware code after unpacking; packers redirect execution through an unpacking stub first |\n| **Function Signature** | The return type, name, and parameter types of a function; applying correct signatures improves decompiler output quality |\n| **Ghidra Script** | Python or Java automation script executed within Ghidra to perform batch analysis, pattern searching, or data extraction |\n\n## Tools & Systems\n\n- **Ghidra**: NSA's open-source software reverse engineering suite with disassembler, decompiler, and scripting support for multiple architectures\n- **IDA Pro\u002FFree**: Industry-standard interactive disassembler; IDA Free provides x86\u002Fx64 cloud-based decompilation\n- **Binary Ninja**: Commercial reverse engineering platform with modern UI and extensive API for plugin development\n- **x64dbg**: Open-source x64\u002Fx32 debugger for Windows used alongside Ghidra for dynamic debugging of malware\n- **FindCrypt (Ghidra Plugin)**: Plugin that identifies cryptographic constants and algorithms in binary code\n\n## Common Scenarios\n\n### Scenario: Reversing Custom C2 Protocol\n\n**Context**: Behavioral analysis shows encrypted traffic to an external IP on a non-standard port. Network signatures cannot detect variants because the protocol is proprietary. Deep reverse engineering is needed to understand the protocol structure.\n\n**Approach**:\n1. Import the unpacked sample into Ghidra and run full auto-analysis\n2. Locate socket\u002FWinHTTP API calls and trace backwards to the calling function\n3. Identify the encryption routine called before data is sent (follow data flow from send\u002FHttpSendRequest)\n4. Reverse the encryption (XOR key extraction, RC4 key derivation, AES key location)\n5. Map the command structure by analyzing the response parsing function (switch\u002Fcase on command IDs)\n6. Document the protocol format (header structure, command bytes, encryption method)\n7. Create a protocol decoder script for network monitoring tools\n\n**Pitfalls**:\n- Not running the full auto-analysis before starting manual analysis (missing function boundaries and type propagation)\n- Ignoring indirect calls through function pointers or vtables (use cross-references to data holding function addresses)\n- Spending time on library code that Ghidra's Function ID (FID) or FLIRT signatures should have identified\n- Not saving Ghidra project progress frequently (analysis state can be lost on crashes)\n\n## Output Format\n\n```\nREVERSE ENGINEERING ANALYSIS REPORT\n=====================================\nSample:           unpacked_payload.exe\nSHA-256:          abc123def456...\nArchitecture:     x86 (32-bit PE)\nGhidra Project:   MalwareX_Analysis\n\nFUNCTION MAP\n0x00401000  main()              - Entry point, initializes config\n0x00401200  decrypt_config()    - XOR decryption with 16-byte key\n0x00401400  init_c2()           - WinHTTP initialization, URL construction\n0x00401800  c2_beacon()         - HTTP POST beacon with system info\n0x00401C00  cmd_dispatcher()    - Switch on 12 command codes\n0x00402000  inject_process()    - Process hollowing into svchost.exe\n0x00402400  persist_registry()  - HKCU Run key persistence\n0x00402800  exfil_data()        - File collection and encrypted upload\n\nC2 PROTOCOL\nMethod:           HTTPS POST to \u002Fgate.php\nEncryption:       RC4 with derived key (MD5 of bot_id + campaign_key)\nBot ID Format:    MD5(hostname + username + volume_serial)\nBeacon Interval:  60 seconds with 10% jitter\nCommand Set:\n  0x01 - Download and execute file\n  0x02 - Execute shell command\n  0x03 - Upload file to C2\n  0x04 - Update configuration\n  0x05 - Uninstall and remove traces\n\nENCRYPTION DETAILS\nAlgorithm:        RC4\nKey Derivation:   MD5(bot_id + \"campaign_2025_q3\")\nHardcoded Seed:   \"campaign_2025_q3\" at offset 0x00405A00\n\nEXTRACTED IOCs\nC2 URLs:          hxxps:\u002F\u002Fupdate.malicious[.]com\u002Fgate.php\n                  hxxps:\u002F\u002Fbackup.evil[.]net\u002Fgate.php (failover)\nCampaign ID:      campaign_2025_q3\nRC4 Key Material: [see encryption details above]\n```\n",{"name":5,"tags":43,"author":45,"domain":37,"license":14,"version":46,"subdomain":47,"description":48},[19,35,44,34,25],"Ghidra","mahipal","1.0.0","malware-analysis","Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.\n","master","3f5d983eb4ef375b749adcd6b07ec03bd82ae8a8","_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra",0,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills","https:\u002F\u002Fgithub.com\u002Fmicsapp","2026-03-20 11:24:18",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add micsapp\u002Fmicstec-skills --skill reverse-engineering-malware-with-ghidra",{"tool":62,"command":63},"bunx","bunx skills add micsapp\u002Fmicstec-skills --skill reverse-engineering-malware-with-ghidra",{"tool":65,"command":66},"pnpm","pnpm dlx skills add micsapp\u002Fmicstec-skills --skill reverse-engineering-malware-with-ghidra","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002FSKILL.md",true,[70,75,81],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002FLICENSE",{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"references\u002Fapi-reference.md","REFERENCE","参考文档",2658,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002Freferences\u002Fapi-reference.md",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"scripts\u002Fagent.py","SCRIPT","脚本",8433,"https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002F_universal\u002Fcybersecurity-skills\u002Fskills\u002Freverse-engineering-malware-with-ghidra\u002Fscripts\u002Fagent.py",[88,125,155,176,196,221],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":93,"categories":94,"keywords":105,"publishedAt":38},"01M6HBTJ02FXBFG9NYEHHYAP52","azure-apim-architecture","Analyzes and explains Azure API Management architecture decisions for enterprise API marketplace implementations using VNet Internal mode, Front Door, hybrid authentication, and multi-environment strategies. Use when discussing APIM component selection, network topology, cost optimization, or comparing alternatives like workspaces vs instances, VNet Internal vs External mode, or Front Door vs Application Gateway.","MIT","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fazure-apim-architecture\u002FSKILL.md",[95,100],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,26],"architecture","azure","azure apim architecture","component","authentication","gateway","topology","Optimization","network","api","team","environment","multi-environment","workspaces","instances","selection","strategies","azure api management","mode",{"skillNo":126,"name":127,"nameZh":6,"description":128,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":129,"categories":130,"keywords":139,"publishedAt":38},"01M6HBT7J4H082JEEA670B3EQ9","apiops-deployment","Guides deployment of Azure API Management infrastructure using Infrastructure as Code (Bicep\u002FTerraform), CI\u002FCD pipelines (GitHub Actions\u002FAzure DevOps), and APIOps workflows. Use when deploying APIM, creating pipelines, or implementing dev→test→prod promotion strategies.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapiops-deployment\u002FSKILL.md",[131,132,135,138],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":133,"categoryName":134,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":136,"categoryName":137,"taxonomyType":98,"taxonomyTypeDesc":99},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[140,141,142,143,107,144,145,146,147,148,149,150,115,116,122,151,152,123,153,154],"deployment","apiops deployment","workflows","azure devops","infrastructure","code","infrastructure as code","actions","ci","github actions","github-actions","as","guides","CI\u002FCD","implementing",{"skillNo":156,"name":157,"nameZh":6,"description":158,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":162,"publishedAt":38},"01M6HBT2HEA23THNE9E00GYQBE","apim-policy-authoring","Creates production-ready Azure API Management policy XML for authentication (OAuth 2.0, JWT validation, subscription keys), rate limiting, CORS configuration, error handling, and API transformations. Use when implementing API security, access control, or request\u002Fresponse processing logic.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapim-policy-authoring\u002FSKILL.md",[161],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},[163,164,165,166,107,110,115,116,167,168,169,170,171,172,173,123,174,175,154,26],"policy","authoring","apim policy authoring","security","access","use","ready","api security","Access Control","error","processing","cors configuration","production-ready",{"skillNo":177,"name":178,"nameZh":6,"description":179,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":180,"categories":181,"keywords":184,"publishedAt":38},"01M6HBSY65SB29J9WE9KYD0K6T","api-security-review","Reviews Azure API Management configurations for security vulnerabilities, OWASP API Security Top 10 compliance, VNet Internal mode validation, Private Link verification, and Azure Security Benchmark alignment. Use when performing security audits, pre-deployment validation, or compliance reviews.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fcopilot-agent-skills\u002F.github\u002Fskills\u002Fapi-security-review\u002FSKILL.md",[182,183],{"categoryNo":96,"categoryName":97,"taxonomyType":98,"taxonomyTypeDesc":99},{"categoryNo":101,"categoryName":102,"taxonomyType":103,"taxonomyTypeDesc":104},[185,166,186,115,170,187,107,140,188,189,190,191,116,192,123,193,194,195,124,26],"review","security review","api security review","benchmark","verification","owasp","owasp-api","alignment","azure security","reviews","top",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":38},"01M6HBSRW4PDFE6K4F8JYPZQ05","jira-cli","Interact with Jira from the command line to create, list, view, edit, and transition issues, manage sprints and epics, and perform common Jira workflows. Use when the user asks about Jira tasks, tickets, issues, sprints, or needs to manage project work items.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fjira-cli\u002FSKILL.md",[],[203,204,205,142,206,207,208,209,115,210,211,212,213,214,215,216,217,218,219,220],"cli","jira","jira cli","init","tasks","create","issues","common","work","command","edit","list","view","project","project work","token","line","sprints",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":92,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":38},"01M6HBSNS3JHMW603G47TWE31H","calculator","Performs arbitrary-precision arithmetic calculations including addition, subtraction, multiplication, division, and exponents. Use when the user asks to calculate, compute, or evaluate math expressions, or when precise decimal arithmetic is needed to avoid floating-point errors.","https:\u002F\u002Fgithub.com\u002Fmicsapp\u002Fmicstec-skills\u002Fblob\u002Fmaster\u002Fcopilot-cli\u002Fawesome-copilot-agents\u002Fskills\u002Fcalculator\u002FSKILL.md",[],[223,228,229,230,231,232,233,168,234,235],"npm","js","calculate","node","math","user","compute","errors"]