Skill Market

analyzing android malware with apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source

GitHub
githubcommunityai-agentsclaude-codecloud-securitycybersecuritydevsecopsethical-hacking
0.0
0 installs33.4K GitHub starsby mukul975

Skill Introduction

Overview
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source

Core value

Turns reusable Development know-how into an installable skill, helping users complete github, community, ai-agents, claude-code work faster.

Target users

  • Developers, testers, and maintainers who handle Development tasks in Focus Code.
  • Teams that already trust workflows or content from mukul975.
  • Users who want standardized prompts, steps, or conventions instead of repeating setup work.

Best practices

  • Read the skill content first to confirm required inputs, expected outputs, and dependencies.
  • Try it on a small task before relying on it for critical work.
  • Add project-specific constraints such as coding style, target platform, test expectations, and delivery format.
  • For external sources, verify the source link, version, and recent maintenance activity.

Best use cases

  • Tasks related to github, community, ai-agents, claude-code that need a reusable execution flow.
  • Converting a community repo, team convention, or personal workflow into day-to-day assistance.
  • Starting from a proven skill instead of writing prompts or procedures from scratch.

Limits and boundaries

  • Results depend on the quality of the original skill content and may need human correction.
  • It does not replace code review, tests, security review, or professional judgment.
  • External tools, APIs, account permissions, and local dependencies still need separate setup.

Differentiation

  • Structured around Development, making it easier to discover and reuse than loose prompt snippets.
  • Marked as GitHub, which helps users judge trust and maintenance expectations.
  • Keeps the original source link available for repository, documentation, or discussion follow-up.
  • Tagged with github, community, ai-agents, claude-code, so it can be filtered by concrete task intent.

Install and use

Install
Copy Install Command
focus install analyzing-android-malware-with-apktool-a57e8f
View source

Detail Preview

SKILL.md

Primary filemarkdown3 KB

name: analyzing-android-malware-with-apktool description: Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection. domain: cybersecurity subdomain: malware-analysis tags:

  • Android
  • APK
  • apktool
  • jadx
  • androguard
  • mobile-malware
  • static-analysis
  • reverse-engineering version: '1.0' author: mahipal license: Apache-2.0 nist_csf:
  • DE.AE-02
  • RS.AN-03
  • ID.RA-01
  • DE.CM-01

Analyzing Android Malware with Apktool

Overview

Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.

When to Use

  • When investigating security incidents that require analyzing android malware with apktool
  • When building detection rules or threat hunting queries for this domain
  • When SOC analysts need structured procedures for this analysis type
  • When validating security monitoring coverage for related attack techniques

Prerequisites

  • Python 3.9+ with androguard
  • apktool (for resource decompilation)
  • jadx (for Java source recovery, optional)
  • Isolated analysis environment (VM or sandbox)
  • Sample APK files for analysis

Steps

  1. Parse APK with androguard to extract manifest metadata
  2. Enumerate requested permissions and flag dangerous combinations
  3. List activities, services, receivers, and providers from manifest
  4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)
  5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)
  6. Extract hardcoded URLs, IPs, and C2 indicators from strings
  7. Generate risk assessment report with MITRE ATT&CK mobile mappings

Expected Output

  • JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score
  • Extracted strings and potential IOCs from the APK

Reviews

Overall rating

0.0
0.0

0 comments

No reviews yet