Analyzing Android Malware
FreeStatic analysis of Android APKs for malware detection.
Free · Opens the source repo
What Analyzing Android Malware does
This skill provides a comprehensive solution for static analysis of Android APK files, enabling users to investigate potential malware without executing the application. By leveraging tools like apktool, jadx, and androguard, it extracts critical information such as permissions, activities, services, and suspicious API calls. This is particularly useful for security professionals, incident responders, and SOC analysts who need to triage APKs and build detection rules based on the findings.
The skill operates by parsing APK files to gather manifest metadata, which includes enumerating requested permissions and flagging dangerous combinations. It also identifies obfuscated code patterns and dynamic code loading techniques, which are common indicators of malicious behavior. The output is a structured JSON report that includes a risk assessment based on the MITRE ATT&CK framework, helping analysts understand the threat landscape and improve their security monitoring capabilities.
Designed for use in isolated environments such as virtual machines or sandboxes, this skill requires a Python 3.9+ setup with necessary dependencies like androguard, apktool, and optionally jadx. It is a valuable addition to any security toolkit, allowing for efficient analysis of suspicious APKs without the risks associated with executing potentially harmful software.
Whether you are building detection rules, conducting threat hunting, or validating security measures against mobile threats, this skill provides the foundational capabilities needed for effective analysis and response.
When to use it
Use this skill when you need to analyze APK files for potential malware or when developing detection rules for mobile threats.
When not to use it
This skill is not suitable for dynamic analysis or when execution of the APK is required for testing behavior.
What you can build with it
Investigating Security Incidents
Use this skill to analyze suspicious APKs during security investigations, identifying potential threats without executing the files.
Building Detection Rules
Leverage the insights gained from the analysis to create effective detection rules for mobile malware in your security systems.
Validating Security Coverage
Utilize this skill to assess and validate your security monitoring coverage against known mobile attack techniques.
How to install Analyzing Android Malware
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/analyzing-android-malware-with-apktool --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Analyzing Android Malware with Apktool
Overview
Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.
When to Use
- When investigating security incidents that require analyzing android malware with apktool
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Python 3.9+ with
androguard - apktool (for resource decompilation)
- jadx (for Java source recovery, optional)
- Isolated analysis environment (VM or sandbox)
- Sample APK files for analysis
Steps
- Parse APK with androguard to extract manifest metadata
- Enumerate requested permissions and flag dangerous combinations
- List activities, services, receivers, and providers from manifest
- Scan for suspicious API calls (reflection, crypto, SMS, telephony)
- Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)
- Extract hardcoded URLs, IPs, and C2 indicators from strings
- Generate risk assessment report with MITRE ATT&CK mobile mappings
Expected Output
- JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score
- Extracted strings and potential IOCs from the APK
Frequently asked questions about Analyzing Android Malware
Similar skills
GitHub Actions Hardening
Enhance the security of your GitHub Actions workflows.
Sensitive Logging Audit
Audit and fix sensitive data exposure in Python logging.
Android App Static Analysis
Automate security assessments of Android apps with MobSF.
Integrating DAST with OWASP ZAP
Seamlessly integrate dynamic security testing into CI/CD pipelines.
Implementing Runtime Security with Tetragon
Enhance Kubernetes security with eBPF-based observability.
Implementing Mobile Application Management
Secure enterprise data on mobile devices with app-level controls.