Статический анализ вредоносных APK-файлов

★ 8.4 · security

analyzing-android-malware-with-apktool is a Claude Code skill that performs static triage of malicious Android APK files without executing them, combining apktool for resource decompilation, jadx for Java source recovery, and androguard for programmatic manifest inspection. It enumerates requested permissions and flags dangerous combinations, lists activities, services, broadcast receivers, and content providers, and identifies obfuscated code, dynamic class loading (DexClassLoader, Runtime.exec), and reflection-based API calls. Hardcoded URLs, IP addresses, and C2 indicators are extracted from strings. The skill outputs a JSON report with a risk score, MITRE ATT&CK Mobile mappings, and a list of IOCs — making it practical for SOC analysts triaging suspicious APKs or building mobile malware detection rules.