ワンクリックでManusで任意のスキルを実行

analyzing-android-malware-with-apktool

スター1

フォーク0

更新日2026年6月11日 20:28

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

インストール

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

Manusで実行

ソース

b3belov

b3belov/security-superpowers

GitHub リポジトリを開く Creator のリポジトリを見る

ダウンロード

Manusで実行

Analyzing Android Malware with Apktool

Overview

Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.

When to Use

When investigating security incidents that require analyzing android malware with apktool
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with androguard
apktool (for resource decompilation)
jadx (for Java source recovery, optional)
Isolated analysis environment (VM or sandbox)
Sample APK files for analysis

Steps

Parse APK with androguard to extract manifest metadata
Enumerate requested permissions and flag dangerous combinations
List activities, services, receivers, and providers from manifest
Scan for suspicious API calls (reflection, crypto, SMS, telephony)
Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)
Extract hardcoded URLs, IPs, and C2 indicators from strings
Generate risk assessment report with MITRE ATT&CK mobile mappings

Expected Output

JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score
Extracted strings and potential IOCs from the APK

このリポジトリの他の Skills

同じリポジトリ

acquiring-disk-image-with-dd-and-dcfldd

b3belov/security-superpowers

Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through hash verification.

2026-06-111

analyzing-active-directory-acl-abuse

b3belov/security-superpowers

Detect dangerous ACL misconfigurations in Active Directory using ldap3 to identify GenericAll, WriteDACL, and WriteOwner abuse paths

2026-06-111

analyzing-api-gateway-access-logs

b3belov/security-superpowers

Parses API Gateway access logs (AWS API Gateway, Kong, Nginx) to detect BOLA/IDOR attacks, rate limit bypass, credential scanning, and injection attempts. Uses pandas for statistical analysis of request patterns and anomaly detection. Use when investigating API abuse or building API-specific threat detection rules.

2026-06-111

analyzing-apt-group-with-mitre-navigator

b3belov/security-superpowers

Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps of adversary TTPs for detection gap analysis and threat-informed defense.

2026-06-111

analyzing-azure-activity-logs-for-threats

b3belov/security-superpowers

Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative operations, impossible travel, privilege escalation, and resource modifications. Builds KQL queries for threat hunting in Azure environments. Use when investigating suspicious Azure tenant activity or building cloud SIEM detections.

2026-06-111

analyzing-bootkit-and-rootkit-samples

b3belov/security-superpowers

Analyzes bootkit and advanced rootkit malware that infects the Master Boot Record (MBR), Volume Boot Record (VBR), or UEFI firmware to gain persistence below the operating system. Covers boot sector analysis, UEFI module inspection, and anti-rootkit detection techniques. Activates for requests involving bootkit analysis, MBR malware investigation, UEFI persistence analysis, or pre-OS malware detection.

2026-06-111

name	analyzing-android-malware-with-apktool
description	Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.
license	Apache-2.0
metadata	{"domain":"cybersecurity","subdomain":"malware-analysis","tags":["Android","APK","apktool","jadx","androguard","mobile-malware","static-analysis","reverse-engineering"],"version":"1.0","author":"mahipal","nist_csf":["DE.AE-02","RS.AN-03","ID.RA-01","DE.CM-01"],"mitre_attack":["T1406","T1407","T1626.001","T1655.001","T1521.001"]}

Analyzing Android Malware with Apktool

Overview

When to Use

When investigating security incidents that require analyzing android malware with apktool
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Python 3.9+ with androguard
apktool (for resource decompilation)
jadx (for Java source recovery, optional)
Isolated analysis environment (VM or sandbox)
Sample APK files for analysis

Steps

Parse APK with androguard to extract manifest metadata
Enumerate requested permissions and flag dangerous combinations
List activities, services, receivers, and providers from manifest
Scan for suspicious API calls (reflection, crypto, SMS, telephony)
Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)
Extract hardcoded URLs, IPs, and C2 indicators from strings
Generate risk assessment report with MITRE ATT&CK mobile mappings

Expected Output

JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score
Extracted strings and potential IOCs from the APK