SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-android-dex-malware
0
Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Android DEX Malware ## When to Use - You have a suspicious `.apk` (or bare `.dex`) and need to understand its behavior. - You need to audit the manifest for dangerous permissions, exported components, and the declared entry points. - The app loads code dynamically (`DexClassLoader`) or ships a native `.so` you must locate. **Do not use** this workflow for iOS apps — DEX/APK tooling does not apply to Mach-O/IPA. ## Prerequisites - jadx (or apktool + a decompiler) and `unzip`; an Android emulator/sandbox for dynamic runs. - `aapt`/manifest parsing for permissions and components. ## Workflow ### Step 1: Unpack the APK An APK is a ZIP. Extract and inventory the DEX files, native libraries, and assets: ```bash python scripts/analyst.py inspect sample.apk ``` ```text dex : classes.dex, classes2.dex native : lib/arm64-v8a/libpayload.so assets : assets/config.enc (possible encrypted payload) manifest : AndroidManifest.xml (binary) ``` ### Step 2: Audit the manifest Decode `AndroidManifest.xml` and review requested permissions (SMS, accessibility, device admin, `REQUEST_INSTALL_PACKAGES`), exported components, and the launcher/`BOOT_COMPLETED` receivers. ### Step 3: Decompile DEX Run jadx to recover Java. Start at the launcher activity and any `BroadcastReceiver`/`Service` declared in the manifest. ### Step 4: Find dynamic and native code Search for `DexClassLoader`/`loadDex`, asset decryption, and `System.loadLibrary`. Dump and recurse on dynamically loaded DEX; analyze native `.so` separately if needed. ### Step 5: Extract behavior and IOCs Recover C2 URLs, overlay/accessibility abuse, SMS interception, and config; map to ATT&CK for mobile in the report. ## Validation - Every DEX and native library in the APK is accounted for. - Dangerous permissions are tied to concrete code paths (not just declared). - Dynamically loaded payloads are dumped and analyzed, not just noted. ## Pitfalls - Reading only `classes.dex` and missing `classes2.dex`/`classes3.dex`. - Trusting the manifest alone; behavior may hide behind dynamic loading. - Ignoring encrypted assets that become the real payload at runtime. ## References - See [`references/api-reference.md`](references/api-reference.md) for the APK inspector. - Android DEX format and jadx (linked in frontmatter).