detecting-mobile-malware-behavior

Featured

Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Detecting Mobile Malware Behavior ## When to Use Use this skill when: - Analyzing suspicious mobile applications submitted by users or discovered during incident response - Monitoring enterprise mobile fleet for malicious app indicators - Performing malware triage on APK/IPA samples - Investigating data exfiltration or unauthorized device access from mobile apps **Do not use** this skill to create, enhance, or distribute malware. This skill is for defensive analysis only. ## Prerequisites - Isolated analysis environment (dedicated device or emulator, not connected to production networks) - MobSF for automated static+dynamic analysis - Frida/Objection for runtime behavior monitoring - Wireshark/tcpdump for network traffic capture - Android emulator (AVD) or Genymotion for safe execution - VirusTotal API key for hash lookups ## Workflow ### Step 1: Static Indicator Analysis ```bash # Hash the sample sha256sum suspicious.apk # Check VirusTotal curl -s "https://www.virustotal.com/api/v3/files/<SHA256>" \ -H "x-apikey: <VT_API_KEY>" | jq '.data.attributes.last_analysis_stats' # Extract permissions from AndroidManifest.xml aapt dump permissions suspicious.apk # High-risk permission combinations: # READ_SMS + INTERNET = SMS stealer # RECEIVE_SMS + SEND_SMS = SMS interceptor/banker trojan # ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability # CAMERA + RECORD_AUDIO + INTERNET = spyware # DEVICE_ADMIN + INTERNET = ransomware capability # READ_CONTACTS + INTERNE...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Solid

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

12,642 Updated today
mukul975
AI & Automation Listed

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

6 Updated today
26zl
AI & Automation Featured

reverse-engineering-android-malware-with-jadx

Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse engineering, mobile malware investigation, or Android threat analysis.

12,642 Updated today
mukul975
AI & Automation Featured

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.

39,227 Updated today
sickn33
Data & Documents Listed

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

335 Updated today
aiskillstore