reverse-engineering-android-malware-with-jadx

Featured

Reverse engineers malicious Android APK files using JADX decompiler to analyze Java/Kotlin source code, identify malicious functionality including data theft, C2 communication, privilege escalation, and overlay attacks. Examines manifest permissions, receivers, services, and native libraries. Activates for requests involving Android malware analysis, APK reverse engineering, mobile malware investigation, or Android threat analysis.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Reverse Engineering Android Malware with JADX ## When to Use - A suspicious Android APK has been reported as malicious or flagged by mobile threat detection - Analyzing Android banking trojans, spyware, SMS stealers, or adware samples - Determining what data an app collects, where it sends it, and what permissions it abuses - Extracting C2 server addresses, encryption keys, and configuration data from Android malware - Understanding overlay attack mechanisms used by banking trojans **Do not use** for analyzing obfuscated native (.so) libraries within APKs; use Ghidra or IDA for native ARM binary analysis. ## Prerequisites - JADX 1.5+ installed (download from https://github.com/skylot/jadx/releases) - Android SDK with `aapt2` and `adb` tools for APK inspection - apktool for full APK disassembly including smali code and resources - Python 3.8+ with `androguard` library for automated APK analysis - Frida for dynamic instrumentation (optional, for runtime analysis) - Isolated Android emulator (Genymotion or Android Studio AVD) without Google services ## Workflow ### Step 1: Extract APK Metadata and Permissions Examine the APK structure and AndroidManifest.xml: ```bash # Get APK basic info aapt2 dump badging malware.apk # Extract AndroidManifest.xml apktool d malware.apk -o apk_extracted/ -f # Analyze permissions with androguard python3 << 'PYEOF' from androguard.core.apk import APK apk = APK("malware.apk") print(f"Package: {apk.get_package()}") print(f"App Name:...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

6 Updated today
26zl
AI & Automation Solid

analyzing-android-malware-with-apktool

Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.

12,642 Updated today
mukul975
AI & Automation Featured

detecting-mobile-malware-behavior

Detects and analyzes malicious behavior in mobile applications through behavioral analysis, permission abuse detection, network traffic monitoring, and dynamic instrumentation. Use when analyzing suspicious mobile applications for data exfiltration, command-and-control communication, credential stealing, SMS interception, or other malware indicators. Activates for requests involving mobile malware analysis, app behavior monitoring, trojan detection, or suspicious app investigation.

12,642 Updated today
mukul975
Data & Documents Listed

jadx

Android APK decompiler that converts DEX bytecode to readable Java source code. Use when you need to decompile APK files, analyze app logic, search for vulnerabilities, find hardcoded credentials, or understand app behavior through readable source code.

335 Updated today
aiskillstore
AI & Automation Featured

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

12,642 Updated today
mukul975