What it does. Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill analyzing-android-malware-with-apktool, or copy the skill folder into ~/.claude/skills/analyzing-android-malware-with-apktool/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/analyzing-android-malware-with-apktool/SKILL.md

SKILL.md (verbatim)

name: analyzing-android-malware-with-apktool
description: Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically triage a suspicious APK without executing it or to build mobile malware detection rules.
domain: cybersecurity
subdomain: malware-analysis
tags:
- Android
- APK
- apktool
- jadx
- androguard
- mobile-malware
- static-analysis
- reverse-engineering
version: '1.0'
author: mahipal
license: Apache-2.0
nist_csf:
- DE.AE-02
- RS.AN-03
- ID.RA-01
- DE.CM-01
mitre_attack:
- T1406
- T1407
- T1626.001
- T1655.001
- T1521.001

Analyzing Android Malware with Apktool

Overview

Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.

When to Use

• When investigating security incidents that require analyzing android malware with apktool
• When building detection rules or threat hunting queries for this domain
• When SOC analysts need structured procedures for this analysis type
• When validating security monitoring coverage for related attack techniques

Prerequisites

• Python 3.9+ with androguard
• apktool (for resource decompilation)
• jadx (for Java source recovery, optional)
• Isolated analysis environment (VM or sandbox)
• Sample APK files for analysis

Steps

1. Parse APK with androguard to extract manifest metadata
2. Enumerate requested permissions and flag dangerous combinations
3. List activities, services, receivers, and providers from manifest
4. Scan for suspicious API calls (reflection, crypto, SMS, telephony)
5. Detect dynamic code loading patterns (DexClassLoader, Runtime.exec)
6. Extract hardcoded URLs, IPs, and C2 indicators from strings
7. Generate risk assessment report with MITRE ATT&CK mobile mappings

Expected Output

• JSON report with permission analysis, component listing, suspicious API calls, network indicators, and risk score
• Extracted strings and potential IOCs from the APK

Other files in this skill

• LICENSE
• references/api-reference.md
• scripts/agent.py

references/api-reference.md (verbatim)

API Reference — Analyzing Android Malware with Apktool

Libraries Used

• androguard: Python APK/DEX analysis — AnalyzeAPK(), permission enumeration, API call scanning
• re: Regex extraction of URLs, IPs, base64 patterns from DEX strings
• json: JSON serialization for analysis reports

CLI Interface

python agent.py sample.apk permissions
python agent.py sample.apk manifest
python agent.py sample.apk apis
python agent.py sample.apk strings
python agent.py sample.apk full
python agent.py sample.apk           # defaults to full analysis

Core Functions

analyze_permissions(apk) — Permission risk assessment

Calls apk.get_permissions(). Flags 20 dangerous permissions including SEND_SMS, READ_CONTACTS, BIND_DEVICE_ADMIN, BIND_ACCESSIBILITY_SERVICE. Risk: CRITICAL >= 8 dangerous, HIGH >= 5, MEDIUM >= 2, LOW < 2.

analyze_manifest(apk) — Manifest component extraction

Calls apk.get_activities(), get_services(), get_receivers(), get_providers(). Returns package name, version, SDK levels, and all component lists.

scan_suspicious_apis(dx) — Suspicious API call detection

Searches DEX analysis for 14 patterns including:

• Runtime.exec, ProcessBuilder.start — command execution
• DexClassLoader.loadClass — dynamic code loading
• Method.invoke, Class.forName — reflection
• Cipher.getInstance — cryptographic operations
• SmsManager.sendTextMessage — SMS abuse

extract_strings(dx, apk) — IOC extraction from DEX strings

Regex extraction of HTTP/HTTPS URLs, external IP addresses, and base64 strings. Filters out private IP ranges (10.x, 192.168.x, 172.16.x, 127.x).

detect_obfuscation(apk, dx) — Obfuscation indicator detection

Checks for single-letter class names (ProGuard), multi-DEX, native libraries.

full_analysis(apk_path) — Comprehensive malware assessment

Androguard API

Risk Scoring

Dependencies

• androguard >= 3.4.0
• Isolated analysis environment recommended

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.