What it does. 'Detects and analyzes malicious behavior in mobile applications through Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).

Install

• npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill detecting-mobile-malware-behavior, or copy the skill folder into ~/.claude/skills/detecting-mobile-malware-behavior/.
• Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/detecting-mobile-malware-behavior/SKILL.md

SKILL.md (verbatim)

1 placeholder credential was shortened (for example to api_key=YOUR_KEY) to pass the site's secret filter.

name: detecting-mobile-malware-behavior
description: 'Detects and analyzes malicious behavior in mobile applications through
  behavioral analysis, permission abuse detection, network traffic monitoring, and
  dynamic instrumentation. Use when analyzing suspicious mobile applications for data
  exfiltration, command-and-control communication, credential stealing, SMS interception,
  or other malware indicators. Activates for requests involving mobile malware analysis,
  app behavior monitoring, trojan detection, or suspicious app investigation.

  '
domain: cybersecurity
subdomain: mobile-security
author: mahipal
tags:
- mobile-security
- android
- ios
- malware-analysis
- owasp-mobile
- penetration-testing
version: 1.0.0
license: Apache-2.0
nist_csf:
- PR.PS-01
- PR.AA-05
- ID.RA-01
- DE.CM-09
mitre_attack:
- T1059
- T1056
- T1036
- T1078
- T1003
mitre_f3:
  version: '1.1'
  tactics:
  - positioning
  - execution
  - initial-access
  techniques:
  - id: T1453
    name: Abuse Accessibility Features
    tactic: positioning
    source: attack
  - id: F1003
    name: Abuse SMS verification
    tactic: execution
    source: f3
  - id: T1113
    name: Screen Capture
    tactic: positioning
    source: attack
  - id: T1219
    name: Remote Access Tools
    tactic: positioning
    source: attack
  - id: F1002.001
    name: 'Abuse of Public-Facing API: Mobile API Abuse'
    tactic: positioning
    source: f3

Detecting Mobile Malware Behavior

When to Use

Use this skill when:

• Analyzing suspicious mobile applications submitted by users or discovered during incident response
• Monitoring enterprise mobile fleet for malicious app indicators
• Performing malware triage on APK/IPA samples
• Investigating data exfiltration or unauthorized device access from mobile apps

Do not use this skill to create, enhance, or distribute malware. This skill is for defensive analysis only.

Prerequisites

• Isolated analysis environment (dedicated device or emulator, not connected to production networks)
• MobSF for automated static+dynamic analysis
• Frida/Objection for runtime behavior monitoring
• Wireshark/tcpdump for network traffic capture
• Android emulator (AVD) or Genymotion for safe execution
• VirusTotal API key for hash lookups

Workflow

Step 1: Static Indicator Analysis

# Hash the sample
sha256sum suspicious.apk

# Check VirusTotal
curl -s "https://www.virustotal.com/api/v3/files/<SHA256>" \
  -H "x-apikey: YOUR_KEY | jq '.data.attributes.last_analysis_stats'

# Extract permissions from AndroidManifest.xml
aapt dump permissions suspicious.apk

# High-risk permission combinations:
# READ_SMS + INTERNET = SMS stealer
# RECEIVE_SMS + SEND_SMS = SMS interceptor/banker trojan
# ACCESSIBILITY_SERVICE + INTERNET = overlay attack capability
# CAMERA + RECORD_AUDIO + INTERNET = spyware
# DEVICE_ADMIN + INTERNET = ransomware capability
# READ_CONTACTS + INTERNET = contact exfiltration

Step 2: MobSF Automated Malware Scan

# Upload to MobSF
curl -F "file=@suspicious.apk" http://localhost:8000/api/v1/upload \
  -H "Authorization: <API_KEY>"

# Review malware indicators in report:
# - Hardcoded C2 server addresses
# - Dynamic code loading (DexClassLoader)
# - Reflection-based API calls (to evade static analysis)
# - Encrypted/obfuscated payloads
# - Root detection (malware often checks for root)
# - Anti-emulator checks (malware evades sandbox)

Step 3: Network Behavior Monitoring

# Start packet capture on emulator
tcpdump -i any -w malware_traffic.pcap

# Or use mitmproxy for HTTP/HTTPS
mitmproxy --mode transparent

# Monitor for:
# - DNS lookups to suspicious/newly registered domains
# - Connections to known C2 infrastructure
# - Data exfiltration patterns (large POST requests)
# - Beaconing behavior (regular interval connections)
# - Non-standard ports and protocols
# - Domain Generation Algorithm (DGA) patterns

Step 4: Runtime Behavior Monitoring with Frida

// monitor_malware.js - Comprehensive behavior monitoring
Java.perform(function() {
    // Monitor SMS access
    var SmsManager = Java.use("android.telephony.SmsManager");
    SmsManager.sendTextMessage.overload("java.lang.String", "java.lang.String",
        "java.lang.String", "android.app.PendingIntent", "android.app.PendingIntent")
        .implementation = function(dest, sc, text, sent, delivery) {
            console.log("[SMS] Sending to: " + dest + " Text: " + text);
            // Allow or block based on analysis needs
            return this.sendTextMessage(dest, sc, text, sent, delivery);
        };

    // Monitor file operations
    var FileOutputStream = Java.use("java.io.FileOutputStream");
    FileOutputStream.$init.overload("java.lang.String").implementation = function(path) {
        console.log("[FILE-WRITE] " + path);
        return this.$init(path);
    };

    // Monitor network connections
    var URL = Java.use("java.net.URL");
    URL.openConnection.overload().implementation = function() {
        console.log("[NET] " + this.toString());
        return this.openConnection();
    };

    // Monitor dynamic code loading
    var DexClassLoader = Java.use("dalvik.system.DexClassLoader");
    DexClassLoader.$init.implementation = function(dexPath, optDir, libPath, parent) {
        console.log("[DEX-LOAD] Loading: " + dexPath);
        return this.$init(dexPath, optDir, libPath, parent);
    };

    // Monitor command execution
    var Runtime = Java.use("java.lang.Runtime");
    Runtime.exec.overload("java.lang.String").implementation = function(cmd) {
        console.log("[EXEC] " + cmd);
        return this.exec(cmd);
    };

    // Monitor camera/audio access
    var Camera = Java.use("android.hardware.Camera");
    Camera.open.overload("int").implementation = function(id) {
        console.log("[CAMERA] Camera opened: " + id);
        return this.open(id);
    };

    // Monitor content provider access (contacts, call log)
    var ContentResolver = Java.use("android.content.ContentResolver");
    ContentResolver.query.overload("android.net.Uri", "[Ljava.lang.String;",
        "java.lang.String", "[Ljava.lang.String;", "java.lang.String")
        .implementation = function(uri, proj, sel, selArgs, sort) {
            console.log("[QUERY] " + uri.toString());
            return this.query(uri, proj, sel, selArgs, sort);
        };

    console.log("[*] Malware behavior monitor active");
});

Step 5: Classify Malware Type

Based on observed behaviors, classify the sample:

Key Concepts

Tools & Systems

• MobSF: Automated static and dynamic analysis for initial malware triage
• VirusTotal: Multi-engine malware scanning and hash reputation lookup
• Frida: Runtime behavior monitoring through method hooking
• Wireshark: Network traffic analysis for C2 communication patterns
• Cuckoo Sandbox / CuckooDroid: Automated malware analysis sandbox for Android samples

Common Pitfalls

• Anti-analysis evasion: Sophisticated malware detects emulators, debuggers, and Frida. Use hardware devices and stealthy Frida configurations for accurate analysis.
• Time-delayed payloads: Some malware activates only after a delay or specific trigger. Monitor for extended periods and simulate various conditions.
• Encrypted C2: Malware using encrypted communications requires TLS interception or memory inspection to observe payload content.
• Multi-stage payloads: Initial APK may be benign; malicious payload downloads later. Monitor for dynamic code loading and file downloads.

Other files in this skill

• LICENSE
• assets/template.md
• references/api-reference.md
• references/standards.md
• references/workflows.md
• scripts/agent.py
• scripts/process.py

assets/template.md (verbatim)

Mobile Malware Analysis Report

Sample Information

Permission Analysis

Behavioral Indicators

IOCs

Recommendations

1. [RECOMMENDATION]

references/api-reference.md (verbatim)

API Reference: Detecting Mobile Malware Behavior

Android Dangerous Permissions

Android Analysis Tools

# Extract permissions from APK
aapt dump permissions app.apk

# Decompile APK
apktool d app.apk -o output_dir/

# Decompile to Java source
jadx app.apk -d java_output/

# Run MobSF scan
docker run -p 8000:8000 opensecurity/mobile-security-framework-mobsf

Suspicious API Patterns

# Dynamic code loading
r"DexClassLoader|PathClassLoader"
# Shell execution
r"Runtime\.exec|ProcessBuilder"
# Device fingerprinting
r"TelephonyManager\.getDeviceId"

MobSF REST API

import requests
# Upload APK
resp = requests.post("http://localhost:8000/api/v1/upload",
    files={"file": open("app.apk", "rb")},
    headers={"Authorization": API_KEY})

# Get scan results
resp = requests.post("http://localhost:8000/api/v1/scan",
    data={"hash": file_hash},
    headers={"Authorization": API_KEY})

Android Broadcast Receivers (Persistence)

CLI Usage

python agent.py --apk suspicious.apk
python agent.py --source-dir jadx_output/
python agent.py --apk app.apk --source-dir decompiled/

references/standards.md (verbatim)

Standards Reference: Mobile Malware Detection

OWASP Mobile Top 10 2024

NIST SP 800-163 Rev 1

• Section 5: Mobile app vetting for malware indicators
• Section 6: Enterprise mobile device management for malware prevention

MITRE ATT&CK Mobile Matrix

references/workflows.md (verbatim)

Workflows: Mobile Malware Detection

Workflow 1: Malware Triage Pipeline

[Receive sample] --> [Hash & VirusTotal check] --> [Known malware?]
                                                    /            \
                                              [Yes: Report]  [No: Continue]
                                                                   |
                                              [MobSF static scan] --> [Permission analysis]
                                                                   |
                                              [Dynamic execution in sandbox]
                                              [Network monitoring]
                                              [Behavior monitoring with Frida]
                                                                   |
                                              [Classify malware type]
                                              [Extract IOCs (domains, IPs, hashes)]
                                              [Generate report]

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.