agentsclimarketplace

Analyzing android dex malware

Skill meltedinhex/analyst-ai-pack/skills/analyzing-android-dex-malware

An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.

Install
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-android-dex-malware

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable Java, auditing the manifest for abused permissions and components, and locating dynamically loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or investigate a suspicious Android app.

The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

3.1 KB, as published. Nobody here has run it

Analyzing Android DEX Malware

When to Use

  • You have a suspicious .apk (or bare .dex) and need to understand its behavior.
  • You need to audit the manifest for dangerous permissions, exported components, and the declared entry points.
  • The app loads code dynamically (DexClassLoader) or ships a native .so you must locate.

Do not use this workflow for iOS apps — DEX/APK tooling does not apply to Mach-O/IPA.

Prerequisites

  • jadx (or apktool + a decompiler) and unzip; an Android emulator/sandbox for dynamic runs.
  • aapt/manifest parsing for permissions and components.

Workflow

Step 1: Unpack the APK

An APK is a ZIP. Extract and inventory the DEX files, native libraries, and assets:

python scripts/analyst.py inspect sample.apk

dex      : classes.dex, classes2.dex
native   : lib/arm64-v8a/libpayload.so
assets   : assets/config.enc  (possible encrypted payload)
manifest : AndroidManifest.xml (binary)

Step 2: Audit the manifest

Decode AndroidManifest.xml and review requested permissions (SMS, accessibility, device admin, REQUEST_INSTALL_PACKAGES), exported components, and the launcher/BOOT_COMPLETED receivers.

Step 3: Decompile DEX

Run jadx to recover Java. Start at the launcher activity and any BroadcastReceiver/Service declared in the manifest.

Step 4: Find dynamic and native code

Search for DexClassLoader/loadDex, asset decryption, and System.loadLibrary. Dump and recurse on dynamically loaded DEX; analyze native .so separately if needed.

Step 5: Extract behavior and IOCs

Recover C2 URLs, overlay/accessibility abuse, SMS interception, and config; map to ATT&CK for mobile in the report.

Validation

  • Every DEX and native library in the APK is accounted for.
  • Dangerous permissions are tied to concrete code paths (not just declared).
  • Dynamically loaded payloads are dumped and analyzed, not just noted.

Pitfalls

  • Reading only classes.dex and missing classes2.dex/classes3.dex.
  • Trusting the manifest alone; behavior may hide behind dynamic loading.
  • Ignoring encrypted assets that become the real payload at runtime.

References

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.