Analyzing Android DEX Malware
Flujo de trabajo de triaje de APK: inventariar cargas útiles DEX y nativas, luego descompilar con jadx
Funciona con configuración
Qué hace
Un reverse-engineering workflow para suspicious Android apps: unpack the APK, audit the manifest para abused permissions y exported components, decompile DEX a Java, y chase dynamically loaded o native payloads a sus IOCs. Ships a small Python inspector que inventories every DEX, .so y asset en el archive y flags multidex y likely encrypted payloads. Se activa con requests para analyze an APK, decompile DEX, o investigate a suspicious Android app.
Informe de la prueba
Se ejecutó el bundled inspector against a purpose-built multidex APK: it correctly listed classes.dex through classes3.dex, el arm64 libpayload.so y assets/config.enc, y raised all three triage flags incluyendo 'possible encrypted payload assets'. It also survived a real APK con no DEX at all y returned a clean 'not a ZIP/APK' error on a text file. El catch es que el script es essentially a classified 'unzip -l' — un plain unzip listing showed the same twelve entries, so the measurable gain over no skill es el auto-flagging plus el workflow's validation rules (tie every dangerous permission to a code path, dump dynamically loaded DEX rather than just noting it). Everything past step 1 depends on jadx y apktool, which the skill lists as prerequisites but neither bundles nor helps install; jadx estaba absent on the test machine, so the headline promise de decompiling DEX a readable Java could not be exercised. Useful as a checklist y a first-pass inventory, but budget time para la external toolchain.
Probado el: 2026-08-10 · Claude Code 2.x (agent harness)
Instalación
git clone https://github.com/meltedinhex/analyst-ai-pack.git mkdir -p ~/.claude/skills cd analyst-ai-pack && cp -r skills/analyzing-android-dex-malware ~/.claude/skills/analyzing-android-dex-malware
Comandos y prompts de ejemplo
/analyzing-android-dex-malwareFlujo de trabajo de triaje de APK: inventariar cargas útiles DEX y nativas, luego descompilar con jadx
Los skills se activan con peticiones en lenguaje natural, sin comandos que memorizar. Tras instalarlo, prompts como estos lo activan (en inglés):
Triage this suspicious multidex APK and list its DEX filesDecompile this Android app and check for abused permissionsFind the IOCs from this app's dynamically loaded native payload