aradotso avatar

Malware Analysis DragonflyTomb Avast

This teaches you to spot malware disguised as cracked security software by analyzing a real example repository that pretends to distribute Avast Premium Security. You get detection code in Go that scans for suspicious imports like syscall and os/exec, checks for obfuscation patterns, and calculates file hashes. It walks through red flags like fake star counts, missing licenses, and keywords like "keygen" or "pre-activated" that signal malware distribution. Use this when you need to evaluate sketchy GitHub repos claiming to offer premium software for free, or when building tooling to detect social engineering attacks that target developers. The skill includes sandbox setup instructions and VirusTotal integration code for safe analysis.

skills.sh installs
851
GitHub stars
6
last updated
Jul 14, 2026

Install

$ npx -y skills add aradotso/security-skills --skill malware-analysis-dragonflyTomb-avast --agent claude-code

Installs into .claude/skills of the current project.

Files

DragonflyTomb/Avast-Premium-Security-2026 Analysis

Skill by ara.so — Security Skills collection

⚠️ WARNING: Malware Distribution Repository

This repository is NOT legitimate Avast Premium Security software. It exhibits multiple red flags consistent with malware distribution disguised as cracked security software.

Threat Indicators

Repository Red Flags

  1. Unauthorized Distribution: Avast Corporation does not distribute software via GitHub repositories named "DragonflyTomb"
  2. Crack/Keygen Keywords: Terms like "Keygen", "Pre-Activated", "Loader", "Serial" indicate piracy or malware
  3. Suspicious Topics: Includes "retdec" (reverse engineering tool) in security software context
  4. No README: Legitimate software repositories include documentation
  5. Artificial Stars: 60 stars at 5 stars/day suggests manipulation
  6. No License: "NOASSERTION" for commercial software is suspicious
  7. Future Date: Claims to be "2026" version (likely timestamp manipulation)

Common Malware Distribution Patterns

// Typical malware loader pattern in Go
package main

Sponsors

Details

Repository
github.com/aradotso/security-skills
Category
Security
First seen
Jul 14, 2026

More from aradotso/security-skills

All 58

Recommended

More Security
1bagelhole avatarlinux-administrationbagelhole/devops-security-agent-skillsSystem administration for Linux servers. Manage packages, services, and system configuration. Use when administering Linux systems.833skills.sh installs
2aradotso avataridentify-malicious-repositoryaradotso/security-skillsidentify malicious repository823skills.sh installs
3aradotso avatarmalware-warning-bitdefender-crackaradotso/security-skillsmalware warning bitdefender crack817skills.sh installs
4aradotso avatarmalware-detection-and-removalaradotso/security-skillsmalware detection and removal796skills.sh installs
5aradotso avatardragonjar-android-pentesting-skillaradotso/security-skillsdragonjar android pentesting skill775skills.sh installs
6aradotso avatarmalware-awareness-bitdefender-crack-fraudaradotso/security-skillsmalware awareness bitdefender crack fraud767skills.sh installs