Analyzing Android Malware With Apktool

This automates static analysis of Android APK malware using androguard, apktool, and jadx. It parses the manifest to pull permissions, activities, services, and receivers, then scans for suspicious API calls like dynamic code loading, reflection abuse, and crypto operations. You get a JSON report with risk scores and MITRE ATT&CK mobile mappings, plus extracted strings and network indicators. Useful when you're triaging mobile malware samples or building detection rules and need structured output instead of manually poking through decompiled code. The permission analysis flags dangerous combinations, which catches a lot of common Android malware patterns. Assumes you're working in an isolated environment and have the Python toolchain set up.

skills.sh installs: 697
GitHub stars: 35.9K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add mukul975/anthropic-cybersecurity-skills --skill analyzing-android-malware-with-apktool --agent claude-code

Installs into .claude/skills of the current project.

Files

Analyzing Android Malware with Apktool

Overview

Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.

When to Use

When investigating security incidents that require analyzing android malware with apktool
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques