reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-android-dex-malware/LICENSE

@@ -0,0 +1,9 @@
+Apache License 2.0 — see the repository root LICENSE file for the full text.
+
+Copyright the AnalystAIPack contributors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0

vendor-new/analyst-ai-pack/skills/analyzing-android-dex-malware/SKILL.md

@@ -0,0 +1,100 @@
+---
+name: analyzing-android-dex-malware
+description: 'Reverses Android malware: unpacking APKs, decompiling DEX bytecode to readable
+  Java, auditing the manifest for abused permissions and components, and locating dynamically
+  loaded or native payloads. Activates for requests to analyze an APK, decompile DEX, or
+  investigate a suspicious Android app.'
+domain: cybersecurity
+subdomain: reverse-engineering
+tags:
+  - reverse-engineering
+  - android
+  - dex
+  - apk
+  - mobile
+  - decompilation
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1059
+  - T1406
+  - T1577
+d3fend:
+  - D3-FCR
+  - D3-DA
+references:
+  - 'Android DEX bytecode format — https://source.android.com/docs/core/runtime/dex-format'
+  - 'jadx DEX-to-Java decompiler — https://github.com/skylot/jadx'
+---
+
+# Analyzing Android DEX Malware
+
+## When to Use
+
+- You have a suspicious `.apk` (or bare `.dex`) and need to understand its behavior.
+- You need to audit the manifest for dangerous permissions, exported components, and the
+  declared entry points.
+- The app loads code dynamically (`DexClassLoader`) or ships a native `.so` you must locate.
+
+**Do not use** this workflow for iOS apps — DEX/APK tooling does not apply to Mach-O/IPA.
+
+## Prerequisites
+
+- jadx (or apktool + a decompiler) and `unzip`; an Android emulator/sandbox for dynamic runs.
+- `aapt`/manifest parsing for permissions and components.
+
+## Workflow
+
+### Step 1: Unpack the APK
+
+An APK is a ZIP. Extract and inventory the DEX files, native libraries, and assets:
+
+```bash
+python scripts/analyst.py inspect sample.apk
+```
+
+```text
+dex      : classes.dex, classes2.dex
+native   : lib/arm64-v8a/libpayload.so
+assets   : assets/config.enc  (possible encrypted payload)
+manifest : AndroidManifest.xml (binary)
+```
+
+### Step 2: Audit the manifest
+
+Decode `AndroidManifest.xml` and review requested permissions (SMS, accessibility, device
+admin, `REQUEST_INSTALL_PACKAGES`), exported components, and the launcher/`BOOT_COMPLETED`
+receivers.
+
+### Step 3: Decompile DEX
+
+Run jadx to recover Java. Start at the launcher activity and any `BroadcastReceiver`/`Service`
+declared in the manifest.
+
+### Step 4: Find dynamic and native code
+
+Search for `DexClassLoader`/`loadDex`, asset decryption, and `System.loadLibrary`. Dump and
+recurse on dynamically loaded DEX; analyze native `.so` separately if needed.
+
+### Step 5: Extract behavior and IOCs
+
+Recover C2 URLs, overlay/accessibility abuse, SMS interception, and config; map to ATT&CK for
+mobile in the report.
+
+## Validation
+
+- Every DEX and native library in the APK is accounted for.
+- Dangerous permissions are tied to concrete code paths (not just declared).
+- Dynamically loaded payloads are dumped and analyzed, not just noted.
+
+## Pitfalls
+
+- Reading only `classes.dex` and missing `classes2.dex`/`classes3.dex`.
+- Trusting the manifest alone; behavior may hide behind dynamic loading.
+- Ignoring encrypted assets that become the real payload at runtime.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the APK inspector.
+- Android DEX format and jadx (linked in frontmatter).

vendor-new/analyst-ai-pack/skills/analyzing-android-dex-malware/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Android DEX Malware
+
+## Overview
+
+`scripts/analyst.py` treats an APK as a ZIP and inventories its DEX files, native libraries,
+assets, and manifest presence, flagging multidex and likely encrypted payload assets. It does
+not decompile or execute — use jadx/apktool for decompilation.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | zipfile, file IO |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| jadx | Decompile DEX bytecode to Java |
+| apktool | Decode resources and binary AndroidManifest.xml |
+| Android emulator | Dynamic analysis of dynamic/native payloads |
+
+## Core functions
+
+### `inspect(path)`
+Returns the DEX list, native libraries, assets, manifest presence, multidex flag, and triage
+notes.
+
+## Usage
+
+```bash
+python scripts/analyst.py inspect sample.apk
+```
+
+## Sources
+
+- Android DEX bytecode format — https://source.android.com/docs/core/runtime/dex-format
+- APK packaging (ZIP container, AndroidManifest.xml) — Android documentation
+- jadx DEX-to-Java decompiler — https://github.com/skylot/jadx

vendor-new/analyst-ai-pack/skills/analyzing-android-dex-malware/scripts/analyst.py

@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Inspect an APK (ZIP) and inventory its DEX, native libraries, and assets.
+
+Lists the components relevant to triage — DEX files, native ``.so`` libraries, the manifest,
+and notable assets — without decompiling or executing anything. Use jadx/apktool for the
+actual decompilation step.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+import zipfile
+from pathlib import Path
+
+
+def inspect(path: str) -> dict:
+    if not zipfile.is_zipfile(path):
+        return {"error": "not a ZIP/APK"}
+    dex, native, assets, other = [], [], [], []
+    with zipfile.ZipFile(path) as zf:
+        for name in zf.namelist():
+            if name.endswith(".dex"):
+                dex.append(name)
+            elif name.startswith("lib/") and name.endswith(".so"):
+                native.append(name)
+            elif name.startswith("assets/"):
+                assets.append(name)
+            elif name == "AndroidManifest.xml":
+                other.append(name)
+    return {
+        "dex": sorted(dex),
+        "native_libs": sorted(native),
+        "assets": sorted(assets),
+        "has_manifest": "AndroidManifest.xml" in other,
+        "multidex": len(dex) > 1,
+        "notes": _notes(dex, native, assets),
+    }
+
+
+def _notes(dex, native, assets) -> list[str]:
+    notes = []
+    if len(dex) > 1:
+        notes.append("multidex: analyze all classesN.dex")
+    if native:
+        notes.append("native libraries present: analyze .so separately")
+    enc = [a for a in assets if a.endswith((".enc", ".dat", ".bin"))]
+    if enc:
+        notes.append(f"possible encrypted payload assets: {enc}")
+    return notes
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = argparse.ArgumentParser(description="Inspect an APK")
+    sub = parser.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("inspect")
+    p.add_argument("file")
+    args = parser.parse_args(argv)
+    print(json.dumps(inspect(args.file), indent=2))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())