- Add validated mitre_attack frontmatter to all 754 skills (286 distinct
techniques), verified against MITRE ATT&CK v19.1 via the official
mitreattack-python library: 0 revoked, deprecated, or invalid IDs
- Curate precise per-skill technique IDs for forensics, malware-analysis,
threat-intel, and red-team skills (e.g. DCSync -> T1003.006,
Kerberoasting -> T1558.003, Pass-the-Ticket -> T1550.003)
- Reconcile v19.1 tactic restructuring: Defense Evasion split into
Stealth (TA0005) and Defense Impairment (TA0112); revoked T1562.*
family and T1070.001/.002 remapped to active equivalents (T1685.*)
- Normalize word-split tags across 35 skills (remove filename-derived
stopword tags, add semantic cybersecurity tags)
- Add api-reference.md for 3 skills that were missing it
- Update README ATT&CK section with accurate v19.1 tactic distribution
Perform static analysis of Android APK malware samples using apktool for decompilation, jadx for Java source recovery, and androguard for permission analysis, manifest inspection, and suspicious API call detection.
cybersecurity
malware-analysis
Android
APK
apktool
jadx
androguard
mobile-malware
static-analysis
reverse-engineering
1.0
mahipal
Apache-2.0
DE.AE-02
RS.AN-03
ID.RA-01
DE.CM-01
T1406
T1407
T1626.001
T1655.001
T1521.001
Analyzing Android Malware with Apktool
Overview
Android malware distributed as APK files can be statically analyzed to extract permissions, activities, services, broadcast receivers, and suspicious API calls without executing the sample. This skill uses androguard for programmatic APK analysis, identifying dangerous permission combinations, obfuscated code patterns, dynamic code loading, reflection-based API calls, and network communication indicators.
When to Use
When investigating security incidents that require analyzing android malware with apktool
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques
Prerequisites
Python 3.9+ with androguard
apktool (for resource decompilation)
jadx (for Java source recovery, optional)
Isolated analysis environment (VM or sandbox)
Sample APK files for analysis
Steps
Parse APK with androguard to extract manifest metadata
Enumerate requested permissions and flag dangerous combinations
List activities, services, receivers, and providers from manifest
Scan for suspicious API calls (reflection, crypto, SMS, telephony)
mukul975
cb8d79e068