Malware Analysis DragonflyTomb Avast

This teaches you to spot malware disguised as cracked security software by analyzing a real example repository that pretends to distribute Avast Premium Security. You get detection code in Go that scans for suspicious imports like syscall and os/exec, checks for obfuscation patterns, and calculates file hashes. It walks through red flags like fake star counts, missing licenses, and keywords like "keygen" or "pre-activated" that signal malware distribution. Use this when you need to evaluate sketchy GitHub repos claiming to offer premium software for free, or when building tooling to detect social engineering attacks that target developers. The skill includes sandbox setup instructions and VirusTotal integration code for safe analysis.

Install to Claude Code

npx -y skills add aradotso/security-skills --skill malware-analysis-dragonflyTomb-avast --agent claude-code