reverse-engineering-android-malware-with-jadx

Name: reverse-engineering-android-malware-with-jadx
Availability: InStock
Author: YukiIto1999

Decompile Android APKs with JADX to identify malicious behaviors.

Updated Apr 23, 2026

Search Tags:#android #static-analysis #malware #reverse-engineering #jadx #apk #apktool

Ready to run

npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill reverse-engineering-android-malware-with-jadx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: reverse-engineering-android-malware-with-jadx
Source: https://github.com/YukiIto1999/ctf-sleuth/tree/main/.claude/skills/reverse-engineering-android-malware-with-jadx
Command: npx skills add https://github.com/YukiIto1999/ctf-sleuth --skill reverse-engineering-android-malware-with-jadx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

Analyze Android APKs to identify malicious behavior by decompiling Java/Kotlin sources with JADX to reveal data theft, C2 communication, privilege escalation, and overlay-related activities.

Core Features & Use Cases

Decompile Android APKs to readable Java/Kotlin source with JADX, enabling in-depth malware analysis.
Identify C2 endpoints, data exfiltration flows, overlay UI injections, and abuse of sensitive permissions from decompiled code.
Use Case: Investigate a suspicious banking Trojan APK to map its C2 channel, targeted data, and UI overlays for risk assessment and IOC extraction.

Quick Start

Decompile a sample APK with JADX and begin scanning the decompiled sources for suspicious patterns.

Frequently Asked Questions about reverse-engineering-android-malware-with-jadx

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I analyze an Android APK for malware using JADX?▼

To analyze Android APK malware with JADX, decompile the application package into readable Java/Kotlin source code, then perform static code scanning to identify malicious behaviors like C2 communication, data exfiltration, and overlay attacks.

What is static analysis for Android malware?▼

Static analysis for Android malware is the process of examining decompiled APK source code without executing the application. It involves using tools like JADX to search for suspicious patterns, such as hardcoded endpoints and data theft routines, to map malicious behavior.

Do I need apktool to extract the manifest when reverse engineering Android malware?▼

Yes, you need apktool to extract the AndroidManifest.xml file when reverse engineering malware. While JADX decompiles the Java/Kotlin source code, apktool is required specifically for manifest extraction to identify abused permissions.

Can I detect C2 communication in a banking trojan APK?▼

Yes, you can detect C2 communication in a banking trojan APK by decompiling the source with JADX and applying regex-based pattern searches. This static analysis locates suspicious endpoints and data exfiltration flows within the decompiled code.

What's the best way to find overlay attacks in decompiled Android apps?▼

The best way to find overlay attacks in decompiled Android apps is to use JADX to convert the APK into readable source code, then statically scan the UI injection components and permission requests for malicious overlay-related activities.

How do I extract IOCs from suspicious Android applications?▼

You can extract IOCs from suspicious Android applications by decompiling the APK with JADX and scanning the source code. This static analysis identifies C2 endpoints, targeted data, and suspicious behaviors needed for risk assessment and IOC extraction.