Imported from reason-machines/security-skills (skills/malware-detection-awareness/SKILL.md) via skills.sh. Install upstream with npx skills add reason-machines/security-skills --skill malware-detection-awareness. Copyright stays with the author.

Malware Detection Awareness

Skill by ara.so — Security Skills collection.

⚠️ SECURITY WARNING

This repository exhibits multiple indicators of malicious software distribution. It does NOT contain legitimate Avast Premium Security software.

Threat Indicators

Red Flags Present

1. Unauthorized Distribution: Claims to provide "pre-activated" commercial software with "keygen" and "loader" tools
2. Trademark Abuse: Unauthorized use of Avast brand name and product names
3. License Violation: No legitimate license; distributing cracked commercial software
4. Suspicious Metrics: Artificially inflated stars (6 stars/day for empty repository)
5. No Source Code: Repository contains no actual code or README
6. Activation Bypass Claims: References to "keygen", "serial", "loader" - common malware indicators
7. Generic Project Name: "DragonflyTomb" unrelated to security software

Common Malware Distribution Patterns

LEGITIMATE SOFTWARE:
✓ Official vendor website download
✓ Verified digital signatures
✓ Clear licensing terms
✓ Active development history
✓ Real source code
✓ Community engagement

MALWARE DISTRIBUTION:
✗ "Cracked" or "pre-activated" claims
✗ Keygens, loaders, patches
✗ Empty repositories with download links
✗ Star manipulation
✗ No verifiable source code
✗ Promises of "free premium" paid software

Detection Techniques

Repository Analysis

// Example: Programmatic repository risk assessment
package main

import (
    "fmt"
    "strings"
)

type RiskIndicator struct {
    Pattern string
    Severity string
}

func AnalyzeRepository(description, topics []string) []RiskIndicator {
    risks := []RiskIndicator{}
    
    malwareKeywords := []string{
        "keygen", "crack", "loader", "pre-activated",
        "serial", "patch", "activator", "license key",
    }
    
    for _, keyword := range malwareKeywords {
        descLower := strings.ToLower(description)
        if strings.Contains(descLower, keyword) {
            risks = append(risks, RiskIndicator{
                Pattern: fmt.Sprintf("Malware keyword: %s", keyword),
                Severity: "CRITICAL",
            })
        }
    }
    
    // Check for trademark abuse
    commercialProducts := []string{"avast", "norton", "mcafee", "kaspersky"}
    for _, product := range commercialProducts {
        if containsAny(description, []string{product + " premium", product + " pro"}) {
            risks = append(risks, RiskIndicator{
                Pattern: fmt.Sprintf("Unauthorized %s distribution", product),
                Severity: "HIGH",
            })
        }
    }
    
    return risks
}

func containsAny(text string, patterns []string) bool {
    lower := strings.ToLower(text)
    for _, pattern := range patterns {
        if strings.Contains(lower, strings.ToLower(pattern)) {
            return true
        }
    }
    return false
}

URL Safety Checking

package security

import (
    "net/url"
    "os"
    "encoding/json"
    "net/http"
)

// CheckURL validates URLs against threat intelligence
func CheckURL(targetURL string) (bool, error) {
    // Use VirusTotal API or similar
    apiKey := os.Getenv("VIRUSTOTAL_API_KEY")
    
    if apiKey == "" {
        return false, fmt.Errorf("API key not configured")
    }
    
    // Parse and validate URL
    parsed, err := url.Parse(targetURL)
    if err != nil {
        return false, err
    }
    
    // Check against threat databases
    // Implementation depends on chosen API
    return checkThreatDatabase(parsed.String(), apiKey)
}

func checkThreatDatabase(url, apiKey string) (bool, error) {
    // Example implementation structure
    // Real implementation would use actual threat intelligence API
    client := &http.Client{}
    req, _ := http.NewRequest("GET", 
        "https://threat-api.example.com/check", nil)
    req.Header.Set("X-API-Key", apiKey)
    
    // Process response
    // Return true if safe, false if malicious
    return false, nil
}

Safe Software Practices

Verification Checklist

// VerificationChecklist for software downloads
type SoftwareSource struct {
    URL           string
    IsOfficial    bool
    HasSignature  bool
    LicenseValid  bool
    SourceVisible bool
}

func (s *SoftwareSource) IsSafe() bool {
    return s.IsOfficial && 
           s.HasSignature && 
           s.LicenseValid && 
           s.SourceVisible
}

// Example usage
func ValidateSource(sourceURL string) *SoftwareSource {
    source := &SoftwareSource{
        URL: sourceURL,
    }
    
    // Check if URL matches official vendor domain
    source.IsOfficial = verifyOfficialDomain(sourceURL)
    
    // Verify digital signature after download
    source.HasSignature = false // Set after file check
    
    // Validate license compliance
    source.LicenseValid = checkLicenseCompliance(sourceURL)
    
    // Ensure source code is available and reviewed
    source.SourceVisible = checkSourceAvailability(sourceURL)
    
    return source
}

Legitimate Alternatives

Official Avast Download

# Always download from official sources
# Official Avast website: https://www.avast.com
# Official download verification:

# 1. Download only from avast.com
# 2. Verify digital signature (Windows):
Get-AuthenticodeSignature "avast_installer.exe"

# 3. Check certificate issuer
# Should be: Avast Software s.r.o.

# 4. Purchase license through official channels
# Never use keygens or cracks

Incident Response

If Exposed to Malware

#!/bin/bash
# Emergency response steps

# 1. Disconnect from network
sudo ifconfig eth0 down

# 2. Run full system scan with legitimate antivirus
# Use Microsoft Defender (Windows) or ClamAV (Linux)

# 3. Check for persistence mechanisms
# Linux:
sudo find /etc/cron* -type f -exec cat {} \;
sudo systemctl list-unit-files | grep enabled

# Windows (PowerShell):
# Get-ScheduledTask | Where-Object {$_.State -eq "Ready"}
# Get-WmiObject Win32_StartupCommand

# 4. Review recent file changes
find /home -type f -mtime -1

# 5. Change all credentials
# Use a clean device to change passwords

Educational Resources

Learning Malware Detection

• OWASP Malicious Software
• VirusTotal - File/URL scanning
• Hybrid Analysis - Malware analysis
• ANY.RUN - Interactive malware sandbox

Legitimate Open Source Security

# Real open-source security tools

# ClamAV - Open source antivirus
sudo apt install clamav
freshclam  # Update signatures
clamscan -r /path/to/scan

# YARA - Malware identification
pip install yara-python

# Volatility - Memory forensics
git clone https://github.com/volatilityfoundation/volatility3.git

Reporting Malicious Repositories

# Report to GitHub
# Visit: https://github.com/contact/report-abuse
# Select: Report malware or abuse

# Report to vendor (Avast)
# Contact: https://www.avast.com/contact
# Report trademark violation and malware distribution

# Report to security communities
# Submit to VirusTotal, abuse.ch, etc.

Key Takeaways

1. Never download cracked software - always contains malware risk
2. Verify source authenticity - check official vendor websites
3. Check digital signatures - legitimate software is signed
4. Use official licenses - support legitimate developers
5. Report suspicious repositories - protect the community

This skill teaches recognition of malicious software distribution, not usage of malware.