malware-analysis-detection

Imported from reason-machines/security-skills (skills/malware-analysis-detection/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill malware-analysis-detection. Copyright stays with the author.

---
name: malware-analysis-detection
description: Detect and analyze potentially malicious repository patterns, crack/keygen distributions, and software piracy indicators
triggers:
  - analyze this repository for malware distribution
  - check if this project is distributing cracks or keygens
  - detect software piracy patterns in code
  - identify malicious repository indicators
  - scan for fake antivirus or security software
  - analyze repository for credential theft patterns
  - check for trojan or malware distribution setup
  - evaluate repository security risk and legitimacy
---

# Malware Analysis & Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ WARNING: MALICIOUS REPOSITORY DETECTED

This repository exhibits **critical security red flags** indicating malware distribution disguised as legitimate software:

### Threat Indicators

**Primary Concerns:**
- **Impersonation Attack**: Falsely claims to distribute Bitdefender Total Security
- **Crack/Keygen Distribution**: Promotes "Pre-Activated", "Activation Keygen Loader", "License Key"
- **No Legitimate Content**: Empty README, no actual code
- **Suspicious Growth**: 59 stars (4/day) indicates artificial popularity boosting
- **Defender Bypass**: Topic explicitly mentions "defender-bypass"
- **Thread Hijacking**: Listed as a feature, a known malware technique

**Classification**: This is a **malware distribution repository** using SEO tactics to target users searching for pirated software.

## Analysis Pattern

### Repository Red Flags Checklist

```go
package malware_detector

type RepoAnalysis struct {
    SuspiciousTopics    []string
    EmptyReadme         bool
    CrackKeywords       []string
    ArtificialStars     bool
    ImpersonatedBrand   string
    RiskLevel           string
}

func AnalyzeRepository(repo Repository) RepoAnalysis {
    analysis := RepoAnalysis{}
    
    // Check for piracy keywords
    crackKeywords := []string{
        "crack", "keygen", "loader", "pre-activated",
        "license key", "full version", "activation",
    }
    
    for _, keyword := range crackKeywords {
        if containsIgnoreCase(repo.Description, keyword) {
            analysis.CrackKeywords = append(analysis.CrackKeywords, keyword)
        }
    }
    
    // Check for malicious topics
    maliciousTopics := []string{
        "defender-bypass", "thread-hijacking",
        "exploit-mitigation", "rootkit-remover",
    }
    
    for _, topic := range repo.Topics {
        for _, malTopic := range maliciousTopics {
            if topic == malTopic {
                analysis.SuspiciousTopics = append(analysis.SuspiciousTopics, topic)
            }
        }
    }
    
    // Check README
    analysis.EmptyReadme = len(repo.Readme) < 100
    
    // Determine risk level
    riskScore := 0
    if len(analysis.CrackKeywords) > 3 { riskScore += 40 }
    if len(analysis.SuspiciousTopics) > 2 { riskScore += 30 }
    if analysis.EmptyReadme { riskScore += 20 }
    if repo.StarGrowthRate > 3 { riskScore += 10 }
    
    switch {
    case riskScore >= 80:
        analysis.RiskLevel = "CRITICAL - Confirmed Malware Distribution"
    case riskScore >= 60:
        analysis.RiskLevel = "HIGH - Likely Malicious"
    case riskScore >= 40:
        analysis.RiskLevel = "MEDIUM - Suspicious Activity"
    default:
        analysis.RiskLevel = "LOW - Monitor"
    }
    
    return analysis
}

Detection Techniques

1. Keyword Pattern Analysis

package detector

import (
    "regexp"
    "strings"
)

var malwarePatterns = map[string]*regexp.Regexp{
    "crack_distribution": regexp.MustCompile(`(?i)(crack|cracked|keygen|patch|loader|activator)`),
    "fake_licenses":      regexp.MustCompile(`(?i)(license\s+key|serial\s+number|activation\s+code|product\s+key)`),
    "bypass_security":    regexp.MustCompile(`(?i)(bypass|disable|remove|crack)\s+(antivirus|defender|firewall|protection)`),
    "trojan_indicators":  regexp.MustCompile(`(?i)(inject|payload|backdoor|remote\s+access|stealer)`),
}

func ScanContent(content string) map[string][]string {
    findings := make(map[string][]string)
    
    for category, pattern := range malwarePatterns {
        matches := pattern.FindAllString(content, -1)
        if len(matches) > 0 {
            findings[category] = matches
        }
    }
    
    return findings
}

2. Brand Impersonation Detection

func DetectImpersonation(repoName, description string) (bool, string) {
    legitimateBrands := []string{
        "Bitdefender", "Norton", "McAfee", "Kaspersky",
        "Avast", "AVG", "Malwarebytes", "ESET",
    }
    
    combined := strings.ToLower(repoName + " " + description)
    
    for _, brand := range legitimateBrands {
        brandLower := strings.ToLower(brand)
        if strings.Contains(combined, brandLower) {
            // Check if official repository
            if !strings.Contains(repoName, "official") && 
               (strings.Contains(combined, "crack") || 
                strings.Contains(combined, "free download") ||
                strings.Contains(combined, "keygen")) {
                return true, brand
            }
        }
    }
    
    return false, ""
}

3. Suspicious Growth Analysis

func AnalyzeStarGrowth(stars, daysActive int) (suspicious bool, rate float64) {
    if daysActive == 0 {
        return true, 0
    }
    
    rate = float64(stars) / float64(daysActive)
    
    // Suspicious if gaining more than 3 stars/day for non-legitimate projects
    suspicious = rate > 3.0
    
    return suspicious, rate
}

Protection Recommendations

For Developers

// DO NOT clone or interact with suspicious repositories
// Always verify software sources

func SafeRepositoryCheck(repoURL string) error {
    // 1. Check repository age and commit history
    // 2. Verify maintainer identity
    // 3. Review code before execution
    // 4. Check for official sources
    
    analysis := AnalyzeRepository(repoURL)
    
    if analysis.RiskLevel == "CRITICAL - Confirmed Malware Distribution" {
        return fmt.Errorf("SECURITY ALERT: Repository flagged as malware distribution - DO NOT USE")
    }
    
    return nil
}

For Users

Never download software from:

• Repositories promoting "cracks", "keygens", or "activators"
• Sources claiming to bypass security software
• Unverified third-party distributions of commercial software
• Repositories with empty/minimal documentation

Safe Alternatives:

const (
    // Always use official sources
    BitdefenderOfficial = "https://www.bitdefender.com"
    
    // For free antivirus, use legitimate options:
    // - Windows Defender (built-in)
    // - Bitdefender Free Edition (official)
    // - Avast Free (official)
)

Reporting Malicious Repositories

func ReportMaliciousRepo(platform, repoURL, evidence string) {
    // GitHub: https://github.com/contact/report-abuse
    // Report as: Malware distribution, Software piracy
    
    report := fmt.Sprintf(`
Repository: %s
Violation: Malware distribution disguised as cracked software
Evidence: 
- Empty codebase with malware keywords
- Impersonates legitimate security software
- Promotes illegal software cracks/keygens
- Contains "defender-bypass" and "thread-hijacking" topics
- Artificial star inflation

Request: Immediate takedown and user investigation
`, repoURL)
    
    // Submit through official channels
}

Conclusion

This repository is NOT a legitimate Bitdefender distribution or security tool. It is a malware distribution scheme targeting users searching for pirated software.

Action Required: Report to platform administrators and warn potential victims.

Remember: Legitimate security software never requires "cracks", "keygens", or "activation loaders". Always obtain software from official sources.