# bitdefender-malware-investigation

Guides security analysis of a deceptive repository masquerading as an antivirus crack. Ideal for researchers investigating trojan distribution vectors.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 775 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-malware-investigation/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/bitdefender-malware-investigation

## What it does

The skill outlines steps to inspect `MistDuckCount/Bitdefender-Total-Security-Crack-2026`. This repository pretends to ship commercial security tools, but shows signs of credential stealers and botnet clients. It flags discrepancies like Windows tools coded in Go or dubious repository topics such as thread hijacking.

The workflow focuses on non-executable inspection. It details checks for obfuscation, process memory manipulation, and direct WinAPI calls such as `VirtualAllocEx` or `CreateProcessW`. To minimize exposure, the guide recommends querying the GitHub API and VirusTotal rather than downloading suspicious files directly.

Cloning this code onto your primary workstation is unsafe. All behavioral tests belong exclusively inside an isolated virtual machine or sandbox.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-investigation -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/bitdefender-malware-investigation/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/bitdefender-malware-investigation/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-investigation -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/bitdefender-malware-investigation/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-investigation -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/bitdefender-malware-investigation/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills bitdefender-malware-investigation
```

2. **Manually: put the files in place**
- File: `.github/skills/bitdefender-malware-investigation/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-investigation -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/bitdefender-malware-investigation
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/bitdefender-malware-investigation/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill bitdefender-malware-investigation -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/bitdefender-malware-investigation/SKILL.md

## When to use it
- identify trojan indicators in counterfeit antivirus software
- extract C2 network endpoints using pattern matching
- audit source code for Windows process injection techniques
- compile abuse reports for GitHub and the impersonated software vendor

## Example prompts
- Audit this fake Bitdefender crack repository for trojan delivery mechanisms
- Extract suspicious network indicators and API calls from this Go project
- Draft an abuse report for GitHub regarding a malicious cracking tool

## Similar
- [git-guardrails-claude-code](https://affpapa.org/en/nevibecode/skills/git-guardrails-claude-code.md) — skill · 499069 installs
- [ponytail-review](https://affpapa.org/en/nevibecode/skills/ponytail-review.md) — skill · 57000 installs
- [ponytail-audit](https://affpapa.org/en/nevibecode/skills/ponytail-audit.md) — skill · 45400 installs
- [security-audit](https://affpapa.org/en/nevibecode/skills/cloudflare-security-audit.md) — skill · 54800 installs
- [security-and-hardening](https://affpapa.org/en/nevibecode/skills/security-and-hardening.md) — skill · 70200 installs
- [supabase](https://affpapa.org/en/nevibecode/skills/supabase.md) — skill · 8 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 69 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md