# malware-analysis-dragonflyTomb-avast

A skill for pulling apart repositories that pose as antivirus installers. It helps you tell a fake distribution from the real thing.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 1000 installs · ★ 12
- Author: reason-machines
- License: LicenseRef-Unknown · policy=link-only · description only; the file stays with the author
- Source: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-analysis-dragonflyTomb-avast/SKILL.md
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/skills/malware-analysis-dragonflytomb-avast

## What it does

The skill walks through the DragonflyTomb/Avast-Premium-Security-2026 repository and lays out why it is not an official Avast Premium Security build. You get a checklist of red flags: words like "Keygen", "Pre-Activated", "Loader" and "Serial" in the name, a missing README, a NOASSERTION license on commercial software, and a "retdec" topic sitting next to an antivirus. Star inflation and the "2026" version label get their own section.

From there it moves into static analysis. On source code the skill suggests grepping for suspicious imports (`syscall`, `unsafe`, `os/exec`, `net/http`, `crypto/aes`), obfuscation markers (`base64`, XOR, decode) and persistence hooks such as the registry, Startup folder or Task Scheduler. A Go example hashes each file with SHA-256 and flags the suspicious ones in a directory tree.

Isolation is the part people skip. The skill recommends a container with networking off (`docker run -it --rm --network none golang:1.21`) and cloning the repository there without running it. Submitting a sample to VirusTotal needs the `VIRUSTOTAL_API_KEY` environment variable set, otherwise the example code returns an error. Open a repo like this on your daily machine and hit build, and you have thrown away the isolation the whole exercise depends on.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflytomb-avast -a claude-code
```
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/malware-analysis-dragonflyTomb-avast/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/malware-analysis-dragonflyTomb-avast/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/malware-analysis-dragonflyTomb-avast/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/malware-analysis-dragonflyTomb-avast/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install reason-machines/security-skills malware-analysis-dragonflyTomb-avast
```

2. **Manually: put the files in place**
- File: `.github/skills/malware-analysis-dragonflyTomb-avast/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/reason-machines/security-skills --path skills/malware-analysis-dragonflyTomb-avast
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/malware-analysis-dragonflyTomb-avast/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add reason-machines/security-skills --skill malware-analysis-dragonflyTomb-avast -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/reason-machines/security-skills/tree/HEAD/skills/malware-analysis-dragonflyTomb-avast/SKILL.md

## When to use it
- tell a fake antivirus installer from an official distribution
- find obfuscation markers in Go source
- check imports for `os/exec` and `net/http` before building
- hash a file with SHA-256 and record it for a report
- set up an isolated environment to examine a malicious repo

## Example prompts
- analyze this suspicious avast installer repository
- check if this security software repository is legitimate
- identify keygen and loader malware indicators in this Go code

## Similar
- [analyzing-packed-malware-with-upx-unpacker](https://affpapa.org/en/nevibecode/skills/analyzing-packed-malware-with-upx-unpacker.md) — skill · 303 installs
- [analyzing-linux-elf-malware](https://affpapa.org/en/nevibecode/skills/analyzing-linux-elf-malware.md) — skill · 457 installs
- [deep-analysis](https://affpapa.org/en/nevibecode/skills/deep-analysis.md) — skill · 516 installs
- [ctf-rev](https://affpapa.org/en/nevibecode/skills/ctf-rev.md) — skill · 321 installs
- [variant-analysis](https://affpapa.org/en/nevibecode/skills/variant-analysis.md) — skill · 6400 installs
- [constant-time-analysis](https://affpapa.org/en/nevibecode/skills/constant-time-analysis.md) — skill · 5400 installs

From the same set: [reason-machines/security-skills](https://affpapa.org/en/nevibecode/by/reason-machines/security-skills.md) — 17 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md