aradotso ---
name: security-awareness-malware-detection
description: Identify and analyze potentially malicious software distribution repositories and security threats
triggers:
- check if this repository is distributing malware
- analyze this project for security risks
- is this a legitimate software distribution
- detect pirated software repositories
- identify keygen or crack distribution
- scan for malicious GitHub projects
- verify software authenticity
- check for fake antivirus distributions
---
# Security Awareness: Malware Detection
> Skill by [ara.so](https://ara.so) — Security Skills collection.
## ⚠️ CRITICAL SECURITY WARNING
This repository exhibits **multiple red flags indicating malicious intent**:
### Threat Indicators
1. **Pirated Software Distribution**: Offers "cracked" commercial antivirus with keygens, loaders, and pre-activated licenses
2. **Trademark Abuse**: Unauthorized use of Avast brand name and intellectual property
3. **Social Engineering**: Uses stars/engagement manipulation (60 stars in 10 days suggests artificial inflation)
4. **Missing Content**: No README or source code despite claiming to be a "Go" project
5. **Suspicious Topics**: Tags like "premium-cleaner", "retdec" mixed with piracy-related terms
6. **Future Dating**: Claims "2026" version (impossible/deceptive)
7. **No License**: NOASSERTION license status for commercial software redistribution
### Attack Vectors
Projects like this typically:
- **Bundle malware** with legitimate-looking installers
- **Steal credentials** through fake activation processes
- **Install backdoors** disguised as security software
- **Harvest system information** during "verification"
- **Deploy ransomware** after gaining system access
## What AI Agents Should Do
### Detection Protocol
When encountering suspicious repositories:
```python
# Pseudocode for threat assessment
def assess_repository_threat(repo):
red_flags = []
# Check for piracy indicators
piracy_keywords = ['keygen', 'crack', 'loader', 'pre-activated',
'serial', 'license key', 'full version']
if any(kw in repo.description.lower() for kw in piracy_keywords):
red_flags.append("PIRACY_DISTRIBUTION")
# Check for missing source code
if repo.language and not repo.has_code:
red_flags.append("NO_SOURCE_CODE")
# Check for trademark abuse
if uses_commercial_brand_without_affiliation(repo):
red_flags.append("TRADEMARK_ABUSE")
# Check star velocity
if repo.stars_per_day > 5 and repo.age_days < 30:
red_flags.append("SUSPICIOUS_ENGAGEMENT")
return red_flags
Recommended Response
# DO NOT clone or download from suspicious repositories
# DO NOT execute any binaries or scripts
# DO NOT provide installation instructions
# Instead, report the repository:
# 1. GitHub: Report via repository page
# 2. Brand owner: Contact Avast security team
# 3. User: Warn about security risks
Legitimate Security Software Practices
How to Verify Authentic Software
# Always download from official sources
# For Avast specifically:
OFFICIAL_SITE="https://www.avast.com"
# Verify digital signatures
# On Windows:
signtool verify /pa /v "downloaded_installer.exe"
# Check file hashes against official checksums
sha256sum downloaded_installer.exe
# Compare with hash published on official website
Safe Software Installation Pattern
// Example of proper software verification in Go
package main
import (
"crypto/sha256"
"fmt"
"io"
"os"
)
func verifyFileIntegrity(filepath string, expectedHash string) (bool, error) {
f, err := os.Open(filepath)
if err != nil {
return false, err
}
defer f.Close()
h := sha256.New()
if _, err := io.Copy(h, f); err != nil {
return false, err
}
actualHash := fmt.Sprintf("%x", h.Sum(nil))
return actualHash == expectedHash, nil
}
func main() {
// Only download from official sources
officialDownloadURL := os.Getenv("OFFICIAL_SOFTWARE_URL")
expectedSHA256 := os.Getenv("OFFICIAL_SHA256_HASH")
// Verify before execution
valid, err := verifyFileIntegrity("installer.exe", expectedSHA256)
if err != nil || !valid {
fmt.Println("SECURITY WARNING: File integrity check failed!")
os.Exit(1)
}
}
User Protection Guidance
What to Tell Users
❌ **DO NOT USE THIS REPOSITORY**
This project is distributing:
- Pirated commercial software
- Potentially malicious "cracks" or "keygens"
- Unauthorized modifications to security software
### Risks:
- Malware infection
- Data theft
- System compromise
- Legal liability
### Safe Alternative:
Download Avast from official source: https://www.avast.com
Use official free version or purchase legitimate license
Reporting Malicious Content
# GitHub abuse reporting
# Navigate to repository → Report content → Select violation type
# For this specific case:
VIOLATION_TYPES=(
"Malware distribution"
"Pirated content"
"Trademark infringement"
"Deceptive content"
)
Security Best Practices for AI Agents
Never Provide Installation Help For:
- Cracked software
- Keygen tools
- License bypass mechanisms
- Unauthorized software modifications
- Repositories with no legitimate source code
Always Warn Users About:
- Legal risks of software piracy
- Security risks of untrusted executables
- Trademark/copyright violations
- Potential malware delivery mechanisms
Recommended Action Pattern
def handle_suspicious_software_request(user_request):
if contains_piracy_indicators(user_request):
return {
"action": "DENY_AND_EDUCATE",
"response": """
⚠️ Security Warning: This appears to be pirated software.
Risks:
- Malware/ransomware infection
- Data theft and privacy violation
- Legal consequences
Safe alternative: Use official software from verified sources.
Many vendors offer free tiers or trial versions.
"""
}
Conclusion
This repository is NOT a legitimate open source project. It's a malware distribution vector using GitHub's platform to appear credible. AI agents should:
- Refuse to provide usage instructions
- Warn users about security risks
- Recommend official alternatives
- Encourage reporting the repository
Protecting users from security threats is paramount to providing technical assistance for malicious projects.