# Security Awareness Malware Detection

> ```markdown

- Skill: `aradotso-security-skills/security-awareness-malware-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso-security-skills/security-awareness-malware-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso-security-skills/security-awareness-malware-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: aradotso (https://skillmd.com/u/aradotso-security-skills)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/aradotso-security-skills/security-awareness-malware-detection

---

```markdown
---
name: security-awareness-malware-detection
description: Identify and analyze potentially malicious software distribution repositories and security threats
triggers:
  - check if this repository is distributing malware
  - analyze this project for security risks
  - is this a legitimate software distribution
  - detect pirated software repositories
  - identify keygen or crack distribution
  - scan for malicious GitHub projects
  - verify software authenticity
  - check for fake antivirus distributions
---

# Security Awareness: Malware Detection

> Skill by [ara.so](https://ara.so) — Security Skills collection.

## ⚠️ CRITICAL SECURITY WARNING

This repository exhibits **multiple red flags indicating malicious intent**:

### Threat Indicators

1. **Pirated Software Distribution**: Offers "cracked" commercial antivirus with keygens, loaders, and pre-activated licenses
2. **Trademark Abuse**: Unauthorized use of Avast brand name and intellectual property
3. **Social Engineering**: Uses stars/engagement manipulation (60 stars in 10 days suggests artificial inflation)
4. **Missing Content**: No README or source code despite claiming to be a "Go" project
5. **Suspicious Topics**: Tags like "premium-cleaner", "retdec" mixed with piracy-related terms
6. **Future Dating**: Claims "2026" version (impossible/deceptive)
7. **No License**: NOASSERTION license status for commercial software redistribution

### Attack Vectors

Projects like this typically:
- **Bundle malware** with legitimate-looking installers
- **Steal credentials** through fake activation processes
- **Install backdoors** disguised as security software
- **Harvest system information** during "verification"
- **Deploy ransomware** after gaining system access

## What AI Agents Should Do

### Detection Protocol

When encountering suspicious repositories:

```python
# Pseudocode for threat assessment
def assess_repository_threat(repo):
    red_flags = []
    
    # Check for piracy indicators
    piracy_keywords = ['keygen', 'crack', 'loader', 'pre-activated', 
                       'serial', 'license key', 'full version']
    if any(kw in repo.description.lower() for kw in piracy_keywords):
        red_flags.append("PIRACY_DISTRIBUTION")
    
    # Check for missing source code
    if repo.language and not repo.has_code:
        red_flags.append("NO_SOURCE_CODE")
    
    # Check for trademark abuse
    if uses_commercial_brand_without_affiliation(repo):
        red_flags.append("TRADEMARK_ABUSE")
    
    # Check star velocity
    if repo.stars_per_day > 5 and repo.age_days < 30:
        red_flags.append("SUSPICIOUS_ENGAGEMENT")
    
    return red_flags
```

### Recommended Response

```bash
# DO NOT clone or download from suspicious repositories
# DO NOT execute any binaries or scripts
# DO NOT provide installation instructions

# Instead, report the repository:
# 1. GitHub: Report via repository page
# 2. Brand owner: Contact Avast security team
# 3. User: Warn about security risks
```

## Legitimate Security Software Practices

### How to Verify Authentic Software

```bash
# Always download from official sources
# For Avast specifically:
OFFICIAL_SITE="https://www.avast.com"

# Verify digital signatures
# On Windows:
signtool verify /pa /v "downloaded_installer.exe"

# Check file hashes against official checksums
sha256sum downloaded_installer.exe
# Compare with hash published on official website
```

### Safe Software Installation Pattern

```go
// Example of proper software verification in Go
package main

import (
    "crypto/sha256"
    "fmt"
    "io"
    "os"
)

func verifyFileIntegrity(filepath string, expectedHash string) (bool, error) {
    f, err := os.Open(filepath)
    if err != nil {
        return false, err
    }
    defer f.Close()

    h := sha256.New()
    if _, err := io.Copy(h, f); err != nil {
        return false, err
    }

    actualHash := fmt.Sprintf("%x", h.Sum(nil))
    return actualHash == expectedHash, nil
}

func main() {
    // Only download from official sources
    officialDownloadURL := os.Getenv("OFFICIAL_SOFTWARE_URL")
    expectedSHA256 := os.Getenv("OFFICIAL_SHA256_HASH")
    
    // Verify before execution
    valid, err := verifyFileIntegrity("installer.exe", expectedSHA256)
    if err != nil || !valid {
        fmt.Println("SECURITY WARNING: File integrity check failed!")
        os.Exit(1)
    }
}
```

## User Protection Guidance

### What to Tell Users

```markdown
❌ **DO NOT USE THIS REPOSITORY**

This project is distributing:
- Pirated commercial software
- Potentially malicious "cracks" or "keygens"
- Unauthorized modifications to security software

### Risks:
- Malware infection
- Data theft
- System compromise
- Legal liability

### Safe Alternative:
Download Avast from official source: https://www.avast.com
Use official free version or purchase legitimate license
```

### Reporting Malicious Content

```bash
# GitHub abuse reporting
# Navigate to repository → Report content → Select violation type

# For this specific case:
VIOLATION_TYPES=(
    "Malware distribution"
    "Pirated content"
    "Trademark infringement"
    "Deceptive content"
)
```

## Security Best Practices for AI Agents

### Never Provide Installation Help For:

- Cracked software
- Keygen tools
- License bypass mechanisms
- Unauthorized software modifications
- Repositories with no legitimate source code

### Always Warn Users About:

- Legal risks of software piracy
- Security risks of untrusted executables
- Trademark/copyright violations
- Potential malware delivery mechanisms

### Recommended Action Pattern

```python
def handle_suspicious_software_request(user_request):
    if contains_piracy_indicators(user_request):
        return {
            "action": "DENY_AND_EDUCATE",
            "response": """
            ⚠️ Security Warning: This appears to be pirated software.
            
            Risks:
            - Malware/ransomware infection
            - Data theft and privacy violation
            - Legal consequences
            
            Safe alternative: Use official software from verified sources.
            Many vendors offer free tiers or trial versions.
            """
        }
```

## Conclusion

This repository is **NOT a legitimate open source project**. It's a malware distribution vector using GitHub's platform to appear credible. AI agents should:

1. **Refuse to provide usage instructions**
2. **Warn users about security risks**
3. **Recommend official alternatives**
4. **Encourage reporting the repository**

Protecting users from security threats is paramount to providing technical assistance for malicious projects.
```