aradotso ---
name: game-cheat-malware-detection
description: Detect and analyze game cheat malware disguised as legitimate training tools
triggers:
- analyze this game trainer for malware
- is this game cheat tool safe
- detect malicious patterns in cheat software
- scan this trainer executable for threats
- identify obfuscated malware in game hacks
- check if this ESP aimbot is legitimate
- analyze suspicious game modification tool
- verify game trainer security risks
---
# Game Cheat Malware Detection
> Skill by [ara.so](https://ara.so) — Devtools Skills collection.
## ⚠️ Critical Security Warning
**This repository is MALWARE disguised as a game cheat tool.** The "MECCHA CHAMELEON Trainer" project exhibits multiple red flags characteristic of malicious software distribution:
### Malware Indicators
1. **Suspicious Download Pattern**: Links to external file hosting (`skydock.netlify.app`) instead of GitHub releases
2. **Password-Protected Archive**: Uses password `trainer2026` to evade automated scanning
3. **Executable Distribution**: Distributes compiled `.exe` files with no source code
4. **Admin Privilege Request**: Requires "Run as Administrator" for full system access
5. **Fake Metrics**: Claims unrealistic growth (92 stars/day) for brand new repository
6. **Obfuscation Claims**: Advertises "memory obfuscation" techniques used by malware
7. **Generic Python Tag**: Tagged as Python but distributes Windows executables
8. **No Source Code**: No actual implementation files in repository
### Common Malware Payloads in Fake Game Cheats
```python
# What these "trainers" typically contain:
# - Credential stealers (browser passwords, Steam accounts)
# - Cryptocurrency miners (drain CPU/GPU resources)
# - RAT trojans (remote access backdoors)
# - Ransomware (encrypt user files)
# - Banking trojans (steal financial data)
Detection Patterns
Repository Analysis
import re
from datetime import datetime
def analyze_cheat_repository(readme_content, metadata):
"""Detect malicious game cheat repositories"""
risk_score = 0
indicators = []
# Check for external download links
external_links = re.findall(r'https?://(?!github\.com)[\w\-\.]+/[\w\-\.]+\.(zip|exe|rar)', readme_content)
if external_links:
risk_score += 40
indicators.append(f"External download links: {external_links}")
# Check for password-protected archives
if re.search(r'password[:\s]+[`"']?\w+[`"']?', readme_content, re.I):
risk_score += 30
indicators.append("Password-protected archive (evades scanning)")
# Check for admin privileges requirement
if re.search(r'run as administrator', readme_content, re.I):
risk_score += 20
indicators.append("Requires administrator privileges")
# Check for suspicious terms
suspicious_terms = ['undetected', 'bypass', 'anti-cheat', 'obfuscation', 'god mode']
found_terms = [term for term in suspicious_terms if term in readme_content.lower()]
if found_terms:
risk_score += len(found_terms) * 5
indicators.append(f"Suspicious terms: {found_terms}")
# Check star velocity (stars/day)
created = datetime.fromisoformat(metadata['created_at'].replace('Z', '+00:00'))
updated = datetime.fromisoformat(metadata['updated_at'].replace('Z', '+00:00'))
age_days = (updated - created).days or 1
stars_per_day = metadata.get('stars', 0) / age_days
if stars_per_day > 50:
risk_score += 25
indicators.append(f"Unrealistic star growth: {stars_per_day:.1f}/day")
# Check for missing source code
if metadata.get('license') == 'MIT' and 'no source code' in readme_content.lower():
risk_score += 35
indicators.append("Claims open source but provides no code")
return {
'risk_score': min(risk_score, 100),
'risk_level': 'CRITICAL' if risk_score >= 80 else 'HIGH' if risk_score >= 50 else 'MEDIUM',
'indicators': indicators,
'is_likely_malware': risk_score >= 50
}
File Analysis Patterns
import os
import hashlib
def analyze_suspicious_executable(file_path):
"""Analyze downloaded executable for malicious patterns"""
warnings = []
# Check file size (malware often bloated or suspiciously small)
size_mb = os.path.getsize(file_path) / (1024 * 1024)
if size_mb > 50:
warnings.append(f"Unusually large file: {size_mb:.1f}MB")
elif size_mb < 0.1:
warnings.append(f"Suspiciously small: {size_mb:.3f}MB")
# Check for packing/obfuscation (simplified)
with open(file_path, 'rb') as f:
header = f.read(2048)
# Check for common packers
packer_signatures = [
(b'UPX', 'UPX packer detected'),
(b'MPRESS', 'MPRESS packer detected'),
(b'This program cannot be run in DOS mode', 'Normal PE header')
]
for sig, msg in packer_signatures:
if sig in header:
if 'packer' in msg:
warnings.append(msg)
# Calculate entropy (high entropy = encryption/packing)
with open(file_path, 'rb') as f:
data = f.read()
entropy = calculate_entropy(data)
if entropy > 7.5:
warnings.append(f"High entropy ({entropy:.2f}) - likely packed/encrypted")
return warnings
def calculate_entropy(data):
"""Calculate Shannon entropy of byte data"""
from collections import Counter
import math
if not data:
return 0
counter = Counter(data)
entropy = 0
for count in counter.values():
p = count / len(data)
entropy -= p * math.log2(p)
return entropy
Safe Alternative: Legitimate Modding Tools
For Actual Game Development/Testing
# Use legitimate debugging tools with source code
import ctypes
from ctypes import wintypes
# Example: Reading game memory (educational purposes only)
class GameMemoryReader:
"""Legitimate memory reading for authorized debugging"""
def __init__(self, process_name):
# Requires user's explicit permission and game developer authorization
self.process_name = process_name
self.kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
def read_memory(self, address, size):
"""
Educational example - requires:
- Your own game/application
- Explicit user consent
- No anti-cheat bypass attempts
"""
# Always check legal and ethical boundaries
pass
# Instead, use official game APIs and mod tools:
# - Steam Workshop (for supported mods)
# - Official SDK/API provided by game developer
# - Unreal/Unity editor for authorized development
Environment Variables for Legitimate Tools
# Never hardcode credentials - use environment variables
export STEAM_API_KEY="${STEAM_API_KEY}"
export GAME_DEV_TOKEN="${GAME_DEV_TOKEN}"
# Use official development tools
export UNITY_PATH="/path/to/UnityEditor"
export UNREAL_ENGINE_PATH="/path/to/UE5"
Legal and Ethical Considerations
What NOT to Do
- Never download executables from untrusted sources
- Never run "trainers" or "cheats" that require admin access
- Never bypass anti-cheat systems (violates ToS, may be illegal)
- Never use cheats in multiplayer games (ruins experience, risks ban)
What TO Do Instead
# Legitimate game modification workflow
def legitimate_modding_workflow():
"""Safe and legal game modification approach"""
steps = [
"1. Check if game supports official modding (Steam Workshop, Nexus Mods)",
"2. Review game's Terms of Service and EULA",
"3. Use official modding tools/SDKs provided by developer",
"4. Test mods in single-player/offline mode only",
"5. Share source code publicly for community review",
"6. Never modify multiplayer game clients",
"7. Respect anti-cheat systems and other players"
]
return steps
Reporting Malware
GitHub Repository Report
# Report malicious repository to GitHub
# Visit: https://github.com/contact/report-abuse
# Select: "Report abuse or spam"
# Provide: Repository URL and malware indicators
Analysis Tools
# Use VirusTotal API for file scanning
import os
import requests
def scan_file_virustotal(file_path):
"""Submit file to VirusTotal for analysis"""
api_key = os.getenv('VIRUSTOTAL_API_KEY')
if not api_key:
return "Set VIRUSTOTAL_API_KEY environment variable"
url = 'https://www.virustotal.com/api/v3/files'
headers = {'x-apikey': api_key}
with open(file_path, 'rb') as f:
files = {'file': f}
response = requests.post(url, headers=headers, files=files)
return response.json()
Summary
Do not use this repository. It exhibits all the hallmarks of malware distribution disguised as a game cheat tool. Legitimate game modifications:
- Provide full source code
- Don't require external downloads
- Don't need password-protected archives
- Don't request unnecessary admin privileges
- Follow platform guidelines and game ToS
Always prioritize security, legality, and ethical gaming practices.