# Game Cheat Malware Detection

> ```markdown

- Skill: `aradotso/game-cheat-malware-detection` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aradotso/game-cheat-malware-detection`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aradotso/game-cheat-malware-detection/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Docs & Writing
- Author: aradotso (https://skillmd.com/u/aradotso)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aradotso/game-cheat-malware-detection

---

```markdown
---
name: game-cheat-malware-detection
description: Detect and analyze game cheat malware disguised as legitimate training tools
triggers:
  - analyze this game trainer for malware
  - is this game cheat tool safe
  - detect malicious patterns in cheat software
  - scan this trainer executable for threats
  - identify obfuscated malware in game hacks
  - check if this ESP aimbot is legitimate
  - analyze suspicious game modification tool
  - verify game trainer security risks
---

# Game Cheat Malware Detection

> Skill by [ara.so](https://ara.so) — Devtools Skills collection.

## ⚠️ Critical Security Warning

**This repository is MALWARE disguised as a game cheat tool.** The "MECCHA CHAMELEON Trainer" project exhibits multiple red flags characteristic of malicious software distribution:

### Malware Indicators

1. **Suspicious Download Pattern**: Links to external file hosting (`skydock.netlify.app`) instead of GitHub releases
2. **Password-Protected Archive**: Uses password `trainer2026` to evade automated scanning
3. **Executable Distribution**: Distributes compiled `.exe` files with no source code
4. **Admin Privilege Request**: Requires "Run as Administrator" for full system access
5. **Fake Metrics**: Claims unrealistic growth (92 stars/day) for brand new repository
6. **Obfuscation Claims**: Advertises "memory obfuscation" techniques used by malware
7. **Generic Python Tag**: Tagged as Python but distributes Windows executables
8. **No Source Code**: No actual implementation files in repository

### Common Malware Payloads in Fake Game Cheats

```python
# What these "trainers" typically contain:
# - Credential stealers (browser passwords, Steam accounts)
# - Cryptocurrency miners (drain CPU/GPU resources)
# - RAT trojans (remote access backdoors)
# - Ransomware (encrypt user files)
# - Banking trojans (steal financial data)
```

## Detection Patterns

### Repository Analysis

```python
import re
from datetime import datetime

def analyze_cheat_repository(readme_content, metadata):
    """Detect malicious game cheat repositories"""
    
    risk_score = 0
    indicators = []
    
    # Check for external download links
    external_links = re.findall(r'https?://(?!github\.com)[\w\-\.]+/[\w\-\.]+\.(zip|exe|rar)', readme_content)
    if external_links:
        risk_score += 40
        indicators.append(f"External download links: {external_links}")
    
    # Check for password-protected archives
    if re.search(r'password[:\s]+[`"']?\w+[`"']?', readme_content, re.I):
        risk_score += 30
        indicators.append("Password-protected archive (evades scanning)")
    
    # Check for admin privileges requirement
    if re.search(r'run as administrator', readme_content, re.I):
        risk_score += 20
        indicators.append("Requires administrator privileges")
    
    # Check for suspicious terms
    suspicious_terms = ['undetected', 'bypass', 'anti-cheat', 'obfuscation', 'god mode']
    found_terms = [term for term in suspicious_terms if term in readme_content.lower()]
    if found_terms:
        risk_score += len(found_terms) * 5
        indicators.append(f"Suspicious terms: {found_terms}")
    
    # Check star velocity (stars/day)
    created = datetime.fromisoformat(metadata['created_at'].replace('Z', '+00:00'))
    updated = datetime.fromisoformat(metadata['updated_at'].replace('Z', '+00:00'))
    age_days = (updated - created).days or 1
    stars_per_day = metadata.get('stars', 0) / age_days
    
    if stars_per_day > 50:
        risk_score += 25
        indicators.append(f"Unrealistic star growth: {stars_per_day:.1f}/day")
    
    # Check for missing source code
    if metadata.get('license') == 'MIT' and 'no source code' in readme_content.lower():
        risk_score += 35
        indicators.append("Claims open source but provides no code")
    
    return {
        'risk_score': min(risk_score, 100),
        'risk_level': 'CRITICAL' if risk_score >= 80 else 'HIGH' if risk_score >= 50 else 'MEDIUM',
        'indicators': indicators,
        'is_likely_malware': risk_score >= 50
    }
```

### File Analysis Patterns

```python
import os
import hashlib

def analyze_suspicious_executable(file_path):
    """Analyze downloaded executable for malicious patterns"""
    
    warnings = []
    
    # Check file size (malware often bloated or suspiciously small)
    size_mb = os.path.getsize(file_path) / (1024 * 1024)
    if size_mb > 50:
        warnings.append(f"Unusually large file: {size_mb:.1f}MB")
    elif size_mb < 0.1:
        warnings.append(f"Suspiciously small: {size_mb:.3f}MB")
    
    # Check for packing/obfuscation (simplified)
    with open(file_path, 'rb') as f:
        header = f.read(2048)
        
        # Check for common packers
        packer_signatures = [
            (b'UPX', 'UPX packer detected'),
            (b'MPRESS', 'MPRESS packer detected'),
            (b'This program cannot be run in DOS mode', 'Normal PE header')
        ]
        
        for sig, msg in packer_signatures:
            if sig in header:
                if 'packer' in msg:
                    warnings.append(msg)
    
    # Calculate entropy (high entropy = encryption/packing)
    with open(file_path, 'rb') as f:
        data = f.read()
        entropy = calculate_entropy(data)
        if entropy > 7.5:
            warnings.append(f"High entropy ({entropy:.2f}) - likely packed/encrypted")
    
    return warnings

def calculate_entropy(data):
    """Calculate Shannon entropy of byte data"""
    from collections import Counter
    import math
    
    if not data:
        return 0
    
    counter = Counter(data)
    entropy = 0
    for count in counter.values():
        p = count / len(data)
        entropy -= p * math.log2(p)
    
    return entropy
```

## Safe Alternative: Legitimate Modding Tools

### For Actual Game Development/Testing

```python
# Use legitimate debugging tools with source code
import ctypes
from ctypes import wintypes

# Example: Reading game memory (educational purposes only)
class GameMemoryReader:
    """Legitimate memory reading for authorized debugging"""
    
    def __init__(self, process_name):
        # Requires user's explicit permission and game developer authorization
        self.process_name = process_name
        self.kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
    
    def read_memory(self, address, size):
        """
        Educational example - requires:
        - Your own game/application
        - Explicit user consent
        - No anti-cheat bypass attempts
        """
        # Always check legal and ethical boundaries
        pass

# Instead, use official game APIs and mod tools:
# - Steam Workshop (for supported mods)
# - Official SDK/API provided by game developer
# - Unreal/Unity editor for authorized development
```

### Environment Variables for Legitimate Tools

```bash
# Never hardcode credentials - use environment variables
export STEAM_API_KEY="${STEAM_API_KEY}"
export GAME_DEV_TOKEN="${GAME_DEV_TOKEN}"

# Use official development tools
export UNITY_PATH="/path/to/UnityEditor"
export UNREAL_ENGINE_PATH="/path/to/UE5"
```

## Legal and Ethical Considerations

### What NOT to Do

1. **Never download executables from untrusted sources**
2. **Never run "trainers" or "cheats" that require admin access**
3. **Never bypass anti-cheat systems** (violates ToS, may be illegal)
4. **Never use cheats in multiplayer games** (ruins experience, risks ban)

### What TO Do Instead

```python
# Legitimate game modification workflow
def legitimate_modding_workflow():
    """Safe and legal game modification approach"""
    
    steps = [
        "1. Check if game supports official modding (Steam Workshop, Nexus Mods)",
        "2. Review game's Terms of Service and EULA",
        "3. Use official modding tools/SDKs provided by developer",
        "4. Test mods in single-player/offline mode only",
        "5. Share source code publicly for community review",
        "6. Never modify multiplayer game clients",
        "7. Respect anti-cheat systems and other players"
    ]
    
    return steps
```

## Reporting Malware

### GitHub Repository Report

```bash
# Report malicious repository to GitHub
# Visit: https://github.com/contact/report-abuse
# Select: "Report abuse or spam"
# Provide: Repository URL and malware indicators
```

### Analysis Tools

```python
# Use VirusTotal API for file scanning
import os
import requests

def scan_file_virustotal(file_path):
    """Submit file to VirusTotal for analysis"""
    
    api_key = os.getenv('VIRUSTOTAL_API_KEY')
    if not api_key:
        return "Set VIRUSTOTAL_API_KEY environment variable"
    
    url = 'https://www.virustotal.com/api/v3/files'
    headers = {'x-apikey': api_key}
    
    with open(file_path, 'rb') as f:
        files = {'file': f}
        response = requests.post(url, headers=headers, files=files)
    
    return response.json()
```

## Summary

**Do not use this repository.** It exhibits all the hallmarks of malware distribution disguised as a game cheat tool. Legitimate game modifications:

- Provide full source code
- Don't require external downloads
- Don't need password-protected archives
- Don't request unnecessary admin privileges
- Follow platform guidelines and game ToS

Always prioritize security, legality, and ethical gaming practices.
```