CuraSec

tag: Malware-Analysis · 4 items

Plan UAC-0099 embeds LLM-disrupting prompts in malware to blind AI analysis
2026-09-01 · The Hacker News · source ↗ #adversarial-ai#malware-analysis#uac-0099
  • Engineer — Learn: GuardBreaker shows that AI-assisted malware scanning can be manipulated at the artifact level; no patch or config change is needed today, but engineers building AI-augmented security pipelines should understand this evasion class.
  • SOC/IR — Plan: Review any AI/LLM-assisted triage or malware-analysis workflows and add a mandatory human-review layer for suspected APT samples — do not treat LLM output as authoritative when analyzing artifacts from sophisticated actors.
  • Leader — Learn: Adversaries are now actively engineering around AI-assisted defenses; file this as context for future AI-tool procurement and policy decisions around over-reliance on LLM-based analysis in SOC operations.
Learn SANS ISC: Malicious PE file compiler statistics overview
2026-08-28 · SANS ISC · source ↗ #malware-analysis#pe-format#threat-research
  • Engineer — Skip
  • SOC/IR — Learn: Compiler and PE header metadata distributions across malicious samples can inform triage heuristics; useful background for analysts who build or tune static detection rules, but yields no immediate detection action.
  • Leader — Skip
Learn archived SANS ISC: Testing Gemma4/Ollama for malware hash analysis via DShield
2026-08-13 · SANS ISC · source ↗ #ai-tooling#malware-analysis#threat-intel
  • Engineer — Learn: Practical walkthrough of using a local LLM to enrich malware hashes against VirusTotal and CyberGordon — worth evaluating if you’re building AI-assisted triage pipelines, but no patch or configuration action required.
  • SOC/IR — Learn: Demonstrates an accessible approach to AI-assisted hash triage using Ollama and Gemma4 locally; useful context for analysts evaluating LLM integration into enrichment workflows, but yields no immediate detection or hunt action.
  • Leader — Skip
Learn archived Malaika: LLM Multi-Agent Framework for Android Malware Behavior Analysis
2026-07-13 · arXiv cs.CR · source ↗ #malware-analysis#llm-security#static-analysis
  • Engineer — Learn: Academic research on grounded agentic reasoning for malware behavior reconstruction; no immediate engineering action, but the tri-grounding approach (domain, semantics, knowledge) is worth noting when evaluating LLM-assisted code-analysis tooling.
  • SOC/IR — Learn: Malaika’s behavior-reconstruction framing — connecting sparse program evidence to auditable behavioral conclusions — could inform how teams structure LLM-assisted malware triage workflows, though no detection or hunt action is available from this paper alone.
  • Leader — Skip