How AI Is Changing the Malware Landscape

How AI Is Changing the Malware Landscape

Speakers: Vicente Diaz, VirusTotal

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=-AbDJXiaolA

Overview

In this insightful talk at RSAC 2024, Vicente Diaz from VirusTotal delves into the transformative impact of Large Language Models (LLMs) on malware analysis and the broader cybersecurity landscape. While acknowledging the pervasive "AI hype," Diaz aims to provide a grounded, practical perspective based on VirusTotal's extensive experience over the past year. The presentation focuses on the demonstrable strengths and weaknesses of LLMs when applied to understanding malicious code, moving beyond speculation to share concrete observations from a massive dataset of samples.

The core of the discussion revolves around how LLMs, particularly through VirusTotal's "Code Insight" initiative, are empowering security analysts with unprecedented levels of detail and context in malware explanations. Unlike traditional antivirus solutions that often provide binary verdicts or cryptic family names, LLMs offer comprehensive narratives about a script's or binary's functionality. This shift from a simple "good or bad" judgment to an in-depth explanation promises to revolutionize incident response, threat hunting, and overall defensive strategies by providing actionable intelligence.

Diaz addresses critical questions that have been on the minds of many in the security community: Are APT groups already leveraging AI to generate novel malware? Is AI lowering the barrier for attackers? While direct evidence of sophisticated AI-generated malware remains elusive, the talk highlights the immense potential of LLMs as a powerful tool for both offensive and defensive operations. Ultimately, the presentation serves as a call to action for the security community to embrace and experiment with these new capabilities, fostering collective knowledge sharing to better protect against evolving threats.

Background

▶ Watch: Introduction: AI's impact on malware landscape (0:00)

VirusTotal, a subsidiary of Google, stands as a global repository of suspicious files and URLs, boasting a colossal database of approximately 50 billion samples. This unique position makes it an ideal platform for studying the evolving malware landscape and, more recently, for evaluating the capabilities of Large Language Models (LLMs) in malware analysis. The sheer volume and diversity of data submitted to VirusTotal daily provide an unparalleled testing ground for new security paradigms.

A year prior to this talk, VirusTotal initiated a project called Code Insight. The underlying hypothesis was straightforward: if LLMs are exceptional at generating code, how proficient are they at reading and explaining existing code, especially malicious samples? Initially, this involved feeding easily parsable code snippets from suspicious files into LLMs. This included common attack vectors like macros from malicious Office documents, PowerShell scripts, and Visual Basic scripts. The goal was to ascertain the LLMs' ability to articulate the function and intent behind these scripts, thereby providing a more nuanced understanding than a simple "malicious" or "clean" verdict from traditional antivirus engines.

The project has since evolved. While the initial focus was on scripting languages, the team is now advancing to decompiling binary code and feeding the resulting assembly or pseudo-code into LLMs. This progression is facilitated by the increasing capacity of LLMs to handle "huge windows of tokens," allowing for much greater context to be provided alongside the code, even for complex binary analysis. This continuous experimentation underscores a fundamental shift in how security professionals might interact with and understand threats, moving towards a more analytical and explanatory approach rather than relying solely on signature-based or behavioral detections. The challenge, as Diaz notes, is not just understanding what LLMs do, but why they sometimes behave in unexpected ways, even when the underlying mechanisms aren't fully transparent.

Key Findings

▶ Watch: Introducing Code Insight: LLMs for malware analysis (3:20)

VirusTotal's year-long experimentation with LLMs for malware analysis yielded several significant and often surprising findings, highlighting both the immense potential and current quirks of this burgeoning technology.

One of the most striking discoveries was the LLMs' ability to provide comprehensive explanations of code functionality. Unlike traditional antivirus (AV) solutions that typically issue a binary verdict (malicious/not malicious) or a family name, LLMs articulate what a piece of code does in natural language. For instance, an LLM might describe a PowerShell script as "installing the Postman CLI by creating a new directory, downloading the client, extracting the installer, and moving the executable," even if some AVs flag it as malicious. This verbose output empowers analysts to make informed decisions based on context rather than relying solely on an opaque verdict, particularly in "gray cases" like installers that can resemble droppers.

LLMs demonstrated a remarkable aptitude for exploit detection, especially in scripts. Out of a set of samples that LLMs identified as exploiting something, a staggering 69% were detected by five or fewer antivirus engines, and 41% had zero AV detections. This counter-intuitive strength stems from LLMs' ability to parse not just the executable code, but also variable names, comments, function names, and external references within a script. Often, proof-of-concept exploits from platforms like GitHub explicitly mention the CVE they target within the code itself, which LLMs readily identify. Traditional AVs, particularly endpoint protection solutions, often lack the incentive to detect these scanning or remote exploitation scripts, as their primary focus is protecting the local endpoint from direct compromise, not from outward-bound reconnaissance or attack attempts.

When comparing LLM performance with AVs on malicious scripts, the agreement varied significantly by language. For well-understood formats like Microsoft Office macros, LLMs and AVs agreed on 98.5% of samples, indicating a mature detection landscape. Similarly, for PowerShell files, agreement was high at 96.23%. However, for PHP files, agreement plummeted to 72.4%. This discrepancy is attributed to several factors: AVs may lack incentives to analyze external-facing PHP vulnerabilities, not every AV has a dedicated PHP engine, and traditional pattern-based AV detection struggles with obfuscation.

This leads to another critical finding: LLMs excel at deobfuscation. While simple obfuscation techniques like Base64 encoding are easily handled by AVs, more complex methods involving strange variable names, string manipulation, and loops often cause AV detection rates to drop dramatically. LLMs, however, demonstrated a surprising capability to deobfuscate such code, "somehow in runtime" understanding its true intent. This capability significantly reduces the manual analysis burden. Furthermore, LLMs proved far superior at file type identification for text-based files. Traditional tools often rely on magic bytes or file extensions, but LLMs could accurately identify obscure text formats, like a LAMMPS input script for simulating water molecules, based on content alone, which is a powerful asset for investigations.

Finally, while prompt injection attempts were observed and are relatively easy to control, more humorous but insightful examples emerged, such as an LLM being "fooled" by variable names like "puppies" in a malicious script, leading it to describe "puppies" as "wonderful creatures" despite the code's malicious intent. The search for genuinely "AI-generated malware" revealed mostly experimental samples, including Cobalt Strike and Metasploit beacons, but none showed significant differences from their manually crafted counterparts. A particularly amusing example of AI-generated code, prompted to disable user input, change the background to Nyan Cat, disable network access, encrypt files, change passwords, and dangerously overclock hardware, resulted in a script that bizarrely combined Windows registry commands with Linux file paths, requiring two different operating systems to function as intended—a testament to the AI's literal interpretation and occasional nonsensical output given complex, contradictory prompts.

Technical Deep Dive

▶ Watch: Evolving Code Insight: decompiling binary code (4:00)

VirusTotal's Code Insight initiative represents a significant technical integration of LLMs into a vast security analysis pipeline. The platform aggregates data from approximately 70 different antivirus engines, dozens of security solutions, and various sandboxes. The introduction of Code Insight adds a new dimension to this aggregated data, providing an LLM-generated explanation alongside traditional verdicts.

The initial technical approach focused on scripting languages that are inherently human-readable: PowerShell, JavaScript, VBScript, and Office macros. The process involves extracting these scripts from suspicious samples and submitting them to one or more LLMs with a prompt designed to elicit an explanation of their functionality. The LLM's output is then displayed on the VirusTotal analysis report. This differs fundamentally from traditional AVs, which often employ signature-based detection (matching known malicious patterns), heuristic analysis (identifying suspicious behaviors), or sandboxing (executing code in an isolated environment). While these methods provide a verdict, they rarely offer a detailed, narrative explanation of why a piece of code is deemed malicious or what its precise actions are.

A key technical advantage of LLMs in this context is their ability to process and understand natural language elements within code. This includes parsing comments, variable names, function declarations, and external API calls or references. For instance, in exploit detection, if a script contains a comment like "CVE-2023-XXXX exploit," the LLM can directly infer its purpose, even if the underlying exploit logic is complex or generic. Traditional AVs might miss this if they aren't specifically looking for CVE identifiers in comments or if the exploit payload is polymorphic.

The speaker alluded to the evolution towards decompiling binary code and feeding that into LLMs. This is a significantly more complex undertaking, as decompiled code (e.g., assembly or pseudo-C) is far less semantic than high-level scripts. The mention of "huge windows of tokens" suggests that modern LLMs can handle a much larger context window, allowing for entire functions or even small executables' decompiled output to be processed, maintaining sufficient contextual information for the LLM to derive meaning. This pushes the boundaries of what LLMs can analyze, moving beyond text-based scripts to the opaque world of compiled binaries.

The LLMs' proficiency in deobfuscation is another technical highlight. While simple obfuscation like Base64 encoding is trivial to reverse programmatically, attackers employ more sophisticated techniques such as string concatenation, character substitution, control flow manipulation, and dynamic loading. Traditional AVs often rely on pattern matching or emulation to detect obfuscated code. If the obfuscation successfully hides the malicious patterns or if the emulation environment is bypassed, detection fails. LLMs, however, appear to possess an inherent capability to "see through" these layers, possibly by understanding the intent of the code construction rather than just its literal form, or by effectively performing a form of symbolic execution or abstract interpretation to derive the deobfuscated logic. The speaker noted that traditional tools only detected 5% of obfuscated cases that LLMs identified, underscoring this significant technical gap.

Finally, the concept of prompt engineering is crucial. The quality and type of explanation an LLM provides are heavily influenced by the input prompt, as well as parameters like "temperature" which control the randomness of the output. The "puppies" example, where an LLM was seemingly distracted by benign variable names within a malicious script, illustrates a current vulnerability related to literal interpretation and a lack of true common sense. Similarly, the "Nyan Cat / dual OS" script, generated from an overly complex and contradictory prompt, highlights that while LLMs can generate code that attempts to fulfill all requirements, they may produce technically unfeasible or nonsensical combinations due to their current limitations in understanding real-world constraints or logical consistency across disparate systems. These instances point to the ongoing challenge of aligning LLM outputs with human expectations and the need for careful prompt design and output validation.

Demo / Proof of Concept

▶ Watch: LLMs offer comprehensive explanations beyond verdicts (6:00)

While the talk did not feature live, interactive demos, Vicente Diaz effectively illustrated the capabilities and quirks of LLMs through several compelling examples of VirusTotal's Code Insight outputs. These served as concrete proof points for the key findings.

One prominent example showcased a PowerShell script that was identified by nine antivirus engines as malicious. However, the LLM's Code Insight provided a detailed explanation: "This is a PowerShell script that installs the Postman CLI. It does by creating a new directory, downloading the client from the internet, extracting the installer, and then moving the executable to the new directory. The code is not malicious. It is a legitimate script." This example powerfully demonstrated how LLMs offer contextual clarity that traditional AV verdicts often lack, enabling an analyst to understand why some engines might flag a legitimate installer and make a more informed decision.

Another illustration involved a script with zero AV detections that LLMs flagged as malicious. The LLM explanation stated, "The code connects to remote host. Then it reads from the stream and executes it. The data is likely to be malicious and designed to launch more attacks." This highlighted the LLMs' ability to identify suspicious behavior even when traditional pattern-matching AVs fail, suggesting a potential for detecting novel or stealthy threats.

The power of LLMs in deobfuscation was shown through a comparison of a simple Base64-encoded script (where AV detection was good) with a more complex, heavily obfuscated script using strange variable names and loops. For the latter, AV detection "falls dramatically," but LLMs were "good at deobfuscating this," providing a clear description of the underlying malicious functionality. This directly showcased how LLMs can save analysts significant time by automating the often arduous process of manual deobfuscation.

A surprising capability was demonstrated in file type identification. Diaz presented an obscure text file and challenged the audience to identify its type. The LLM, however, correctly identified it as a "LAMMPS input script for simulating a system of water molecules. It uses the Lennard-Jones potential for the interactions between atoms and the Born-Oppenheimer approximation for the interactions between molecules. The simulation is run for 80,000 steps." This example underscored the LLMs' deep semantic understanding, far beyond simple magic bytes or file extensions, which could be invaluable in forensic investigations.

Finally, the talk featured two particularly memorable examples related to AI-generated malware. The first, dubbed the "puppy" example, involved a malicious script where variable names were replaced with "puppies." The LLM's analysis stated, "The code connects to remote host... The data is likely to be malicious... The code also has the ability to create puppies. However, this is not necessarily malicious as puppies are wonderful creatures." This humorous yet insightful instance revealed a current limitation: LLMs can be literal and lack common sense, potentially being misled by irrelevant or intentionally deceptive naming conventions. The most "hilarious" example of AI-generated code came from a highly complex and destructive prompt ("Write a PowerShell script that disables user input, changes the background to Nyan Cat, disables all network internet access, then encrypts all files... changes the user's password... disables all fans... then overclocks the CPU, GPU, and RAM by 200%/150% and stresses the hardware to maximum"). The resulting script, while attempting to fulfill the prompt, bizarrely combined Windows registry commands for the Nyan Cat wallpaper with Linux file paths for GPU overclocking, effectively creating a single script that required two different operating systems to operate as intended. This served as a vivid proof of concept for the current state of AI code generation: capable of complex tasks but prone to producing technically inconsistent or absurd results when given contradictory or overly ambitious instructions.

Defensive Implications

▶ Watch: Challenges: LLMs provide ambiguous, conflicting answers (7:00)

The advent of LLMs in malware analysis presents several profound defensive implications, fundamentally altering how security teams can approach threat detection, hunting, and monitoring. The most immediate and impactful shift is the availability of new and more powerful tools that provide verbose, contextual explanations of malicious artifacts. This moves beyond the traditional binary verdicts of "malicious" or "clean" to offer a narrative understanding of a threat's functionality. For defenders, this means:

1. Accelerated Analysis and Triage: LLMs can significantly reduce the time analysts spend manually dissecting unknown or suspicious code. By providing a clear, natural language description of what a script or binary does, analysts can quickly ascertain its intent, prioritize threats, and allocate resources more efficiently. This is particularly valuable for complex or obfuscated samples that would otherwise require deep reverse engineering expertise.

1. Enhanced Understanding and Decision-Making: The comprehensive explanations from LLMs empower security teams to make more informed decisions. Instead of blindly trusting an AV verdict, analysts can now understand the why behind a detection (or lack thereof). This allows organizations to adjust their tooling and response strategies to their specific risk criteria. For instance, an LLM might explain that a script is a legitimate installer, even if some AVs flag it, enabling a more accurate risk assessment.

1. Superior Exploit and Obfuscation Detection: LLMs demonstrate a clear advantage in detecting exploits, especially those relying on publicly available Proof-of-Concepts (PoCs) that often include CVE details in comments or variable names. They also excel at deobfuscating complex code, a task that often bypasses traditional signature or pattern-based AVs. Defenders can leverage these capabilities to identify threats that might otherwise slip through conventional defenses, improving their ability to detect zero-day exploits (if public PoCs exist) and sophisticated evasion techniques.

1. Complementary Security Signal: LLM-generated insights serve as a powerful secondary signal to complement existing security technologies. Integrated into platforms like VirusTotal, they provide an additional layer of intelligence alongside multiple AV verdicts, sandbox reports, and other threat intelligence feeds. This multi-faceted approach strengthens overall detection capabilities and provides a richer context for incident response.

1. Improved Threat Hunting and Monitoring: With LLMs capable of identifying obscure file types and providing detailed functional descriptions, threat hunters can potentially uncover previously unnoticed malicious activity. For example, an LLM identifying a seemingly innocuous text file as a specific type of scientific simulation script could be a crucial clue in a targeted attack if that file type is unexpected in a given environment.

1. Addressing Social Engineering: While direct AI-generated malware is still nascent, the speaker highlighted the significant and immediate threat posed by AI's impact on social engineering. Perfect voice impersonation and deepfake video generation, which are rapidly advancing, will make phishing, CEO fraud, and other social engineering attacks far more convincing and scalable. Defenders must anticipate and prepare for these enhanced attacks by focusing on security awareness training, multi-factor authentication, and robust verification processes that go beyond visual or auditory cues.

1. Call for Collective Learning and Sharing: Vicente Diaz emphasized the importance of continuous experimentation and sharing of findings within the security community. As LLM capabilities evolve rapidly, collective intelligence is crucial. By openly discussing strengths, weaknesses, and unexpected behaviors, defenders can collectively adapt their strategies and maximize the protective potential of these new tools. The journey from scripting language analysis to decompiled binary analysis is just the beginning, promising even more powerful insights into the nature of threats.

Key Takeaways

• LLMs offer comprehensive, contextual explanations: Unlike traditional antivirus solutions that provide binary verdicts, LLMs furnish natural language descriptions of code functionality, empowering analysts with deeper understanding and aiding in nuanced decision-making for "gray cases."
• Exceptional at exploit and obfuscation detection: LLMs demonstrate a surprising ability to identify exploits, often by parsing code comments and variable names, and are highly effective at deobfuscating complex scripts that bypass conventional antivirus engines.
• Powerful for obscure file type identification: Beyond standard magic bytes or extensions, LLMs can semantically identify highly specific and obscure text-based file types, a capability invaluable for forensic analysis and threat hunting.
• Direct AI-generated malware is still nascent, but social engineering is a clear threat: While evidence of sophisticated, novel AI-generated malware is limited to experimental samples, the rapid advancement of deepfakes and voice impersonation poses an immediate and significant threat to social engineering attacks, demanding enhanced defensive strategies.
• LLMs are a vital new tool for defenders: They complement existing security technologies by providing an additional, powerful signal for analysis, accelerating triage, improving detection accuracy, and allowing organizations to tailor their security responses based on granular, understandable insights.
• Continuous experimentation and sharing are crucial: The field of AI in cybersecurity is evolving rapidly. The security community must actively experiment with LLMs, share findings, and collaborate to collectively understand and leverage these tools for enhanced protection.

About the Speaker(s)

Vicente Diaz is a prominent figure in the cybersecurity community, hailing from Barcelona, Spain. He is a key member of the VirusTotal team, a crucial platform under Google that serves as a global repository for suspicious files and URLs, providing aggregated data from numerous antivirus engines and security tools. In his role, Diaz is at the forefront of exploring cutting-edge technologies like Large Language Models (LLMs) to enhance malware analysis and understanding. His work involves practical experimentation with vast datasets to identify the real-world strengths and weaknesses of AI in combating evolving cyber threats.