Automating Malware Reverse Engineering with Local LLM
Ghidra
A researcher presented the MLMalwareAnalyzer project, which automates malware analysis using a local LLM (Qwen3), Ghidra, and Neo4j. The system decompiles code, analyzes each function with the LLM, and builds call graphs to identify behavioral patterns such as file encryption and communication with a C2 server.
To automate reverse engineering of malicious software, a combination of PyGhidra (Python bindings for Ghidra), the Neo4j graph database, and the local LLM Qwen3 running via LM Studio with an API key has been proposed. The process involves several stages: extracting facts from the binary using PyGhidra (disassembly, decompilation, collection of metadata and call graph), loading data into Neo4j, analyzing each function with the local LLM using neighbor context, aggregating tags into capabilities, building behavior chains, and generating a report. In testing on a WannaCry sample (195 functions, analysis took 126 minutes), the system identified three behavioral patterns with 100% confidence: File Encryption, C2 Communication, and Anti-Analysis. The anti-debug pattern found was confirmed by the YARA rule DebuggerCheck__API.
Source: Habr — хаб ИИ —
original