SentinelLABS constructed a standardized, multi-stage reverse-engineering benchmark using the fast16 sabotage implant to evaluate whether frontier LLMs can conduct autonomous, long-horizon malware analysis rather than isolated triage. Only OpenAI's GPT-5.6 Sol completed the full eight-stage investigation, distinguished by its ability to perform 'project-scale recovery' — withdrawing invalidated hypotheses, repairing dependent artifacts, and re-verifying corrected claims — while other frontier models (GPT-5.5, GLM-5.2, Opus 4.x) plateaued at local competence without sustained investigative closure.
malware analysis
5 posts
Sol Searching | Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? Go Get ‘Em: Updates to Volexity Golang Tooling Volexity has released updates to its Golang reverse engineering tooling to address the growing trend of Go-based malware and obfuscation techniques like Garble. The release introduces GoStringExtractor, a plugin for IDA Pro and Ghidra that organizes unterminated Go string tables, and updates GoResolver to recover runtime type information (RTTI), significantly enhancing static analysis capabilities.
Simplifying MBA obfuscation with CoBRA Trail of Bits has open-sourced CoBRA, a highly effective tool designed to deobfuscate Mixed Boolean-Arithmetic (MBA) expressions commonly used by malware authors and software protectors. Available as a CLI tool, C++ library, and LLVM pass, CoBRA successfully simplifies nearly 100% of complex MBA expressions, significantly aiding reverse engineering and malware analysis efforts.
Building an Adversarial Consensus Engine | Multi-Agent LLMs for Automated Malware Analysis SentinelOne Labs developed a multi-agent LLM architecture using OpenClaw and Claude models to automate malware reverse engineering. By employing a serial consensus pipeline with an active rejection mandate, the system forces independent tool agents (radare2, Ghidra, Binary Ninja, IDA Pro) to cross-validate findings, significantly reducing decompiler artifacts and hallucinations.
Intelligence Center Cisco Talos introduced DispatchLogger, an open-source dynamic analysis tool designed to intercept and log late-bound COM automation calls. By utilizing transparent proxying and recursive object wrapping, the tool provides analysts with deep semantic visibility into script-based malware behavior, such as WMI abuse and fileless execution, effectively bypassing common script obfuscation techniques.
