GLESEC’s
SKYWATCHSM ALERTS
This analysis explores the application of Generative AI specifically Googles Gemini Advanced in
malware analysis.
The experiment focuses on analyzing executable files particularly a RisePro Stealer sample.
The methodology involves decompiling the malware using Ghidra and IDA Pro then using
specific prompts with Gemini to analyze the code.
The process aims to determine the files verdict understand its behavior and identify Indicators
of Compromise (IOCs).
While Gemini proves useful in providing insights and aiding analysis challenges such as
handling large codebases and obfuscated code are noted.
The study concludes that Gen AI can be a powerful tool in malware analysis when used in
conjunction with traditional reverse engineering tools but emphasizes the need for human
expertise in interpreting results.
GLESEC INFORMATION SHARING PROTOCOL
GLESEC CYBER SECURITY FLASH REPORTS are in compliance with the U.S. Department of Homeland
Security (DHS) Traffic-Light Protocol (TLP): TLP-White (Disclosure is Not Limited), TLP-Green (Limited
Disclosure, Restricted Only to the Community), TLP-Amber (Limited Disclosure, restricted to the
Participant’s Organization), and TLP-Red (Not for Disclosure, Restricted/ Classified – Only Shared with US
DHS).
Symantecs Threat Hunter Team recently observed the Syssphinx (aka FIN8) cyber-crime group deploying a variant of the Sardonic backdoor to deliver the Noberus ransomware.
Read More...Adversaries were found abusing Googles Firebase Hosting service to deliver the legitimate Sorillus remote administration tool.
Read More...A zero-day vulnerability (CVE-2023-36884) affecting Microsoft Windows and Office products is being exploited by attackers in the wild. To date, the exploit has been used in highly targeted attacks against organizations in the government and defense sectors in Europe and North America.
Read More...WhiteSnake Stealer was discovered in early 2022 and can collect data from browsers email clients messages apps and crypto wallets.
Read More...