Automating Malware Reverse Engineering with Local LLMs, PyGhidra and Neo4j Graphs
A researcher has built an automated system that combines PyGhidra, Neo4j and a local large language model to speed up the initial analysis of malicious binaries. The project addresses the main drawbacks of sending decompiled code to cloud LLMs: leakage of indicators of compromise, possible censorship of sensitive modules, and rapid context overflow when a sample contains 100–200 functions.
Architecture and data flow
The pipeline begins with ghidra_extractor.py, which uses PyGhidra to disassemble and decompile a binary without launching the Ghidra GUI. For every function the extractor records its address, name, size, cyclomatic complexity, decompiled C pseudocode (truncated at 6000 characters with a 30-second timeout), call-graph neighbors, string references and imported API calls. Metadata such as PE format, architecture and all standard file hashes are also stored. All extracted entities are loaded into Neo4j as distinct node types: Sample, Function, String, Import, Analysis, Capability and Behavior.
Next, worker.py and mcp.py iterate over functions and send each one to a locally hosted Qwen3 model running inside LM Studio. The prompt includes both the decompiled code and the function’s position in the call graph, allowing the model to understand caller-callee relationships. The model returns structured JSON describing the function’s purpose, extracted IOCs, tags, network indicators, command-line usage and anti-analysis techniques.
aggregator.py then aggregates tags across all functions into Capability nodes that carry a strength weight reflecting how often each capability appears. builder.py combines these capabilities with the call graph to detect higher-level behavioral patterns such as file encryption combined with network activity. Finally, generator.py produces a human-readable report by querying the enriched graph.
Graph data model
Storing functions in a flat table makes it difficult to answer questions such as whether five anti-debug functions call one another. In the Neo4j model a Function node is connected to other Function nodes via CALLS edges, to String nodes via REFERENCES edges, and to Import nodes via USES edges. Capability and Behavior nodes sit above the function level and are linked through weighted relationships, enabling concise Cypher queries instead of recursive joins.
Validation on WannaCry
The pipeline was tested on a WannaCry sample obtained from MalwareBazaar. Processing 195 functions took 126 minutes on a machine with 60 GB RAM and an Nvidia 5070 Ti. The generated report identified three behavioral patterns with 100 percent confidence: File Encryption (supported by 40 functions), C2 Communication and Anti-Analysis. A publicly available YARA rule confirmed the anti-debug findings discovered by the system.
The complete source code is available in the repository Dvoranchik/MLMalwareAnalyzer. Future work will focus on refining call-graph traversal and prompt engineering to surface additional indicators.
Related articles
GitHub Removes 10,000 Malware Repositories After Public Exposure but Takes No Further Action
An investigation reveals that GitHub hosts thousands of repositories distributing trojanized ZIP archives, many of which have persisted for two years despite the platform's resources. The malicious repositories follow consistent patterns in README files, including specific headings and links to versioned archives hosted on githubusercontent.com. A detailed article and accompanying script published on Hacker News identified over 10,000 such repositories, prompting GitHub to delete only those specific entries. New repositories matching the same patterns continue to appear and remain active, with no additional proactive measures taken by the security team. The situation highlights questions about Microsoft's approach to automated detection and response on its subsidiary platform.
Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
Dolphin X is a newly identified Windows infostealer and remote access trojan that integrates an AI Profiler component designed to score infected machines and generate priority rankings for operators. The profiler analyzes telemetry from compromised systems, including application usage, browser domains visited, and installed software, to produce daily summaries that help attackers focus resources on the most valuable targets such as those with cloud access or sensitive tools. Dolphin X claims compatibility with over 300 applications, explicitly covering nine Chromium and Gecko browser families, more than 100 cryptocurrency wallet extensions, 65 desktop wallets, 10 password managers, and over 30 common cloud CLI tools. The malware targets files like .env configurations, SSH keys, cloud access tokens, browser sessions, and cryptocurrency wallet data to accelerate movement from initial credential theft to further compromises in accounts and production environments. Researchers have confirmed the AI Profiler workflow and associated scoring functions in the operator panel, although the underlying AI model itself remains unverified without full analysis of an active sample. The discovery highlights how automated prioritization can significantly shorten the time between mass infections and targeted follow-on attacks, prompting recommendations for reduced local credential storage and enhanced behavioral detection.
YARA Style Guide: Comprehensive Best Practices for Naming, Structuring and Maintaining Detection Rules
The article presents a detailed translation and adaptation of Florian Roth's YARA Style Guide, aimed at bringing consistency to large collections of YARA rules used by security teams. It explains how to construct informative rule names that include threat category, context, operating system, architecture, technology, packers and creation date, using prefixes such as MAL, HKTL, WEBSHELL, EXPL, VULN, SUSP and PUA. The guide recommends specific metadata fields including description, author, date, reference, score and hash, along with a three-tier string categorization system using $x*, $s* and $a* prefixes for high-specificity, group and preliminary strings. It also covers false-positive filters marked with $fp*, proper indentation, readable hex and string formatting, and a recommended order of conditions that begins with header checks and ends with false-positive filters. The publication highlights the benefits of this structured approach for long-term maintainability and faster triage during mass detections. Additional references point to the separate YARA-Performance-Guidelines project for deeper optimization techniques.
187,064 Instructions for One Flag: Reverse Engineering HTB Callfuscated Insane Challenge
A detailed technical breakdown of the HackTheBox Callfuscated reversing challenge reveals an extremely heavy obfuscation scheme built around a custom virtual machine, mixed Boolean-arithmetic transformations, opaque predicates, and call-based junk code. The binary implements a password checker that executes 187,064 instructions even on a short input because every real operation is wrapped inside thousands of call/pop gadgets. The author bypassed static analysis by building a ptrace-based tracer, dumping the 586-cell VM program array, and writing a Python emulator that faithfully replays the recorded execution trace. After fixing several edge cases involving rand() return addresses and operand-size detection, the emulator reproduced the exact register state of the original binary. Dynamic analysis exposed that the VM performs simple big-endian word construction followed by XOR operations with eight constant pairs, allowing the flag to be recovered directly without further symbolic execution.