Research area · Binary analysis & forensics Agentic
From binary to attack path: Understand malicious code, derive detection
A malware analysis is only complete when the understood behavior turns into detection. We combine AI-assisted reverse engineering with forensic practice: specialized agents in VamiReverse do the groundwork for analysts, who review rules, IOCs, and the mapping to MITRE ATT&CK — through to the compromise assessment that searches your environment for exactly these traces.
- Multi-agent analysis
- APK · PE/ELF · .NET
- YARA · Sigma · Suricata
- IOCs & MITRE ATT&CK
- Frida
- Compromise assessment
- Honeypots & deception
- Deep Dives
- 4
- Whitepapers
- 0
- Solutions
- 1
Why analysis only ends with detection and cleanup
Attackers often go unnoticed: according to Mandiant M-Trends 2026, the global median dwell time in 2025 was 14 days, and only 52% of the incidents investigated were detected internally. A single sample answers little on its own. What is needed are the behavior, persistence mechanisms, and communication channels, indicators that can be used to search your own environment, and detection rules derived from them.
This is where VamiReverse comes in: specialized agents build on self-operated tools such as Ghidra, ILSpy, and jadx and analyze Android apps (APK) as well as Windows and Linux programs (PE/ELF, including .NET). They deliver AI-annotated pseudocode, behavioral analysis, vulnerability hypotheses, YARA, Sigma, and Suricata rules, IOCs, and the ATT&CK mapping. Android apps can be examined dynamically with Frida in a sandbox and emulator; the AI suggests, analysts review.
Our threat briefing of October 31, 2026, on the tampered Claude Code extension shows what such indicators look like: an SSH key with the comment svc-telemetry, the LaunchAgent com.apple.sysmond or the scheduled task SysMon, and outbound connections to a server operated by the attackers. The information is based on Cursor's security notice and analyses by OpenSourceMalware and StepSecurity — exactly the kind of traces a compromise assessment looks for.
Open questions in practice
- 01
How far can malware analysis be delegated to AI agents?
Our approach
As far as analysts review the results. In VamiReverse, specialized agents do the groundwork for analysts instead of replacing them: they classify behavior, suggest rules, and produce an analysis report. The platform runs as SaaS on T Cloud Public, exclusively in German data centers, or on-prem on request; you choose the LLM, and there is no AI training on customer data.
- 02
When is an IOC sweep enough, and when do you need a behavior-based search?
Our approach
IOC sweeps match forensic artifacts against known indicators such as file hashes, IP addresses, and domains; they find what is already known. TTP-based analyses search for attack techniques along MITRE ATT&CK and thus also capture activity without a known signature. In a compromise assessment, we combine both with EDR telemetry; analysts validate suspicious hits manually.
- 03
What remains on the machine after a tampered extension has been removed?
Our approach
In the case of the Claude Code extension, SSH keys, scripts, and a LaunchAgent or scheduled task remained after uninstalling. The order matters: disconnect the machine and preserve evidence, remove persistence, then install the clean version and rotate credentials from a clean machine. A compromise assessment then clarifies whether there was any follow-on activity.
- 04
What do honeypots reveal about an attacker's tools?
Our approach
That depends on the depth of interaction. Low-interaction honeypots emulate services only superficially and provide limited insight. High-interaction honeypots provide real systems and allow in-depth analysis of tools and procedures, but require considerably more safeguarding. To prevent a compromised decoy from becoming a stepping stone, we strictly limit outbound traffic.
Key takeaways
- 01
Even environment variable names reveal where access lies
The loader of the tampered Claude Code extension sat at the top of extension.js, ahead of the actual code, and ran as soon as the extension was loaded; no conversation with Claude was needed. A profile of the machine and the names of environment variables were transmitted — based on the analyses so far, not their values. Even these names reveal where access lies.
- 02
A negative result applies only to the available data
A compromise assessment provides a snapshot for a defined scope and time period. If it finds no attacker activity, this does not prove the absolute absence of compromise. Many assessments also produce structural findings: gaps in logging and sensor coverage, log retention that is too short — weaknesses that make later forensic investigation more difficult.
Source: Compromise Assessment
- 03
Incident data is evidence — even without prosecution
According to NIST SP 800-61 Rev. 3, the integrity and provenance of collected incident data must be preserved; for this, ISO/IEC 27037 describes identification, collection, acquisition, and preservation with hash values and chain of custody. For the analysis, this means securing volatile data such as memory first and not rebuilding compromised systems prematurely, because that destroys evidence.
Source: Incident Response
- 04
Detection quality beats coverage
MITRE ATT&CK catalogs observed techniques, but it is neither a catalog of controls nor a compliance checklist. Coverage heatmaps can create a false sense of security when many weak rules cover techniques only nominally. Rules from malware analysis only take effect once the matching data source is collected and the detection has been tested against real attacker behavior.
Source: MITRE ATT&CK
How we work
Static and dynamic analysis deliver hypotheses. They only become reliable through review by analysts, mapping to MITRE ATT&CK, and a search of the affected environment.
Agentic binary analysis
Specialized agents on Ghidra, ILSpy, and jadx: AI-annotated pseudocode, behavioral analysis, and vulnerability hypotheses for APK as well as PE/ELF, including .NET.
Dynamic Android analysis
Android apps are run with Frida in a sandbox and emulator and examined at runtime.
Detection rules & IOCs
YARA, Sigma, and Suricata rules, indicators of compromise, and the mapping to MITRE ATT&CK as a verifiable result of the analysis.
IOC and TTP sweeps
Match forensic artifacts against known indicators and search for attack techniques based on behavior, complemented by EDR telemetry and manual validation.
Evidence preservation per ISO/IEC 27037
Identification, collection, acquisition, and preservation of digital evidence — with working copies, hash values, and an unbroken chain of custody.
Honeypots & honeynets
Realistic-looking decoys in isolated honeynet segments to observe attackers' techniques — strictly separated from the production network; deception ends at your own network boundary.
How to get started
- 1Secure and dissect the artifactSecure the sample in a forensically sound manner, analyze it statically and dynamically, and work out behavior, persistence, and communication channels.
- 2Derive and review detectionAnalysts review the agents' suggestions and derive rules, IOCs, and the ATT&CK mapping — documented traceably in the analysis report.
- 3Search and clean up the environmentIOC and TTP sweeps in the compromise assessment; in the event of active compromise, a structured transition to incident response with cleanup and credential rotation.
Deep dives, whitepapers, and analyses
Deep Dives 4
From research area to implementation
Related research areas
Suspicious file or unusual behavior on your network?
We analyze samples, examine your environment in a compromise assessment, and support the cleanup. In case of acute suspicion, our CSIRT can be reached at any time at csirt@vamisec.com.