Forest Global Training Partners

Cyber Risks · Cisco Talos

Using LLMs as a reverse engineering sidekick

Summary: Cisco Talos researchers documented a malware-analysis setup that pairs the Model Context Protocol with IDA Pro and a VSCode client, using Ollama with Devstral:24b locally and Anthropic's Claude 3.7 Sonnet in the cloud on an old IcedID sample of about 37 defined functions. Across three prompts, Claude cost $2.91, $1.09 and $13.24 and ran 18m 0s, 4m 0s and 11m 24s, while the local model cost $0 and ran 22m 34s, 18m 01s and 46m 08s, with the third local prompt requiring repeated execution because the model kept forgetting its instructions.

Bottom line: The local model stopped after roughly a dozen functions once its context window filled, so on a binary with hundreds or thousands of unknown functions the analyst is the one re-entering prompts - and the cloud run that finished the job cost $13.24 for a single small sample.

Read the original at Cisco Talos ↗

Topics
Malware
Related