LLM-enabled MalTerminal Malware Leverages GPT-4 to Generate Ransomware Code

Cybersecurity: LLM-enabled Malware Analysis

Cybersecurity researchers have identified an early instance of malware utilizing a Large Language Model (LLM) for dynamic malicious code generation. Known as MalTerminal , the malware leverages OpenAI's GPT-4 to create ransomware code and reverse shells, posing significant challenges for detection and analysis.

Unlike traditional malware, MalTerminal generates malicious logic on-the-fly using an external AI model, rendering static security measures ineffective. This finding represents a shift in adversary tactics, as code is not hardcoded but generated uniquely for each execution. The research is part of an investigation into how threat actors are utilizing LLMs.

LLM-enabled malware, like MalTerminal, incorporates AI capabilities directly into its payload, adapting behavior based on the target environment. This differs from simple AI-created malware, which is still developing. The primary concern is its unpredictability; by using an LLM for code generation, the malware's actions vary, complicating security measures.

Past examples, such as PromptLock and LameHug, have shown LLMs can generate system commands and exfiltrate data. SentinelLABS developed a novel threat-hunting strategy, focusing on artifacts of LLM integration, such as API keys and prompt structures, rather than searching for malicious code.

YARA rules were created to detect patterns for major LLM providers, flagging over 7,000 samples, mostly non-malicious errors. MalTerminal was identified by analyzing samples with multiple API keys and prompts indicating malicious intent. An LLM classifier scored the prompts' maliciousness, leading to Python scripts and a Windows executable named MalTerminal.exe .

The analysis showed MalTerminal used a deprecated OpenAI chat completions API endpoint, indicating its creation before November 2023. It prompts an operator to choose between deploying ransomware or a reverse shell, then generates the required code using GPT-4.

File name Purpose Notes

MalTerminal.exe Malware Compiled Python2EXE sample: C:\Users\Public\Proj\MalTerminal.py

testAPI.py (1) Malware Malware generator Proof-of-Concept (PoC) scripts

testAPI.py (2) Malware Malware generator PoC scripts

TestMal2.py Malware An early version of MalTerminal

TestMal3.py Defensive Tool "FalconShield: A tool to analyze suspicious Python files."

Defe.py (1) Defensive Tool "FalconShield: A tool to analyze suspicious Python files."

Defe.py (2) Defensive Tool "FalconShield: A tool to analyze suspicious Python files."

The emergence of LLM-enabled malware like MalTerminal highlights new challenges in cyber defense, as static detection signatures are inadequate. Network traffic to legitimate LLM APIs can resemble malicious use. However, this malware's reliance on external APIs and embedded keys creates detection opportunities. Revocation of an API key can neutralize the malware.

While still experimental, the development of LLM-enabled malware allows defenders to adapt strategies for a future where malicious code is generated on demand.

Based on reporting by Cyber Security News.