Remco Sprooten

Imagine you're a detective solving complex crimes. Each crime scene is unique, but you notice small similarities—like similar footprints or cigarette butts. To solve the mystery, you need to connect these dots, even if they come from different places. This is what we do in cybersecurity, using creativity to make different tools work together. In our research, we faced the challenge of detecting similarities in malware. We used Locality Sensitive Hash (TLSH) and an Intermediate Language (IL). On their own, these tools are useful, but by combining them, we found a powerful way to uncover relationships between malware samples. TLSH creates compact "fingerprints" of malware, while IL provides a consistent view of code across different platforms. By merging these tools, we could find similar code fragments across malware, revealing patterns that would otherwise be missed. This combination made our analysis faster and more accurate, helping us tackle real-world cybersecurity challenges.

Despite Linux’s pervasive use, the landscape of Linux malware remains significantly under-researched, often leading to an overestimation of its sophistication. This talk challenges that perception by highlighting the surprising ease with which many Linux malware samples can be detected and analyzed. A core premise is that malware authors, perhaps due to this perceived obscurity, frequently forgo robust obfuscation techniques, leaving their malicious intent remarkably transparent. Building upon this accessibility, the second part of the presentation will delve into an innovative approach for large-scale malware analysis. We will demonstrate how Large Language Models (LLMs), when integrated with a disassembler, can revolutionize the reverse engineering workflow. The inherent “straightforwardness” of many Linux malware samples makes them ideal candidates for LLM-assisted analysis, allowing for rapid and automated reporting on sample functionality within minutes.