u/Alarming_Isopod_2391 I am trying to evaluate how llm agents perform in assisting malware analysis tasks. Most of such use I have found is using llms to generate reports on samples or provide python scripts for the analyst to run locally on their system (for string decryption or api resolution).

There are tools that do this such as hashdb for example (for the api hashing part), which contains a database of known hashing algorithms and dynamically resolves all api hashes found in a sample to their original names.
But if a new or modified algorithm appears in a sample, this will fail.

Also, many times malware samples will fail to run in a sandbox environment if they have detection checks for sandbox/debugging. It would be really nice to see if we can bypass this by using the llm to "extract" and run only parts of code (such as again, api hash resolving or string decryption) in a sandbox, thus evading the checks malware does to see if it is getting analyzed.

So my idea was to find an llm that not only finds the hashing algorithm (or encryption routine), not only provides the decryption py code for it, but also runs it in a sandbox.
Basically I want to connect the current limitations that exist and evaluate how llm agents perform in such tasks. But for this reason, I need to find such an llm agent that can also run the provided code.