Exploring GenAI in Cybersecurity: Gemini for Malware Analysis

Description

This analysis explores the application of Generative AI, specifically Google's Gemini Advanced, in malware analysis. The experiment focuses on analyzing executable files, particularly a RisePro Stealer sample. The methodology involves decompiling the malware using Ghidra and IDA Pro, then using specific prompts with Gemini to analyze the code. The process aims to determine the file's verdict, understand its behavior, and identify Indicators of Compromise (IOCs). While Gemini proves useful in providing insights and aiding analysis, challenges such as handling large codebases and obfuscated code are noted. The study concludes that Gen AI can be a powerful tool in malware analysis when used in conjunction with traditional reverse engineering tools, but emphasizes the need for human expertise in interpreting results.