The purpose of the tool is to use artificial intelligence to mutate a malware (PE32 only) sample to bypass AI powered classifiers while keeping its functionality intact. In the past, notable work has been done in this domain with researchers either looking at reinforcement learning or generative adversarial networks as their weapons of choice to modify the states of a malware executable in order to deceive anti-virus agents. Our solution makes use of a combination of deep reinforcement learning and GANs in order to overcome some of the limitations faced while using these approaches independently as showen below.
Find our full documentation for the tool here
Installation Instructions
⚠️ Since this tool deals with malware files, it is strongly recommended to use a virtual machine. After installation of the tool, make sure to disconnect from the network.
The following steps will guide you through all the installations required to set up the environment.
Mutate Your Malware
The output from GAN has already been stored as (RL_Features/adverarial_imports_set.pk
and RL_Features/adverarial_sections_set.pk
) which will be used for when adding imports and sections to the malware for mutation.
python classifier.py -d /path/to/directory/with/malware/files
mutate.py
python script to mutate your malware samples. python mutate.py -d /path/to/directory/with/malware/files
Mutated_malware/mutated_<name-of-the-file>
python classifier.py -d Mutated_malware/
Known Issues & Fixes
⚠️ WARNING: This segment is currently under construction. We apologize for any inconvinience caused. Please proceed to the next section. click here
pip install -r requirements.txt
gives you an error. Solution: pip install tqdm pip install sklearn pip install lief
python main_malgan.py
script. Solution: pip install tensorboardX
cd portable-executable/ chmod 777 project-add-sections/bin/Debug/project-append-section chmod 777 project-add-imports/bin/Debug/project-append-imports
Built With
Authors
Acknowledgments
Starship is a powerful, minimal, and highly customizable cross-shell prompt designed to enhance the terminal…
Lemmy is an innovative, open-source platform designed for link aggregation and discussion, providing a decentralized…
The latest release of ImHex v1.37.0 introduces a host of exciting features and improvements, enhancing…
Ghauri is a cutting-edge, cross-platform tool designed to automate the detection and exploitation of SQL…
Writing tools have become indispensable for individuals looking to enhance their writing efficiency, accuracy, and…
PatchWerk is a proof-of-concept (PoC) tool designed to clean NTDLL syscall stubs by patching syscall…