Unit 42 Finds Experimental LLM Use in Infostealer and Sliver Dropper
Summary
Unit 42 analyzed two OSINT-sourced malware samples using OpenAI models: a .NET infostealer whose LLM-generated evasion and obfuscation suggestions were mostly unused, and a Sliver dropper that asks GPT-4 whether to execute.
Key points
- Unit 42 examined two OSINT-sourced samples integrating large language models: a .NET infostealer and a dropper for Sliver.
- The ConfuserEx 2-packed infostealer collects system information, browser cookies and file listings; most GPT-3.5-Turbo-generated evasion and obfuscation suggestions are logged, not implemented.
- The infostealer sends stolen data in JSON over HTTP; its LLM-generated message is added to request headers, while the sample's C2 address is a default local endpoint.
- The dropper sends host telemetry—including process, network, USB and security-software information—to GPT-4 for a JSON execute-or-not verdict, and launches its decrypted Sliver payload when the verdict allows it.
- Researchers describe the infostealer's LLM features as largely superficial, while the dropper's LLM-based environment assessment is a functional, though experimental, execution gate.
- The article reports no known examples of malware using locally executed agentic attack flows and notes that embedding or deploying local models remains challenging.
Article Details
- Attack Vectors
- A ConfuserEx 2-obfuscated C#/.NET infostealer collects system information, browser cookies, and file listings, then attempts to send the data as JSON over HTTP to a default localhost C2 URL. The article notes that this endpoint may indicate local testing rather than operational C2 infrastructure.
- The infostealer queries GPT-3.5-Turbo for suggested evasion, obfuscation, and communication content; most returned suggestions are logged rather than implemented. It also uses an LLM-generated delay before continuing.
- A dropper collects host telemetry, including process lists, antivirus products, network information, USB devices, and uptime, and sends it to GPT-4 for an execution verdict. It proceeds to launch its Sliver payload only when the response specifies execute:true.
- Defensive Notes
- Palo Alto Networks identifies Advanced Threat Prevention as protection against threats including the Sliver dropper.
- Palo Alto Networks says Advanced WildFire models and analysis techniques were reviewed and updated in light of the reported indicators.
- Palo Alto Networks says Cortex XDR and XSIAM use the Malware Prevention Engine, including Advanced WildFire, Behavioral Threat Protection, and Local Analysis, to prevent known and unknown malware.
- The article says Unit 42 shared the findings with Cyber Threat Alliance members for deployment of protections and disruption of malicious cyber activity.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 02ce798981fb2aa68776e53672a24103579ca77a1d3e7f8aaeccf6166d1a9cc6 | SHA256 hash identified for .NET-based infostealer sample 2. |
| SHA256 | 052d5220529b6bd4b01e5e375b5dc3ffd50c4b137e242bbfb26655fd7f475ac6 | SHA256 hash identified for the malware dropper that gates Sliver payload execution. |
| SHA256 | 1b6326857fa635d396851a9031949cfdf6c806130767c399727d78a1c2a0126c | SHA256 hash identified for .NET-based infostealer sample 1. |
| SHA256 | 7c7b7b99f248662a1f9aea1563e60f90d19b0ee95934e476c423d0bf373f6493 | SHA256 hash identified for .NET-based infostealer sample 3. |
MITRE ATT&CK
T1005 · Data from Local SystemThe infostealer collects local file listings and saves collected data to disk.T1016 · System Network Configuration DiscoveryThe dropper gathers network information and includes it in telemetry sent for an LLM-based execution assessment.T1027 · Obfuscated Files or InformationThe .NET infostealer is obfuscated with ConfuserEx 2, which the article says may hinder analysis and detection.T1041 · Exfiltration Over C2 ChannelThe infostealer attempts to send stolen data as JSON to its configured C2 endpoint; the article says the sample's localhost URL is a default that may reflect local testing.T1057 · Process DiscoveryThe dropper collects the host process list and submits it as part of its telemetry.T1071.001 · Web ProtocolsThe samples use HTTP for OpenAI API requests and for the infostealer's JSON communication to its configured endpoint.T1082 · System Information DiscoveryThe samples collect system information; the dropper also gathers host telemetry for its execution decision.T1120 · Peripheral Device DiscoveryThe dropper's host survey includes information about USB devices.T1497.001 · System ChecksThe dropper submits host telemetry, including processes and monitoring-related artifacts, for a safety verdict and launches its payload only when the LLM returns execute:true.T1518.001 · Security Software DiscoveryThe dropper collects antivirus product information, including an example containing msmpeng.exe.T1539 · Steal Web Session CookieThe infostealer collects browser cookies from victim systems.
Vendors
OpenAImalware samples that integrate large language models: a ConfuserExâpacked .NET infostealer that calls OpenAI GPTâ3.5âTurbo for logging and superficial evasion/obfuscation suggestions, and a dropper that queriesPalo Alto NetworksPalo Alto Networks protections (Advanced Threat Prevention, Advanced WildFire, Cortex XDR, XSIAM) and Unit 42 services are cited as defenses; indicators include multiple SHA256 hashes and a C2 URL used in the samples.
Products
Advanced Threat PreventionPalo Alto Networks protections (Advanced Threat Prevention, Advanced WildFire, Cortex XDR, XSIAM) and Unit 42 services are cited as defenses; indicators include multiple SHA256 hashes and a C2 URL used in the samples.Advanced WildFirePalo Alto Networks protections (Advanced Threat Prevention, Advanced WildFire, Cortex XDR, XSIAM) and Unit 42 services are cited as defenses; indicators include multiple SHA256 hashes and a C2 URL used in the samples.Cortex XDRPalo Alto Networks protections (Advanced Threat Prevention, Advanced WildFire, Cortex XDR, XSIAM) and Unit 42 services are cited as defenses; indicators include multiple SHA256 hashes and a C2 URL used in the samples.GPT-3.5-TurboThe first sample we’ll discuss is an information stealer that integrates its functionality with OpenAI’s GPT-3.5-Turbo via HTTP API.GPT-4This information is inserted into a prompt and sent to OpenAI’s GPT-4 model using an HTTP API.XSIAMPalo Alto Networks protections (Advanced Threat Prevention, Advanced WildFire, Cortex XDR, XSIAM) and Unit 42 services are cited as defenses; indicators include multiple SHA256 hashes and a C2 URL used in the samples.
Tools
ConfuserEx 2The .NET infostealer (C# .NET Framework 4.0, ConfuserEx 2 obfuscated) collects system info, browser cookies and file listings, logs LLM outputs, and posts JSON to a default C2 URL.Donut[T1055 ] Process Injection – Dropper decrypts Donut shellcode and may execute a Sliver payload (shellcode execution/loading behavior) (‘decrypts Donut shellcode, but instead of immediately executing the shellcode, thisSliverevasion/obfuscation suggestions, and a dropper that queries GPTâ4 to gate execution before deploying a Sliver payload.