SentinelOne Details Multi-Agent Pipeline for Cross-Validating Malware Analysis

Mar 19, 2026 · Original article ↗

Summary

SentinelOne describes a serial multi-agent pipeline that cross-checks malware analyses from four reverse-engineering tools, rejects artifacts through adversarial review, and uses deterministic bridge scripts to improve report reliability while managing latency and model

Key points

The pipeline runs tool-specific agents for radare2, Ghidra, Binary Ninja, and IDA Pro in sequence, passing findings through a shared context.
A second “Gauntlet” phase makes agents review and explicitly agree with or reject earlier findings; the report writer anchors claims to virtual addresses and decompilation snippets.
In SysJoker analysis, cross-checking identified a malformed C2 string from radare2; another test rejected Go runtime strings initially mistaken for a Tor address.
The authors chose deterministic bridge scripts that extract tool output in batch over interactive MCP calls, citing more comprehensive extraction and predictable latency and token use.
The system uses stronger models for orchestration and report writing, cheaper models for tool-specific agents, and caps concurrency to address rate limits.
Early-run fixes included normalizing agent output schemas, propagating tool exit codes, and preserving orchestration state so a failed subagent could be restarted.

Article Details

Defensive Notes: Cross-validate malware-analysis findings across multiple reverse-engineering tools and require agents to explicitly reject unsupported claims.
Anchor reported capabilities to virtual addresses and decompilation evidence; treat decompiler artifacts, parsing errors, dead code, and misclassified strings as unverified until checked.
Use deterministic extraction and validate bridge-script exit codes so failed tool runs do not produce reports from empty or invalid output.

Indicators of compromise

Type	Indicator	Context
SHA1	`60c8128c48aac890a6d01448d1829a6edcdce0d2`	Sample hash identified in the article for WizardUpdate.
SHA1	`678aa572faa73f6873d24f24e423d315e7eb2c2d`	Sample hash identified in the article for Go Infostealer.
SHA1	`f5149543014e5b1bd7030711fd5c7d2a4bef0c2f`	Sample hash identified in the article for SysJoker.