ReversingLabs Found AI-Modified Malware Before Anthropic Report, Says Behaviors Still Reveal It
Summary
ReversingLabs says it identified rebuilt malware variants two months before Anthropic’s report. Its telemetry found that AI can accelerate changes to hashes, but the malware’s behaviors and links to infrastructure remain useful detection signals.
Key points
- ReversingLabs says five stager builds with five hashes appeared in its telemetry over 25 days; fuzzy hashing grouped them into two code variants.
- The stager hid and ran code, collected browser history, and contacted a staging server; the backdoor persisted, injected into another process, and accessed browser and Teams data.
- Telemetry linked the staging server to additional stagers and lure shortcuts, while the shortcuts themselves contained no code and were not flagged by antivirus engines.
- Of 61 domains in Anthropic’s appendix that ReversingLabs classified as malicious, 48 had been flagged in its telemetry before publication; the median domain was flagged by only 2 of about 47 reputation sources.
- ReversingLabs argues that hashes, build artifacts, and filenames can be changed or produce noisy matches, while behavior and historical relationships between files and infrastructure remain useful signals.
- The company assesses that AI-assisted operators will likely shorten the useful life of hash indicators, increasing the value of historical telemetry and infrastructure relationships.
Article Details
- Attack Vectors
- Stager builds hide their window, decode and run hidden code, collect browser history using public PowerSploit/Empire code, and report to a staging server.
- A backdoor installs under a fake Windows service name, restarts with the machine, injects into another process, and reads browser and Teams data.
- Lure shortcuts point to the staging server; the shortcuts contain no code, and their malicious nature is based on their destinations.
- Defensive Notes
- Use behavioral detection and historical telemetry, including relationships between files and infrastructure, alongside static file hashes; the article reports that five stager builds had five hashes over 25 days.
- Correlate staging-server activity with stager beacons, hosted stagers, and lure shortcuts rather than relying solely on the server's reputation.
- The article describes YARA retro-hunts using Spectra Analyze as the source of its behavioral hunt.
MITRE ATT&CK
T1005 · Data from Local SystemThe backdoor reads browser and Teams data from the system.T1055 · Process InjectionThe backdoor injects into another process.T1140 · Deobfuscate/Decode Files or InformationThe stager decodes hidden code before running it.T1564.003 · Hidden WindowThe stager hides its window while running.
Threat Actors
Products
Microsoft TeamsLikewise, the backdoor installs under a fake Windows service name, restarts with the machine, injects into another process and reads browser and Teams data.Microsoft WindowsLikewise, the backdoor installs under a fake Windows service name, restarts with the machine, injects into another process and reads browser and Teams data.Spectra AnalyzeAt RL, our Spectra Intelligence telemetry provided the critical threat history data, while the behavioral hunt was fueled by data from YARA retro-hunts using Spectra Analyze.Spectra IntelligenceAt RL, our Spectra Intelligence telemetry provided the critical threat history data, while the behavioral hunt was fueled by data from YARA retro-hunts using Spectra Analyze.
Tools
Empirestager hides its window, decodes and runs hidden code, collects browser history with public PowerSploit/Empire code and reports to a staging server.PowerSploitthe stager hides its window, decodes and runs hidden code, collects browser history with public PowerSploit/Empire code and reports to a staging server.YARAAt RL, our Spectra Intelligence telemetry provided the critical threat history data, while the behavioral hunt was fueled by data from YARA retro-hunts using Spectra Analyze.