Malware analysis by a team of AI analysts that cite their evidence
Give it a suspicious file. Specialist AI agents take it apart with real tools, argue over what they find, and hand back a report in which every line shows its proof.
Behind the headline, a hex dump of a sample fills the page. A lens follows the pointer and shows the same bytes decompiled to pseudocode: a mutex check, a string decoder and the loop that beacons to the command server.
Unknown file in. Checked report out.
Each agent works the file with its own tool, the agents challenge each other, and a judge decides. Your own agent and tool join the team the same way.
An animation of one run. A sample is split up and sent to six analyst desks: static analysis with a scanner, a reverser with a disassembler, a sandbox, network analysis with a traffic capture, threat intelligence with an intel feed, and an empty desk into which your own agent and tool are dragged. Each desk files its results as evidence in a ledger. The agents then debate around a table: a claim backed by evidence is confirmed, a claim without it is struck. A judge gives the verdict, and the report is written line by line, each line linked to the evidence it rests on.
Every sentence has a source, and a check
Nothing is taken on trust. A sentence whose evidence does not hold is removed before anyone reads it.
An excerpt of a report. Each sentence names the evidence ledger entries it rests on; selecting one shows the tool output behind it, such as the decompiled mutex call or the sandbox's record of the mutex. Before anything is published, validators check citations, values and contradictions: here a sentence claiming a 30 second sleep is struck and removed, because its cited entry records 60 seconds.
report, section 3: behaviour
removed: “Sleeps 30 seconds between beacons.” The value 30 s is not in ev_0055.
ev_0003triagecapability scannerencrypt data using RC4 PRGA at 0x180002f10
ev_0049reverserdisassembler: decompile 0x180004a100x180004a2c h = CreateMutexW(NULL, TRUE, L"mx_7f3a"); 0x180004a41 if (GetLastError() == 0xb7) ExitProcess(0);
ev_0050reverserdisassembler: decompile 0x1800038b00x1800038d2 rc4_init(&ctx, cfg_key, 0x20); 0x1800038f0 decode_strings(&ctx);
ev_0052sandboxbehaviour reportmutex created mx_7f3a (pid 4412)ev_0053sandboxbehaviour reporttask created \Updater trigger: logonev_0054networktraffic capturePOST hxxps://c2-a[.]example/live/ 200 POST hxxps://c2-b[.]example/live/ 200
ev_0055networktraffic capture14 POST requests, 60 s apart
A senior analyst's findings, from a team that runs on your own machine
Measured against reports by professional analysts on the same sample, Malspark found 54 of their 57 key facts, and 53 verified facts none of them had.
Any model. Any tool. Your own agents.
Every part is a slot. Swap the AI model, connect any MCP tool server, or add an agent and a tool you wrote. Nothing is tied to one vendor.