LLMalMorph: On The Feasibility of Generating Variant Malware using
  Large-Language-Models
Large Language Models (LLMs) have transformed software development and
automated code generation. Motivated by these advancements, this paper explores
the feasibility of LLMs in modifying malware source code to generate variants.
We introduce LLMalMorph, a semi-automated framework that leverages semantical
and syntactical code comprehension by LLMs to generate new malware variants.
LLMalMorph extracts function-level information from the malware source code and
employs custom-engineered prompts coupled with strategically defined code
transformations to guide the LLM in generating variants without
resource-intensive fine-tuning. To evaluate LLMalMorph, we collected 10 diverse
Windows malware samples of varying types, complexity and functionality and
generated 618 variants. Our thorough experiments demonstrate that it is
possible to reduce the detection rates of antivirus engines of these malware
variants to some extent while preserving malware functionalities. In addition,
despite not optimizing against any Machine Learning (ML)-based malware
detectors, several variants also achieved notable attack success rates against
an ML-based malware classifier. We also discuss the limitations of current LLM
capabilities in generating malware variants from source code and assess where
this emerging technology stands in the broader context of malware variant
generation.
68771a0b257d4f04353707a9
Md Ajwad Akil
claimed_verified
2025-07-16T08:15:48.362Z
6159f88235226e98eaa28b39
https://cdn-avatars.huggingface.co/v1/production/uploads/1633286253722-noauth.jpeg
Md Ajwad Akil
user
Ajwad
68771a0b257d4f04353707aa
Adrian Shuai Li
68771a0b257d4f04353707ab
Imtiaz Karim
68771a0b257d4f04353707ac
Arun Iyengar
68771a0b257d4f04353707ad
Ashish Kundu
68771a0b257d4f04353707ae
Vinny Parla
68771a0b257d4f04353707af
Elisa Bertino
LLMalMorph: On The Feasibility of Generating Variant Malware using
  Large-Language-Models
Large Language Models (LLMs) have transformed software development and
automated code generation. Motivated by these advancements, this paper explores
the feasibility of LLMs in modifying malware source code to generate variants.
We introduce LLMalMorph, a semi-automated framework that leverages semantical
and syntactical code comprehension by LLMs to generate new malware variants.
LLMalMorph extracts function-level information from the malware source code and
employs custom-engineered prompts coupled with strategically defined code
transformations to guide the LLM in generating variants without
resource-intensive fine-tuning. To evaluate LLMalMorph, we collected 10 diverse
Windows malware samples of varying types, complexity and functionality and
generated 618 variants. Our thorough experiments demonstrate that it is
possible to reduce the detection rates of antivirus engines of these malware
variants to some extent while preserving malware functionalities. In addition,
despite not optimizing against any Machine Learning (ML)-based malware
detectors, several variants also achieved notable attack success rates against
an ML-based malware classifier. We also discuss the limitations of current LLM
capabilities in generating malware variants from source code and assess where
this emerging technology stands in the broader context of malware variant
generation.
LLMalMorph, a semi-automated framework using LLMs, generates malware variants by semantically and syntactically comprehending source code, reducing detection rates and achieving attack success against ML-based classifiers.
Large Language Models LLMalMorph semantical code comprehension syntactical code comprehension function-level information custom-engineered prompts code transformations antivirus engines ML-based malware detectors malware variant generation