🤖 AI Summary
Information-stealing trojans (e.g., Aurora) pose significant challenges in identifying infection vectors from screenshots, and scalable, automated analysis methods remain lacking.
Method: This paper introduces the first reactive visual analysis framework leveraging a large language model (GPT-4o-mini), integrating multimodal understanding and contextual reasoning to automatically extract indicators of compromise (IoCs)—including malicious URLs, installer filenames, and exploited software topics—from infected screenshots, and to correlate attack activities across samples.
Contribution/Results: Evaluated on 1,000 real-world infection screenshots, the method successfully identified 337 actionable URLs and 246 associated files, enabling attribution and confirmation of three distinct attack campaigns. It bridges a critical gap in log-dependent, post-hoc forensic analysis by pioneering end-to-end visual parsing of information-stealing malware artifacts using LLMs, thereby substantially enhancing both the efficiency and scalability of threat intelligence generation.
📝 Abstract
Infostealers exfiltrate credentials, session cookies, and sensitive data from infected systems. With over 29 million stealer logs reported in 2024, manual analysis and mitigation at scale are virtually unfeasible/unpractical. While most research focuses on proactive malware detection, a significant gap remains in leveraging reactive analysis of stealer logs and their associated artifacts. Specifically, infection artifacts such as screenshots, image captured at the point of compromise, are largely overlooked by the current literature. This paper introduces a novel approach leveraging Large Language Models (LLMs), more specifically gpt-4o-mini, to analyze infection screenshots to extract potential Indicators of Compromise (IoCs), map infection vectors, and track campaigns. Focusing on the Aurora infostealer, we demonstrate how LLMs can process screenshots to identify infection vectors, such as malicious URLs, installer files, and exploited software themes. Our method extracted 337 actionable URLs and 246 relevant files from 1000 screenshots, revealing key malware distribution methods and social engineering tactics. By correlating extracted filenames, URLs, and infection themes, we identified three distinct malware campaigns, demonstrating the potential of LLM-driven analysis for uncovering infection workflows and enhancing threat intelligence. By shifting malware analysis from traditional log-based detection methods to a reactive, artifact-driven approach that leverages infection screenshots, this research presents a scalable method for identifying infection vectors and enabling early intervention.