🛡️ LLM‑Assisted Malware Analysis Lab

This project provides a complete, step-by-step guide to build an isolated Windows VM running FLARE VM, integrated with GhidraMCP and Claude Desktop App, to enable LLM‑powered malware analysis. Even non-experts can obtain human-readable reports after uploading a malware sample.

📑 Table of Contents

• 🛡️ LLM‑Assisted Malware Analysis Lab
• ✅ Recommended System Requirements (Host Machine)
• 🚀 Step-by-Step Setup
  • 1. Create Virtual Machine
  • 2. Install FLARE VM
  • 3. Install Ghidra & GhidraMCP Plugin
  • 4. Install MCP Bridge Script
  • 5. Setup Claude Desktop
  • 6. Analyze Malware Sample
• 📁 Directory Structure
• 🧪 Sample Prompt
• 🛡️ Security Notes
• 📚 References
• ⚠️ Disclaimer
• 💡 Coming Soon

---

🌐 Main Features

• Deploys an isolated Windows 10 VM using FLARE VM for safe malware analysis.
• Integrates Ghidra with Claude AI via the GhidraMCP bridge for LLM-assisted reverse engineering.
• Produces human-readable malware behavior reports from disassembled/decompiled code.
• Uses a realistic system configuration to avoid malware anti-VM detection.
• Supports CLI automation via Ghidra headless analysis and LLM prompt scripting.
• Offers a streamlined workflow from malware import → analysis → report generation.
• Designed for education, cybersecurity research, and scalable forensic triage.

---

✅ Recommended System Requirements (Host Machine)

Component	VM Allocation	Host System Minimum Requirements
CPU	4 vCPUs (minimum)	8 physical cores (Hyper‑Threading ✓)
RAM	8 GB (comfortable Win10)	16 GB+
Storage	80 GB fixed-width SSD	160 GB+ NVMe/SSD
GPU	N/A (optional GPU passthrough)	VT‑x/AMD‑V + SLAT support (EPT/RVI)
Networking	Virtual NIC in Host-Only/NAT mode	Separate subnet segment, optional INetSim routing

---

🚀 Step-by-Step Setup

1. Create Virtual Machine

• Allocate 4 vCPU, 8 GB RAM, 80 GB fixed-size SSD
• Install Windows 10/11 x64 inside VM
• Disable Windows Defender, Auto Updates, and Guest Additions
• Enable Host-Only or NAT networking
• Take a clean snapshot

2. Install FLARE VM

Inside the VM, run PowerShell as Administrator:

Set-ExecutionPolicy Unrestricted -Force
iwr -Uri https://raw.githubusercontent.com/fireeye/flare-vm/main/install.ps1 -OutFile install.ps1
Unblock-File .\install.ps1
.\install.ps1

After completion, take another snapshot.

3. Install Ghidra & GhidraMCP Plugin

• Download Ghidra 11.x
• In Ghidra: File → Install Extensions → + → Select GhidraMCP.zip
• Restart Ghidra
• Enable MCP under: File → Configure → Developer

4. Install MCP Bridge Script

On your VM (or host Python environment):

pip install fastmcp
python bridge_mcp_ghidra.py --ghidra-server http://127.0.0.1:8080/

5. Setup Claude Desktop

• Install Claude Desktop App
• Go to Settings → Developer → Edit Config
  Add this MCP section:

{
  "mcpServers": {
    "ghidra": {
      "command": "python",
      "args": [
        "C:/full/path/to/bridge_mcp_ghidra.py",
        "--ghidra-server",
        "http://127.0.0.1:8080/"
      ]
    }
  }
}

Restart Claude Desktop.

6. Analyze Malware Sample

1. Import EXE file into Ghidra project
2. Let analyzers finish processing
3. Start bridge_mcp_ghidra.py
4. In Claude, use a prompt like:

Analyze this file. Identify if it's malicious and explain the behavior clearly.

Claude will return a natural-language report with reasoning.

---

📁 Directory Structure

/
├── bridge_mcp_ghidra.py
├── ghidra_scripts/
├── samples/
├── reports/
└── README.md

---

🧪 Sample Prompt

This file uses GetAsyncKeyState and writes to AppData. Could this be an InfoStealer? What does the control flow indicate?

---

🛡️ Security Notes

• Do not expose your analysis VM to the internet.
• Always use snapshots before launching new malware.
• Never run the analyzed file directly.
• Avoid shared folders or clipboard integration between host and guest.

---

📚 References

• FLARE VM GitHub
• Ghidra
• Claude Desktop App
• GhidraMCP

---

⚠️ Disclaimer

This environment is for educational and research use only. Always ensure legal compliance and sandbox containment when working with malware samples.

---

💡 Coming Soon

• 🔁 Automated CLI + JSON reports
• 🔐 Offline LLM integration (LLaMA, Mistral, etc.)
• 📦 Support for multi-file malware campaigns
• 🎓 Web UI for simplified end-user interaction