u/AccomplishedRace6674

I've been playing with Malcat MCP + claude to augment my manual analysis, beyond that I find I like the HTML reports it generates. I have found that AI augmented analysis can be helpful to save time and fill some gaps, however, an analyst still needs to understand what they're seeing and be able to validate or re-phrase queries as needed.

In this sample I had already observed that client.dll is likely malicious, I observed how it was loaded, and noted that it isn't needed to run the application. I then switched to Malcat MCP, Remnux MCP to help tighten up some findings and generate a written report. I've had to have AI adjust the report as I added my own findings, like likely App Publishers that are related, and hunting finds in VirusTotal for similar samples.

The result I think, is a fairly decent report. Not how these typically flow on my blog, but worth trying out.

u/AccomplishedRace6674 — 7 days ago