Abstract:
The escalating sophistication and frequency of malware attacks strain traditional detection and analysis methods, which often require manual effort and fragmented tooling. This paper presents MalBot, an automated malware investigation framework that processes network packet captures (PCAPs) end-to-end. MalBot automatically extracts transferred files from captured traffic, identifies potentially malicious applications, and enriches findings with multi-source threat intelligence via APIs, alongside reverse engineering output. All extracted intelligence including static, dynamic, and network-level indicators is consolidated into a structured dataset (CSV). A large language model (LLM) serves as the analytical interface: when a user submits a natural-language query, the model generates and executes Python code to interrogate the dataset, then returns a concise, human-readable summary. This architecture unifies diverse analysis stages into a single, reproducible workflow, reducing analyst workload and enabling rapid, accessible malware investigations for both technical and non-technical users.