Categories: Malware

Machine learning system to create invisible malwares – gym-malware

In the recent DEF CON Meet, technical director of security shop Endgame Hyrum Anderson disclosed a research paper on adapting API frameworks in building a malware that AV engines cannot identify.

The core function of the system is to build a legitimate looking app by making minor changes to the original app that can avoid AV detections. By making minor changes they have deceived the AV Engines and they named as gym-malware.

Andrew said, “All machine learning models have blind spots,”. “Depending on how much knowledge a hacker has they can be convenient to exploit.”

Also Read Alternative Android App Store “CepKutusu.com” Spreading Malware From Every Downloaded App

In a span of 15 hours of training, the software ran over 100,000 samples past an unnamed security engine. Around 60% of samples produced can bypass the system security.

Code for OpenAI Gym published in Github by Anderson and their team.

OpenAI Gym is a toolkit for developing and comparing reinforcement learning algorithms. This makes it possible to write agents that learn to manipulate PE files (e.g., malware) to achieve some objective (e.g., bypass AV) based on a reward provided by taking specific manipulation actions.

AddThis Website Tools
Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

View Comments

Recent Posts

MATLAB, Serving Over 5 Million Users, Hit by Ransomware Attack

MathWorks, the renowned developer of MATLAB and Simulink, has been grappling with the aftermath of…

1 hour ago

CISA Publishes ICS Advisories Highlighting New Vulnerabilities and Exploits

On May 27, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released a new Industrial…

2 hours ago

Chrome Security Patch Addresses High-Severity Vulnerabilities Enabling Code Execution

The Chrome team at Google has officially released Chrome 137 to the stable channel for…

2 hours ago

Zero-Interaction libvpx Flaw in Firefox Allows Attackers to Run Arbitrary Code

Mozilla has released Firefox 139, addressing several critical and moderate security vulnerabilities that posed significant…

3 hours ago

INE Security And RedTeam Hacker Academy Announce Partnership To Advance Cybersecurity Skills In The Middle East

INE Security, a global cybersecurity training and certification provider, today announced a strategic partnership with…

3 hours ago

Threat Actors Use Fake DocuSign Notifications to Steal Corporate Data

DocuSign has emerged as a cornerstone for over 1.6 million customers worldwide, including 95% of…

19 hours ago