Machine learning system to create invisible malwares – gym-malware

In the recent DEF CON Meet, technical director of security shop Endgame Hyrum Anderson disclosed a research paper on adapting API frameworks in building a malware that AV engines cannot identify.

The core function of the system is to build a legitimate looking app by making minor changes to the original app that can avoid AV detections. By making minor changes they have deceived the AV Engines and they named as gym-malware.

Andrew said, “All machine learning models have blind spots,”. “Depending on how much knowledge a hacker has they can be convenient to exploit.”

Also Read Alternative Android App Store “” Spreading Malware From Every Downloaded App

In a span of 15 hours of training, the software ran over 100,000 samples past an unnamed security engine. Around 60% of samples produced can bypass the system security.

Code for OpenAI Gym published in Github by Anderson and their team.

OpenAI Gym is a toolkit for developing and comparing reinforcement learning algorithms. This makes it possible to write agents that learn to manipulate PE files (e.g., malware) to achieve some objective (e.g., bypass AV) based on a reward provided by taking specific manipulation actions.

Guru baran

View Comments

Recent Posts

Active Attacks Targeting Google Chrome & ownCloud Flaws: CISA Warns

The CISA announced two known exploited vulnerabilities active attacks targeting Google Chrome & own cloud vulnerabilities in their catalog. CVE-2023-6345 …

5 hours ago

Cactus Ransomware Exploiting Qlik Sense code execution Vulnerability

A new Cactus Ransomware was exploited in the code execution vulnerability to Qlik Sense for initial access. Qlik Sense is…

1 day ago

Hackers Bypass Antivirus with ScrubCrypt Tool to Install RedLine Malware

The ScrubCrypt obfuscation tool has been discovered to be utilized in attacks to disseminate the RedLine Stealer malware, and its new variant was being marketed in…

1 day ago

Hotel’s Hacked Logins Let Attacker Steal Guest Credit Cards

According to a recent report by Secureworks, a well-planned and advanced phishing attack was carried out, specifically targeting hotels and…

1 day ago

Critical Zoom Vulnerability Let Attackers Take Over Meetings

Zoom, the most widely used video conferencing platform has been discovered with a critical vulnerability that threat actors could potentially…

1 day ago

Hackers Using Weaponized Invoice to Deliver LUMMA Malware

Hackers use weaponized invoices to exploit trust in financial transactions, embedding malware or malicious links within seemingly legitimate payment requests. …

2 days ago