LLaMa Assisted Reverse Engineering of Modern Ransomware: A Comparative Analysis with Early Crypto-Ransomware

Abstract

The evolution of ransomware from crypto-ransomware to sophisticated data theft ransomware presents new challenges in cybersecurity. This study investigates the strategic shift in ransomware tactics, emphasizing covert communication and advanced data exfiltration methods. Utilizing the LLaMa-12B model and IDA Pro for reverse engineering, the research delves into the operational intricacies of contemporary ransomware, contrasting recent data theft variants like AlphV and Black Basta with early crypto-ransomware examples like TeslaCrypt and WannaCry. The findings highlight the necessity for adaptive cybersecurity strategies, incorporating advanced detection systems to recognize ransomware activities. The study underscores the importance of expanding research to a broader range of ransomware samples and integrating AI and machine learning technologies for a comprehensive understanding of these evolving threats. The limitations, primarily the research's focus on specific ransomware samples and the subjective interpretation of the LLaMa-12B model's analysis, are acknowledged. Future research should aim to refine AI-driven techniques and develop standardized analysis frameworks, enhancing the effectiveness of cybersecurity defenses against ransomware.