[Hands-on] “Isn’t that the one from before?” 👯‍♂️ Malware Original vs. Variant: AI-Powered Genetic Testing (Similarity Analysis)

Jul 18, 2026

—

Hello, security researchers who track to the end! 🕵️‍♂️

The world of cybersecurity is an endless game of ‘tag’. When a security vendor detects a specific piece of malware, hackers release a slightly modified ‘variant’ of the code a few days later (or even a few hours later).

Some just change their outer shell, some undergo plastic surgery, some switch weapons… the types are diverse. 🎭

The process by which an analyst determines “Is this new one the same as the old one?” is called Code Similarity Analysis.

In the past, we had to stare at tools like BinDiff until our eyes hurt, but now AI instantly compares the “genes” of two codes. Today, we will conduct a hands-on session using AI to play ‘spot the difference’ between original malware and its variants. 🔍

1. Why is Similarity Analysis Necessary? 🤷‍♀️

Over 90% of malware is a rehash of existing code. There’s no need to reinvent the wheel every time.

Evasion of Detection: To avoid signature-based detection by antivirus software, only variable names or function order are changed.
Feature Upgrade: Adding ‘information theft’ capabilities to existing ransomware or strengthening encryption algorithms.
Attribution: Gaining clues like, “Hmm? This coding style is 95% identical to the ‘Lazarus’ group active last year.”

2. [Preparation] Prepare Original and Variant Code (Decompiled) 📂

For analysis, rather than in binary (EXE) form, we need Pseudocode restored to C language form via tools like Ghidra or IDA.

📁 [Sample A] Original Ransomware

// Original: Simple file encryption loop
void EncryptFiles() {
    char* key = "1234"; // Vulnerable hardcoded key
    FileInfo file = FindFirstFile("*.*");
    while (file) {
        XOR_Encrypt(file, key); // Simple XOR encryption
        file = FindNextFile();
    }
}

📁 [Sample B] Variant Ransomware

// Variant: Key generation method changed and features added
void ProcessData() { // Function name changed
    char* key = GenerateRandomKey(); // Strengthened with random key generation
    FileInfo f = FindFirstFile("*.*");
    while (f) {
        if (IsSystemFile(f)) continue; // [Change] System files are skipped (safety mechanism)
        AES_Encrypt(f, key); // [Change] Algorithm changed to AES
        f = FindNextFile();
    }
}

At a glance, the structure looks similar, but many details have changed, right? Let’s leave this to AI.

3. Request “Genetic Testing” from AI 🧬

If you simply say “compare these two,” AI will only find textual differences. We want ‘functional/logical differences,’ so we need to write the prompt carefully.

🗣️ [Prompt] Similarity Analysis Prompt

[Role] You are a malware reverse engineering expert.

[Task] Compare and analyze the two C codes provided below (Sample A, Sample B).

Sample A is the original malware, and Sample B is presumed to be its variant.

[Requirements]

1. Similarity Score: Estimate the similarity between 0-100% based on the logical structure and flow of the two codes.

2. Key Changes (Diff): Ignore minor changes like variable name alterations, and focus on explaining differences primarily in algorithms, logic, and functional additions/deletions.

3. Intent of the Variant: Infer the attacker’s reason for modifying the code this way (e.g., detection evasion, feature enhancement).

[Sample A Code]

(Paste original code above)

[Sample B Code]

(Paste variant code above)

4. [Result] AI’s Detailed Analysis Report 📝

AI understands that a variable name changing from ‘file’ to ‘f’ is not important. Instead, it identifies changes in core logic.

🤖 AI Analysis Report

1. 📊 Estimated Similarity: Approximately 70%

– Basis: The overall framework (Structure) of the file traversal loop (FindFirstFile -> while -> FindNextFile) is identical. However, significant changes in the internal processing logic have been detected.

2. 🔄 Key Changes (Key Differences)

– Strengthened Encryption: Simple XOR operation has been changed to AES, an advanced encryption standard.

– Key Management Method: The hardcoded key (“1234”) has been replaced with a dynamic generation method via GenerateRandomKey(), making decryption more difficult.

– Added Safety Mechanism: IsSystemFile() check logic has been added. This is to prevent critical Windows files from being encrypted, which would lead to unbootable systems.

3. 😈 Inferred Intent of the Variant

The creator of this variant, seeing that the previous version was too easily decrypted by security vendors, has sophisticated the encryption algorithm to force victims to pay. Furthermore, there is an apparent intent to increase system stability and avoid ‘rug pull’ controversies (where ransomware is paid but recovery is impossible).

5. Key Points of the Hands-on Session: The Art of Diffing ✨

Through this hands-on session, we can gain the following insights:

Importance of Control Flow Graph (CFG): Even if variable names change, the structure of an If statement running inside a While loop does not easily change. AI effectively recognizes this structural similarity.
Noise Reduction: By telling AI to “ignore variable name changes,” we could focus only on truly important functional differences.
Establishing Response Strategies: We can determine the direction of analysis, such as, “Ah, this variant uses AES. Then we should target when the key is generated in memory.”

🎉 Conclusion

Today, we used AI to analyze the “genealogy” (?) of malware.

In the past, we would stare at two monitors, playing “spot the difference” until our eyes were bloodshot, but now that AI does the preliminary work, we can focus on the more sophisticated task of ‘understanding the attacker’s intent.’

Next time, we will consolidate all the analysis content learned so far and conclude this series splendidly by conducting a hands-on session on “Automated Generation of Final Malware Analysis Reports.”

May your analyses always be clear! Keep up the great work! 💪