Record behavior
Run dynamic analysis in a VM and collect records of processes, file operations, and other activity.
VMWARE / SYSMONMALWARE ANALYSIS WORKFLOWFrom analysis
From analysis
to reporting,
fully automated.
The LLM investigates. Scripts connect the steps.
Turn dynamic logs and Ghidra findings into evidence-based insights.
OVERVIEW01 / OBSERVE 02 / INSPECT 03 / INTERPRET
Connect the analysis. Deepen the insight.
Understand the code
Inspect functions and decompiled code in Ghidra, including logic that did not appear during execution.
GHIDRA / MCPTurn evidence into a report
The LLM organizes findings into Markdown and HTML, separating observations from inferences.
LLM / REPORTWHY r_AKanalyFocus on investigation.
Focus on investigation.
Spend less time moving between steps.
Malware analysis involves preparing a sample for execution, collecting logs, inspecting code, and correlating results. r_AKanaly connects these steps, combining LLM investigation with script-driven workflow management.
Less switching between tools
Scripts handle routine VM operations and log collection, passing the information to the next stage and connecting the workflow through to reporting.
Revisit the details that matter
The LLM uses available evidence to decide what to inspect next. It follows functions and references to investigate the code behind behavior observed in dynamic logs.
Keep conclusions with their evidence
Record what was observed and which operations it relates to. Separate confirmed facts, inferences, and unresolved questions in a report you can revisit.
BEHAVIOR × CODECompare what happened
DYNAMIC ANALYSIS STATIC ANALYSIS
Compare what happened
with what the code says.
What happened during execution?
Dynamic analysis runs the sample inside a VM and records processes, file operations, and other activity. Behavior actually observed under those conditions becomes the starting point for investigation.
What logic is inside?
Static analysis inspects functions and call relationships using tools such as Ghidra without normally executing the sample. This includes unobserved logic and branches that require specific conditions.
For example, after observing a file modification. Inspect the related functions and their call conditions to check whether the code matches the logged behavior. Distinguish code that exists from code that actually executed.
SCROLL-DRIVEN ROADMAP
After you submit a sample.
Scroll to follow requests into the Guest and results back to the Host. Stop scrolling to pause the paths, or scroll back to reverse them.
HOST ⇄ GUEST / CONCEPTUAL FLOW01 / 07
Accept the sample
Read the selected sample and analysis settings, then prepare the environment for analysis.
Swipe the diagram horizontally on mobile. This conceptual diagram includes planned features. vmrun runs on the Host. Lines represent logical requests and results, not direct sample transfer through MCP.
Accept the sample
Read the selected sample and analysis settings, then prepare the environment for analysis.
Record behavior in the VM
Observe behavior in the dynamic-analysis VM and collect logs, then switch to the static-analysis environment.
The LLM requests an investigation
The LLM decides what to inspect. MCP forwards the request to the resident Host agent.
Reach the Guest through vmrun
The resident Host agent relays instructions through vmrun to operations inside the Guest.
Prepare with the OS agent
The Guest OS agent handles extraction, file operations, and tool preparation. Transfer the sample only after readiness checks.
Inspect the details in Ghidra
Retrieve functions and decompiled code from the resident Ghidra agent. Revisit relevant areas as needed.
Return findings and write the report
Return analysis results along the reverse path. The LLM correlates them with dynamic logs and compiles its findings into the final report.
AGENTS & CONTROL
Reasoning and operations, each with a role.
The LLM and resident Host agent
The LLM decides what to investigate. The Host relays MCP requests and returns results.
Two agents inside the Guest
The OS agent prepares, extracts, and launches tools. The Ghidra agent retrieves functions and analysis data.
Scripts manage the workflow
Scripts coordinate snapshot restoration, readiness checks, sample transfer, log collection, and post-analysis preservation.
Resident Ghidra integration inside the VM and post-analysis preservation are in development.
SECURITY BY DESIGNKeep the investigation
Keep the investigation
inside the VM.
The design prioritizes separation between the LLM on the Host and the Guest environment that handles samples. It aims to perform static analysis through Ghidra and supporting tools inside the VM, returning findings to the Host.
Resident VM integration and integration into the application are in development. The following describes the intended architecture.
Analyze samples in the Guest
Extract samples and operate analysis tools inside the VM. The Host LLM investigates the returned information. The architecture uses vmrun / Guest Operations and does not require a Host-Only network connection.
Separate execution from static inspection
Manage separate snapshots for dynamic and static analysis. Unanswered questions during static analysis should not automatically trigger normal execution of the sample.
Check readiness before transfer
Check the VM agents, analysis tools, destination, and isolated LAN without external connectivity before transferring the sample. Prepare the environment before handling the sample.
REPORTBeyond the results,
Beyond the results,
insights you can revisit.
What happened? What supports the conclusion? What remains unknown? Organize the findings so they can guide further investigation.
This report is an illustration of the structure, not an actual sample or analysis result.
analysis_report.htmlILLUSTRATIVE
Analysis overview
Basic informationFile details, hashes, and analysis settings
Observations and evidenceDynamic logs and related functions or operations
Findings and open questionsInferences and conditions requiring verification
PREPARE & RECEIVESet the conditions.
BEFORE ANALYSIS AFTER ANALYSIS
Set the conditions.
Revisit the results.
Fully automated means connecting the steps after you prepare the environment and specify the sample and analysis settings. Here is what to prepare and what to review afterward.
What to prepare
- Windows and VMwarePrepare an analysis Guest and snapshots for restoration.
- Analysis tools and LLM accessSet up Ghidra, log collection, and the connection to the LLM.
- Sample and analysis settingsSpecify the target file, any required ZIP password, VM configuration, and output location.
What to review
- Markdown and HTML reportsReview basic information, observations, evidence, findings, and unresolved questions.
- Dynamic-analysis logsRefer to execution records to verify the evidence behind the report.
- Preservation for follow-up analysisCollection of Ghidra projects and optional post-analysis snapshots are in development.
Distribution is being prepared. Supported environments and setup instructions will be provided with the release.
Check release status ↗
Build, investigate, understand more.