SemSearch — Automated Malware Intelligence Platform

SHA-256	Family	Match	First Seen
78de45f9a2c03b...	Cobalt Strike	94.2%	2026-03-15
2c91f30bd507e1...	Cobalt Strike	87.6%	2026-02-28
9a1d72fc4e83b0...	Cobalt Strike	81.3%	2026-01-19
3e8a12bc7f04d9...	Beacon Loader	67.8%	2025-12-04

Sample Overview

File metadata, submission context, and pipeline execution timeline.

SHA-256

a3f4b2c1d8e9f047ac62b381de5c6f0912b3e4d7c8a91f2b56e7d80a3c4f19e2

File Type

PE32+ ◆ x86-64

File Size

412,672 bytes ◆ 403 KB

Compiler

MSVC ◆ Rich Header present

Packer / Protector

VMProtect 3.x detected

First Seen

2026-03-15 ◆ MalwareBazaar

Import Count

147 imports ◆ 8 DLLs

Section Count

6 sections ◆ .text / .data / .rsrc

Entropy

7.82 / 8.0 ◆ High (packed)

Pipeline Execution Timeline

14:32:01Z

Sample submitted ◆ hash computed, dedup check passed

14:32:04Z

Threat intel feed lookup ◆ 5 feeds queried, 2 hits

14:32:08Z

Disassembly complete ◆ 47 functions extracted

14:32:19Z

Dual AI Encoding complete ◆ structural + semantic representations generated

14:32:22Z

Similarity search ◆ 6 matches above threshold (47 functions queried)

14:32:25Z

AI enrichment ◆ 12 critical functions summarized

14:32:27Z

Family classification ◆ Cobalt Strike 91.4% confidence

14:32:28Z

IOC extraction ◆ 18 indicators extracted across 7 types

14:32:29Z

YARA rules generated ◆ 3 rules, alert dispatched ◆ CRITICAL

Threat Score

Composite score (0.0◆1.0) combining multiple independent signals. Evasion boost applied.

Composite Score

0.94

CRITICAL

Evasion boost applied: +0.25
Base score: 0.69 ? Final: 0.94

Signal Breakdown

AI Risk Score

0.96

ML Confidence

0.91

Similarity Score

0.88

Family Confidence

0.87

Intel Feed Hits

2 / 5

Evasion Detection

EXTREME

Evasion Techniques Detected

Anti-debug

DETECTED

Anti-VM

DETECTED

Packer / Protector

VMProtect 3.x

Process injection

DETECTED

Reflective loading

DETECTED

API hashing

DETECTED

String encryption

DETECTED

Timing checks

DETECTED

Code signing

NOT FOUND

Family Attribution

ML classification result with confidence breakdown and matched behavioral evidence.

Cobalt Strike

ML confidence: 91.4% ◆ Rule-based: matched 8/12 capabilities ◆ Extended Classifier

Cobalt Strike

91.4%

Beacon Loader

6.1%

Brute Ratel

1.5%

Unknown

1.0%

process-injection shellcode-loader anti-debug VMProtect packed reflective-loading C2-beacon PEB-walk API-hashing

Classification Evidence

PEB loader list traversal to resolve kernel32.dll exports without calling LoadLibrary ◆ canonical Cobalt Strike beacon staging method.

XOR-based key rotation before shellcode decryption matches documented Cobalt Strike 4.x payload staging patterns.

Reflective PE loading sequence: VirtualAllocEx → WriteProcessMemory → CreateRemoteThread ◆ observed in 91.4% confidence match against known CS beacon samples.

Rule-based check: 8 of 12 Cobalt Strike capability signatures matched including C2 beacon structure, sleep masking, and HTTP/S malleable profile indicators.

Structural classification score: 0.914 against Cobalt Strike cluster centroid — highest confidence match across all 12 family profiles.

Function Analysis

47 functions extracted and analyzed. Showing 3 highest-severity functions with AI-generated summaries.

All CRITICAL Anti-Debug Injection Networking Crypto

Showing 3 of 47 functions ◆ 12 flagged CRITICAL ◆ 9 flagged HIGH

FUN_00401a40 ◆ ReflectiveLoader_Stage2

CRITICAL ◆ 0.96 anti-debug shellcode-loader

AI Analysis ◆ confidence 0.96

This function implements a reflective PE loader. It resolves kernel32.dll exports by walking the PEB loader list, allocates executable memory, writes a shellcode payload, and invokes it through a remote thread. An IsDebuggerPresent check with a conditional exit path is present ◆ consistent with observed Cobalt Strike beacon staging behavior. The normalization-resistant XOR key rotation before decryption is a known fingerprint of CS 4.x payload loaders.

00401a40pushrbp 00401a41movrbp, rsp 00401a44subrsp, 0x28 00401a48callIsDebuggerPresent; anti-debug check 00401a4dtesteax, eax 00401a4fjnz00401b80; exit if debugger 00401a55callFUN_0040f200; PEB walk 00401a5acallVirtualAllocEx 00401a5fcallWriteProcessMemory 00401a64callCreateRemoteThread

Threat Score 0.96 Instructions 312 API Calls VirtualAllocEx, WriteProcessMemory, CreateRemoteThread Similarity 94.2% match ◆ CS sample 78de45f9

FUN_00407b10 ◆ DecryptPayload_XOR

CRITICAL ◆ 0.91 crypto

AI Analysis ◆ confidence 0.91

XOR decryption loop with a 4-byte rotating key applied to a statically embedded payload blob. The key rotation algorithm is structurally identical to known Cobalt Strike 4.x staging implementations. Entropy of the encrypted blob is 7.72 ◆ consistent with compressed-then-encrypted shellcode.

Threat Score 0.91 Instructions 88 Payload Size 48,640 bytes Key Length 4 bytes rotating

FUN_00403c20 ◆ C2_Beacon_HTTP

CRITICAL ◆ 0.88 networking c2

AI Analysis ◆ confidence 0.88

HTTP C2 beacon implementation. Constructs HTTP GET requests with a hardcoded User-Agent matching Cobalt Strike malleable C2 profile defaults. IP addresses 185.220.101.42 and 194.165.16.77 are statically embedded and used as primary/fallback C2 servers. Sleep interval extracted: 60000ms with 20% jitter.

Threat Score 0.88 Instructions 241 API Calls WinHttpOpen, WinHttpConnect, WinHttpSendRequest Sleep 60s ◆ 20% jitter

IOC Extraction

18 indicators extracted across 7 types. Malicious/suspicious classification applied automatically.

2IP Addresses

2Domains

4Registry Keys

3Mutexes

4File Paths

2URLs

1Hash

IPv4 Addresses 2

185.220.101.42 C2 SERVER

194.165.16.77 C2 SERVER

Domains 2

update.microsoft-cdn.net SUSPICIOUS

telemetry.windowsupdate.org SUSPICIOUS

URLs 2

hxxp://185.220.101.42/content/uploads/jquery.min.js DEFANGED

hxxp://194.165.16.77/api/v2/telemetry DEFANGED

Registry Keys 4

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost32 PERSISTENCE

HKLM\SYSTEM\CurrentControlSet\Services\WinDefend TAMPER

HKCU\Software\Classes\ms-settings\shell\open\command

HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths

Mutexes 3

Global\CobaltStrike-{3a9f17bc} KNOWN CS

Local\MSIMutex_7f3b2e

Global\WindowsInstaller_Updater

File Paths 4

%APPDATA%\Microsoft\Windows\svchost32.exe DROP

%TEMP%\~tmp4af7.dat

C:\Windows\System32\wbem\wmic.exe

C:\Windows\SysWOW64\cmd.exe

SHA-256 Hashes 1

a3f4b2c1d8e9f047ac62b381de5c6f0912b3e4d7c8a91f2b56e7d80a3c4f19e2 SELF

Similar Samples

6 samples with significant function-level overlap found in the corpus. Match method shown per result.

Top Match

94.2%

Functions Matched

34 / 47

Avg Match (top 6)

80.1%

Campaign Match

Yes

SHA-256	Family	Match	Method	First Seen
78de45f9a2c03b91◆	Cobalt Strike	94.2%	Hybrid	2026-03-15
2c91f30bd507e1a4◆	Cobalt Strike	87.6%	Hybrid	2026-02-28
9a1d72fc4e83b021◆	Cobalt Strike	81.3%	Semantic	2026-01-19
3e8a12bc7f04d9e6◆	Beacon Loader	74.2%	Structural	2025-12-04
b7f23e10c8a49d30◆	Cobalt Strike	68.8%	Semantic	2025-11-12
47ca910e2db63f51◆	Brute Ratel	61.4%	Structural	2025-10-30

YARA Rules

3 rules auto-generated from this sample ◆ function-level byte signatures, API call patterns, and family string indicators.

Rules Generated

From Functions

From Sample

SemSearch_CobaltStrike_Loader_FUN_00401a40

Function source threat_score: 0.96

// Generated by SemSearch ◆ 2026-03-19 ◆ function: FUN_00401a40

rule SemSearch_CobaltStrike_Loader_FUN_00401a40 {
    meta:
        generated_by  = "SemSearch v1.0"
        sha256        = "a3f4b2c1d8e9f047ac62b381de5c6f09..."
        family        = "CobaltStrike"
        threat_score  = "0.96"
        severity      = "CRITICAL"
        date          = "2026-03-19"

    strings:
        $fn_0  = { 55 48 89 E5 48 83 EC 28 48 89 7D F8 }
        $fn_1  = { FF 15 ?? ?? ?? ?? 85 C0 75 ?? 48 8D }
        $api_0 = "VirtualAllocEx" ascii nocase
        $api_1 = "WriteProcessMemory" ascii nocase
        $api_2 = "CreateRemoteThread" ascii nocase
        $api_3 = "IsDebuggerPresent" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize < 2MB and
        2 of ($fn_*) and
        3 of ($api_*)
}

SemSearch_CobaltStrike_C2Beacon_FUN_00403c20

Function source threat_score: 0.88

// Generated by SemSearch ◆ 2026-03-19 ◆ function: FUN_00403c20

rule SemSearch_CobaltStrike_C2Beacon_FUN_00403c20 {
    meta:
        generated_by  = "SemSearch v1.0"
        family        = "CobaltStrike"
        threat_score  = "0.88"
        date          = "2026-03-19"

    strings:
        $c2_0  = "185.220.101.42" ascii
        $c2_1  = "194.165.16.77"  ascii
        $ua    = "Mozilla/5.0 (compatible; MSIE 9.0" ascii
        $api_0 = "WinHttpOpen" ascii
        $api_1 = "WinHttpConnect" ascii

    condition:
        uint16(0) == 0x5A4D and
        1 of ($c2_*) and
        all of ($api_*)
}

SemSearch_CobaltStrike_Sample_a3f4b2c1

Sample source threat_score: 0.94

// Generated by SemSearch ◆ 2026-03-19 ◆ sample-level rule

rule SemSearch_CobaltStrike_Sample_a3f4b2c1 {
    meta:
        generated_by  = "SemSearch v1.0"
        sha256        = "a3f4b2c1d8e9f047ac62b381de5c6f09..."
        family        = "CobaltStrike"
        threat_score  = "0.94"
        severity      = "CRITICAL"

    strings:
        $mutex   = "Global\\CobaltStrike-{" ascii
        $path    = "%APPDATA%\\Microsoft\\Windows\\svchost32" ascii wide
        $reg     = "CurrentVersion\\Run\\svchost32" ascii wide
        $fn_load = { 55 48 89 E5 48 83 EC 28 }

    condition:
        uint16(0) == 0x5A4D and
        filesize < 2MB and
        2 of ($mutex, $path, $reg) and
        $fn_load
}

Campaign Attribution

This sample has been grouped into an active campaign based on shared code, infrastructure, and behavioral overlap.

Campaign Identification

Operation SilverBeacon

Campaign ID: CAMP-2026-0041 ◆ Cobalt Strike cluster

Samples

C2 IPs

78%

Code Overlap

91d

Active Span

Campaign Timeline

2025-12-18

First sample ◆ initial loader (47ca910e) detected via MalwareBazaar submission. Low similarity, no family match at time of detection.

2026-01-19

Cluster formed ◆ 9a1d72fc identified with 81.3% function-level overlap to 47ca910e. Campaign attribution triggered at 3-sample threshold.

2026-0203

Active expansion ◆ 8 additional samples added. Shared C2 infrastructure confirmed. Cobalt Strike family attribution stabilized at >90%.

2026-03-19

This sample ◆ a3f4b2c1 added to campaign. 94.2% match to cluster centroid. 3 shared IOCs confirmed.

Shared Indicators Across Campaign

185.220.101.42 ◆ C2 (13/14 samples)

194.165.16.77 ◆ C2 (9/14 samples)

Global\CobaltStrike-{* mutex pattern

svchost32.exe drop path pattern

XOR key rotation algorithm (structural)

PEB-walk export resolver (semantic)

What it is

Malware analysis, end to end, without the manual work

SemSearch is a self-hosted malware intelligence platform that takes raw binaries — PE files — and runs them through a fully automated multi-stage analysis pipeline. The output is a structured, searchable intelligence report: threat score, malware family attribution, function-level AI summaries, extracted IOCs, auto-generated YARA rules, similar sample matches, and campaign attribution.

The core idea is function-level analysis. Rather than treating a binary as a single opaque blob, SemSearch decomposes it into its individual functions, analyzes each one independently, and builds intelligence bottom-up. A function that implements a reflective PE loader is the same function regardless of which binary it appears in — even if that binary has been recompiled, repacked, or had its imports obfuscated. That invariance is the foundation SemSearch is built on.

Two independent AI models run on every function: a structural model that captures the shape of the code, and a semantic model that captures what the code means. The results are combined to power similarity search, family classification, and campaign grouping — using methods that hold up against obfuscation and evasion in ways that signature-based approaches don't.

"The code that makes malware work doesn't change when the hash does. We analyze the code."

The Problem

Seven things that break traditional malware analysis

The security industry has built most of its detection infrastructure around artifacts that are trivially changed. Threat actors know this, and they exploit it constantly. SemSearch was designed around seven specific failure modes in traditional analysis:

Hash-only detection fails after one recompile

A file hash identifies an exact byte sequence. Recompile the same source with a different compiler flag and the hash changes completely — even though the logic, behavior, and threat are identical.

Signatures don't survive obfuscation

Static signatures match against byte patterns. Packers, encryption, and code mutation break these patterns trivially. Threat actors routinely cycle packing configurations specifically to burn signature hits.

Manual reverse engineering doesn't scale

A skilled analyst can triage tens of samples per day. Modern threat operations produce thousands. The gap between analyst capacity and sample volume is structural — it cannot be closed by hiring more analysts.

No systematic code reuse detection

Malware authors reuse proven code heavily — loaders, C2 implementations, crypters, anti-debug stubs. Without function-level comparison across the corpus, this reuse is invisible to most analysis platforms.

Family attribution is inconsistent

Different analysts and different tools disagree on malware family labels. SemSearch uses ML classifiers trained on behavioral and structural features to produce reproducible, confidence-scored classifications.

Campaign connection requires manual correlation

Connecting related samples across a campaign — same actor, same tooling, different hashes and file names — requires hours of manual correlation that most teams can't afford on every incident.

Intelligence lives in analysts' heads

Hard-won knowledge from a reverse engineering session — what a function does, what family it belongs to, what campaign it connects to — rarely persists in a queryable form. SemSearch stores and indexes everything.

Philosophy

Built for the work, not for the pitch deck

SemSearch is not enterprise security software. There is no enterprise sales team, no SOC2-compliance-first roadmap, no feature list designed to check procurement checkboxes. It is a tool built by people who do malware analysis, for the people who do malware analysis.

That means a few specific things. Self-hosted first — your samples don't leave your infrastructure. API-first — every capability is accessible programmatically, making it integrable into any existing pipeline. Depth over breadth — we would rather do function-level analysis extremely well than offer a shallow version of everything. And honest documentation — no features listed that don't exist, no "coming soon" treated as shipped.

Your data stays yours

Fully self-hosted — Docker Compose or Kubernetes. Your samples, results, and intelligence never leave your environment. No cloud telemetry, no sample sharing, no vendor lock-in to a hosted service.

API-first, automation-ready

100+ REST API endpoints. Every submission, result, search, alert, and export operation is available programmatically. Built to drop into existing pipelines — no GUI required for any workflow.

Function-level depth, always

Every binary is disassembled down to individual functions. Every function is AI-analyzed, AI-enriched, cross-searched, and threat-scored. Analysis at this granularity is the non-negotiable core of what SemSearch does.

No vaporware

Every feature in the documentation is implemented, tested, and ships with the platform. Features in active development are clearly listed as coming soon — nothing else is implied to exist. The report you see on this site is what the platform actually produces.

Roadmap

What's coming next

Static analysis — the full automated pipeline from binary ingestion through family classification, IOC extraction, YARA generation, and campaign attribution — is live. The next phase is dynamic analysis: correlating what the binary contains statically with what it actually does at runtime.

In Active Development

Dynamic Analysis Sandbox

Runtime behavioral correlation synchronized with existing static analysis results. Every behavioral event — API call, network connection, file operation, registry modification — linked back to the function and code region that produced it.

Runtime behavioral event capture correlated to static function-level analysis

API call sequence analysis and behavioral pattern matching

Network capture with automatic IOC extraction from live traffic

Memory dump ingestion and correlation with disassembly results

Static + dynamic threat score fusion for higher-confidence attribution

From raw binary
to threat
intelligence
in minutes.

How SemSearch Works

Submit Your Sample

multi-stage automated Pipeline

Analyst-Ready Intelligence

Built to automate the hard parts

Function-Level Similarity Search

Dual AI Analysis

AI-powered Function Enrichment

Automated Family Classification

IOC Extraction (14 Types)

YARA Rule Generation

Real-Time Alerts

SIEM Integration COMING SOON

What an analysis looks like

Built by analysts. For analysts.

Malware Analysts

SOC Teams

Threat Hunters

Security Researchers

Dynamic Analysis ◆ Coming Next

Every feature.
Built and shipped.

Intelligence & Classification

Evasion Categories Detected

Malware Families Classified

Search & Threat Hunting

Result Filters

Outputs & Reports

Integrations & Alerts

Real-Time Alert Rules

Infrastructure

What a SemSearch report looks like

A platform built
around the analysis,
not around the alert.

Malware analysis, end to end, without the manual work

Seven things that break traditional malware analysis

Built for the work, not for the pitch deck

What's coming next

From raw binary to threat intelligence in minutes.

How SemSearch Works

Submit Your Sample

multi-stage automated Pipeline

Analyst-Ready Intelligence

Built to automate the hard parts

Function-Level Similarity Search

Dual AI Analysis

AI-powered Function Enrichment

Automated Family Classification

IOC Extraction (14 Types)

YARA Rule Generation

Real-Time Alerts

SIEM Integration COMING SOON

What an analysis looks like

Built by analysts. For analysts.

Malware Analysts

SOC Teams

Threat Hunters

Security Researchers

Dynamic Analysis ◆ Coming Next

Every feature.Built and shipped.

Intelligence & Classification

Evasion Categories Detected

Malware Families Classified

Search & Threat Hunting

Result Filters

Outputs & Reports

Integrations & Alerts

Real-Time Alert Rules

Infrastructure

What a SemSearch report looks like

A platform builtaround the analysis,not around the alert.

Malware analysis, end to end, without the manual work

Seven things that break traditional malware analysis

Built for the work, not for the pitch deck

What's coming next

From raw binary
to threat
intelligence
in minutes.

Every feature.
Built and shipped.

A platform built
around the analysis,
not around the alert.