Real malware samples analysed in about 15 minutes by computer use

Kostas@Kostastsale

Been testing GPT-6 Astra against some recent malware we collected through IR engagements.

I used the ChatGPT Chrome extension with Guacamole running a @ThruntingLabs FlareVM environment directly inside the browser.

Samples included a recent SynkLoader, SystemBC and a few fairly nasty obfuscated DLLs.

Using high effort, Astra got through the analysis in roughly 15 minutes and found pretty much everything I was looking for, including obfuscated configuration, encrypted passwords embedded in the binaries and the important execution behaviour.

That part impressed me, but overall, computer use is insane!

Compared with GPT-5.6 Sol, the difference is huge. Astra was much better at understanding what was on screen, interacting with the tooling and moving through the analysis without getting lost.

This changes the automation angle quite a bit. You can now start thinking about automating workflows around the actual tools analysts already use, rather than having to rebuild everything around APIs and custom integrations. Just throw Computer Use at it and let it do the work.

Very interesting direction for DFIR and malware analysis!