LLMalMorph: On The Feasibility of Generating Variant Malware using
  Large-Language-Models
Authors: name: Md Ajwad Akil; name: Adrian Shuai Li; name: Imtiaz Karim; name: Arun Iyengar; name: Ashish Kundu; name: Vinny Parla; name: Elisa Bertino
Published: 2025-07-12 22:11:10

Abstract: Large Language Models (LLMs) have transformed software development and
automated code generation. Motivated by these advancements, this paper explores
the feasibility of LLMs in modifying malware source code to generate variants.
We introduce LLMalMorph, a semi-automated framework that leverages semantical
and syntactical code comprehension by LLMs to generate new malware variants.
LLMalMorph extracts function-level information from the malware source code and
employs custom-engineered prompts coupled with strategically defined code
transformations to guide the LLM in generating variants without
resource-intensive fine-tuning. To evaluate LLMalMorph, we collected 10 diverse
Windows malware samples of varying types, complexity and functionality and
generated 618 variants. Our thorough experiments demonstrate that it is
possible to reduce the detection rates of antivirus engines of these malware
variants to some extent while preserving malware functionalities. In addition,
despite not optimizing against any Machine Learning (ML)-based malware
detectors, several variants also achieved notable attack success rates against
an ML-based malware classifier. We also discuss the limitations of current LLM
capabilities in generating malware variants from source code and assess where
this emerging technology stands in the broader context of malware variant
generation.