Exploring Malware Analysis with AI Part 1: Thoughts of How It Works

Here's a documentation of my thoughts as I go through the setup of a local agentic malware lab. To start, I will be setting up according to a few guides online (links below), but next will be building out my own custom setup. I'd like to, as closely as possible, set up a similar agentic AI that runs entirely local and can assist with malware using the available Remnux MCP, and create my own MCPs for threat hunting and research.

This is not meant to be a step-by-step guide, although I'm not opposed to it once this gets further along, but an exercise in learning.

These concepts are also not new. I am aware of the Agentic Threat Hunting Framework and I'm sure there are multiple completed builds of research modules. After going through the Remnux setup, I plan to explore other tools as well and report back on their use and takeaways.

Starting

I'll be using the following as my (spiritual) guide:

• https://blog.gdatasoftware.com/2026/03/38381-llm-malware-analysis
• https://www.youtube.com/watch?v=YOduz8VIvvw
• https://www.youtube.com/watch?v=QrWzRgPsyTE
• https://medium.com/@jimsweb/building-a-local-agentic-ai-assistant-5d8476ac2175
• https://blog.alexewerlof.com/p/local-llms-for-agentic-coding
• https://github.com/Nebulock-Inc/agentic-threat-hunting-framework

Somewhat recently, Malware Analysis for Hedgehogs (MAH) uploaded a few videos about getting started with an agentic AI in for reverse engineering. The man behind MAH, Karsten Hahn, makes great reverse engineering content to learn from with different kinds of malware. From his Youtube: "I am Principal Malware Researcher at G DATA CyberDefense AG and have been reversing malware professionally since 2015." Fancy! I've learned a lot of reverse engineering over the years by following along with his videos and attempting his approaches.

What I'm trying to solve

Since I'm feeling stuck myself with where I am and my RE skills, this seems like an opportunity to learn. And to go beyond the article, I'd like to see how much I can offload onto the machine — I want a local-only malware lab that doesn't require internet, and building out a custom MCP of my own.

My ideal scenario is a local agentic AI that can assist with documentation and repetitive tasks. Due to hardware and model limitations, it's not realistic to expect it to perform like a powerful cloud-hosted model, like Anthropic's Fable. What is realistic is something that take what an analyst has worked on and assist with documentation and summaries, and answering questions that have a lot of reference materials. AI-powered security is where the future has been headed for a while now.

I also want to start blogging again. And being quite honest, this will hopefully also look good as I apply to jobs. For now at least, this will be a learning experience in creating an assistant, and I plan on still doing the heavy lifting myself, as the models I'm working with on cheap hardware will require a lot of handholding to see what each step looks like. Documenting this in a few blog articles greatly helps organize my thoughts and process.

The 'How'

I have a cheap laptop, Ideapad 3 with 8GB RAM running Debian 13 as my primary machine, with a VM for Remnux inside (to start). I'll also be testing using Claude Code, is nice but that can potentially get pricey; hoping that the $20 month will do. And for the AI to be used effectively, it requires a strong understanding of how LLMs and agentic AI work in the first place. "Analyze this malware" is a cool goal eventually, but how do you trust the outputs? Even if everything's provided perfectly, AI hallucinations cause issues even for experts in their field, offloading a lot of the request without understanding how it works.

What first?

When learning anything, I like to copy the experts first, and start deviating as my understanding gets better. So lets emulate what MAH has set up with Claude Code!

I've set up a Remnux VM on VirtualBox and begin. For those following along or those that want to learn, it's tempting to want to start going crazy (see the dozens of revisions of this blog article) but expanding our understanding step-by-step will be best.

Of course, the first time I had it go through what I swear looked like the whole process of installing the MCP server via Claude Code, only for the commands to have not run and not show any other local servers. Nothing that a quick /exit and reloading the prompt couldn't fix. Strange, but I'm not going to think about it too much either, it works now. And right after, installing the docs as well.

This is a good point for starting, so I'll wrap up this post here. In the next blog, I'll be breaking apart some malware, creating a skill, and planning out how to emulate this locally/on a budget. And if you have ideas, recommendations, or anything else, please drop it in the comments below!