A Blog about malware and file formats

This benchmark tests Mistral 4 Large, Luna 6, MiMo 2.6 Pro, MiMo 2.6 Flash and GLM 5.3 Flash on six static unpacking tasks, from a .NET dropper to an obfuscated Go loader. The models use only Malcat's MCP server, with a 30-minute tool-use limit and a €1 budget per sample. I compare their accuracy, performance and price.

Ever wondered which LLM model is the best to analyse malware? Well, we did, and put them to the test. By strapping 9 state-of-the-art large language models to Malcat's powerful MCP server, we made them analyse and sometimes even statically unpack a curated list of malware. We then compared their accuracy, performance and price.