Human-Verified AI-Assisted Evidence Interpretation in Comparative Malware Analysis: WhiteSnake, Donex, and Emotet Samples

In the digital world, malicious software operates like a silent intruder, slipping into computers to steal secrets, lock away files, or hijack systems for further attacks. To stop these intruders, security experts must understand exactly how they work. This requires a careful two-step process: first, looking at the code without running it to see what tools it carries, and second, watching what it actually does when it is allowed to run in a safe, isolated room. The challenge lies in telling the difference between what a piece of software might be able to do based on its code, and what it actually did during a specific test. If an expert sees a lock-picking tool in a suspect's pocket, they know the suspect has the capability to break in, but they cannot be sure a break-in happened unless they see the door open. This distinction is vital for building accurate defenses, yet it is often blurred when reports mix potential abilities with confirmed actions.

A researcher recently tackled this problem by examining three distinct pieces of malicious software: one designed to steal passwords, one intended to encrypt files for ransom, and one that acts as a loader to bring in other threats. They did not create new experiments from scratch; instead, they revisited a detailed project completed by undergraduate students in 2025. The researcher treated the original student logs, screenshots, and data as a historical record to be audited. Their goal was to apply a new method of analysis that combined human expertise with artificial intelligence to sort through the evidence. The AI acted as a powerful assistant, organizing thousands of data points and suggesting possible interpretations, but it never made the final call. Every conclusion was checked and verified by a human analyst to ensure that no guess was mistaken for a fact.

The first specimen, known as WhiteSnake, was a program built with a specific technology that allowed it to run on many different computer systems. When the researcher looked at its code, they found it was heavily disguised, a technique called obfuscation, which makes the instructions hard to read. More importantly, the code contained a long list of words related to virtual machines and sandbox environments, such as "vmware" and "vbox." This suggested the program was designed to check if it was running in a safe testing room and to stop itself if it detected one. When the program was run in the isolated laboratory, it did try to reach out over the network, specifically looking for a connection to a messaging service. However, because the laboratory was cut off from the real internet, the connection failed. The researcher could see the attempt, but they could not confirm that the program successfully stole any passwords or sent data to a remote server. The evidence showed the intent to steal, but not the act of theft.

The second specimen, Donex, appeared to be a ransomware program, designed to lock up a user's files. Its code contained references to powerful encryption tools and commands that could shut down a computer or delete system logs. These were clear indicators of what the program was built to do. However, when the researcher ran it, the expected disaster did not happen. The files on the test computer were not encrypted, no ransom note appeared on the screen, and the system did not reboot as the code suggested it might. The program showed signs of instability and made some local network noises, but it failed to perform its primary function. The study concluded that while Donex had the tools to cause harm, it did not actually use them in this specific test. The presence of the tools was real, but the damage was not.

The third specimen, Emotet, arrived in a deceptive package: a file that looked like a standard word document but had a hidden second extension to trick the user. Once opened, it tried to contact a specific address on the network. In the isolated lab, this address resolved to a local machine, and the connection attempt failed, returning a message that the destination was unreachable. The program moved so quickly that the monitoring tools could not capture a stable record of its activity. It is possible the program injected itself into another process or simply finished its task before the cameras could focus, but the researcher could not prove this. They could only confirm that the program tried to reach out and failed due to the laboratory conditions.

A key part of this study was how the researcher handled the artificial intelligence. They used the AI to organize the messy data from the three tests and to propose possible explanations for what they saw. The AI suggested that the behaviors matched known tactics used by cybercriminals. However, the human team reviewed every single suggestion. They rejected the idea that the programs had successfully stolen data or encrypted files because the direct evidence was missing. They also rejected the idea that the programs had successfully evaded detection, even though the code suggested they tried. The AI provided a list of possibilities, but the human analysts provided the truth based on what was actually recorded.

The final result of this work is a clear, cautious map of what happened. The researcher found that these three programs possessed the capabilities to steal data, encrypt files, and hide their tracks. Yet, under the specific conditions of this test, none of them successfully completed their main missions. The study emphasizes that seeing a capability in the code is not the same as seeing the action in the real world. By separating what was observed from what was only suggested, the team created a more reliable picture of the threat. This approach ensures that security defenses are built on confirmed facts rather than assumptions, preventing the overestimation of danger while still acknowledging the potential for harm. The work serves as a reminder that in the fight against digital threats, patience and verification are just as important as the tools used to find the enemy.