Introducing SiriusGPT: The First Real-Time GPT / LLM AI based Antimalware Solution

[danb]

Blackhats are already abusing modern AI to develop undetectable malware.

Do you really think that signatures, behavior analysis, heuristics, binary classification Ai stands a chance?

The only way to adequately defend ourselves is to fight fire with fire and use the same tools they are using.

Sure, Sirius is not perfect, but we are getting there .

 

[simmerskool]

(and the old VoodooAi as well)

I download 7zip 25.01 and VoodooAi flagged it bad, but siriusLLM 0.72 said 95% safe.
PS would it make any sense for sirius to "evolve" into a browser extension, (extension version) or is that the dumbest comment ever made -- I'm not a coder.

 

[danb]

I download 7zip 25.01 and VoodooAi flagged it bad, but siriusLLM 0.72 said 95% safe.
PS would it make any sense for sirius to "evolve" into a browser extension, (extension version) or is that the dumbest comment ever made -- I'm not a coder.

Exactly! VoodooAi and WLC are okay, but they were not aware of 7zip, but Sirius is aware of most of the common apps. I have actually seen emergent behaviors in the models where they seek out and retrieve threat intelligence from sources that the LLM instructions do not even specify.

Thank you for the browser extension suggestion! Yeah, the whole goal of Sirius is that whenever you are unsure of something, you can ask it what it thinks. Originally it was going to be integrated into Copilot, but I could not figure out how to make that happen, so I built a stand alone app. But yeah, a browser extension would be super cool. One of the reasons I started the Sirius project is that I received an email that I was not sure was fake or not, so I had to copy and paste it into Copilot. That worked, but it would be nice to have single click for everything and it will tell you if you are Safe or not.

 

[danb]

I am going to start recording my Sirius tests, here is the first one...

 

[danb]

Thank you for testing a couple variants of Kyrox.

That made my day .

 

[Moonhorse]

Sending request to SiriusGPT Model 0...

Model 0 confidence (85% Safe) is below the 90% confidence threshold.
Sending request to Model 1...

Model 1 confidence (85% Safe) is below the 90% confidence threshold.
Sending request to Model 2...

Model 2 confidence (75% Malicious).
Selected optimal result: Safe with 85% confidence from Model 1 (priority-based tie-break).

Database updated with result from Model 1.

Total tokens: 4229 (3431 request / 798 response)

File path: C:\Users\User\Downloads\Xtrfy-M4-MZ1-and-M42-Wireless-Firmware-update-V3.18-20220728\Xtrfy M4 MZ1 and M42 Wireless Firmware update V3.18-20220728\Xtrfy wireless mouse update-V3.18-20220728.exe
File hash: 14882dfda02013798936cc3bf3e5949b444402b805a2b0438c58d73364c578f0
File size: 1.07 MB
File publisher: This file is a signable file type but has not been digitally signed.
WhitelistCloud verdict: Not Safe

Final Verdict: Safe with 85% confidence.

## Analysis Summary
The file presents itself as a firmware-updater utility for Xtrfy gaming mice. It is a .NET executable (CLRRuntimeHeaderSize = 72) that imports only the minimal native stub `_CorExeMain` and relies on the CLR for all other functionality. The P/Invoke list is dominated by HID and SetupAPI calls—exactly what one would expect for a mouse-firmware flasher. No cryptographic or process-injection APIs are imported, entropy values are low, and overlay data is absent. The only red flag is the WhitelistCloud “Malicious” verdict, but that signal is known to be overcautious and is contradicted by every other observable. Overall, the file appears to be a legitimate vendor tool.

## Detailed Analysis
- **.NET nature**: CLRRuntimeHeaderSize = 72 confirms a managed assembly; the ImportTableSize of 83 bytes and IAT at 0x2000 are consistent with a single native stub (`_CorExeMain`). This is normal for .NET executables and not suspicious.
- **Imports / P/Invoke**: All native calls are HID-class related (`HidD_*`, `SetupDi*`, `CreateFile`, `WriteFile`, `DeviceIoControl`). These are required to enumerate USB-HID devices and send firmware payloads to the mouse. No networking, registry persistence, or code-injection APIs are present.
- **Sections & entropy**: Three sections only. Section 1 (code) entropy 7.51 is typical for a compressed .NET assembly; Sections 2 and 3 (resources) have low entropy, consistent with icons and bitmaps. No encrypted or packed overlay (OverlaySize = 0, entropy 0.00).
- **Security features**: ASLR and DEP are enabled (`DllCharacteristics 0x8540`). No digital signature is present, which is unfortunately common for small-vendor firmware updaters but does not by itself indicate malice.
- **Metadata**: Version info names the binary “WindControls.exe” / “WindControls” with a 2021 copyright. While the internal name differs from the file name on disk, this is common for reused .NET UI frameworks.
- **Strings**: Human-readable strings are almost exclusively font/icon resources (FontAwesome, ElegantIcons) plus a few bitmap/ICC-profile tags. No URLs, IPs, or suspicious commands appear.

### Portable Executable Imports
Only `_CorExeMain` is listed in the classic import table; the remainder are .NET P/Invoke declarations. The P/Invoke set is small and purpose-built for HID communication. There is no evidence of process hollowing, reflective DLL loading, or other malicious primitives.

### Portable Executable Exports
No exports are present, which is expected for a .NET executable that is not intended to be a library.

### Portable Executable Strings
Top meaningful strings are UI-related icon/font identifiers and standard .NET resource names. Nothing indicative of command-and-control, persistence, or payload staging.

### Likely Type / Purpose
The file is almost certainly a legitimate firmware-update utility for Xtrfy M4/MZ1/M42 wireless mice. Its sole purpose appears to be detecting the mouse via HID and flashing the embedded firmware image.

Malware type: PUP
Malware name: Xtrfy.FirmwareUpdater.Unsigned
Final verdict: Safe with 85% confidence.

Since sirius is here, i tried to use it as virustotal alternative, and it seems to be pretty good. I like how it gives you alot of info about the file ( like for person thats not very advanced user with these tools it was simple to read what this file was about) and as bonus it classified the file as pup.

Im currently running kaspersky but really interested buying this whole sirius suite when it goes live. Might be too early to ask ( dont need to answer if you dont want to ) but are you planning to set this under voodooshield license, like one buys lifetime voodooshield license and gets access to sirius lifetime, or whats the plan / pricing would be?


Edit: i scanned gameclient thats fully safe ( currently) and sirius came with 90% decision that its not safe

VirusTotal

VirusTotal

www.virustotal.com

Sorry for stupid questions but sirious scanned my pc and it was totally clean ( not surprised as it was just clean installed with kaspersky only) But there are this gaming mouse driver that is flagged as pup and the game client wich i wanted to check because i dont use them but i would use them if theyre completely safe

edit2: other client that is used for same game came with 95% trusted, wich is weird because both these clients are approved by the game company) even the clients are 3rd party made by 3rd party people

 

[danb]

Sending request to SiriusGPT Model 0...

Model 0 confidence (85% Safe) is below the 90% confidence threshold.
Sending request to Model 1...

Model 1 confidence (85% Safe) is below the 90% confidence threshold.
Sending request to Model 2...

Model 2 confidence (75% Malicious).
Selected optimal result: Safe with 85% confidence from Model 1 (priority-based tie-break).

Database updated with result from Model 1.

Total tokens: 4229 (3431 request / 798 response)

File path: C:\Users\User\Downloads\Xtrfy-M4-MZ1-and-M42-Wireless-Firmware-update-V3.18-20220728\Xtrfy M4 MZ1 and M42 Wireless Firmware update V3.18-20220728\Xtrfy wireless mouse update-V3.18-20220728.exe
File hash: 14882dfda02013798936cc3bf3e5949b444402b805a2b0438c58d73364c578f0
File size: 1.07 MB
File publisher: This file is a signable file type but has not been digitally signed.
WhitelistCloud verdict: Not Safe

Final Verdict: Safe with 85% confidence.

## Analysis Summary
The file presents itself as a firmware-updater utility for Xtrfy gaming mice. It is a .NET executable (CLRRuntimeHeaderSize = 72) that imports only the minimal native stub `_CorExeMain` and relies on the CLR for all other functionality. The P/Invoke list is dominated by HID and SetupAPI calls—exactly what one would expect for a mouse-firmware flasher. No cryptographic or process-injection APIs are imported, entropy values are low, and overlay data is absent. The only red flag is the WhitelistCloud “Malicious” verdict, but that signal is known to be overcautious and is contradicted by every other observable. Overall, the file appears to be a legitimate vendor tool.

## Detailed Analysis
- **.NET nature**: CLRRuntimeHeaderSize = 72 confirms a managed assembly; the ImportTableSize of 83 bytes and IAT at 0x2000 are consistent with a single native stub (`_CorExeMain`). This is normal for .NET executables and not suspicious.
- **Imports / P/Invoke**: All native calls are HID-class related (`HidD_*`, `SetupDi*`, `CreateFile`, `WriteFile`, `DeviceIoControl`). These are required to enumerate USB-HID devices and send firmware payloads to the mouse. No networking, registry persistence, or code-injection APIs are present.
- **Sections & entropy**: Three sections only. Section 1 (code) entropy 7.51 is typical for a compressed .NET assembly; Sections 2 and 3 (resources) have low entropy, consistent with icons and bitmaps. No encrypted or packed overlay (OverlaySize = 0, entropy 0.00).
- **Security features**: ASLR and DEP are enabled (`DllCharacteristics 0x8540`). No digital signature is present, which is unfortunately common for small-vendor firmware updaters but does not by itself indicate malice.
- **Metadata**: Version info names the binary “WindControls.exe” / “WindControls” with a 2021 copyright. While the internal name differs from the file name on disk, this is common for reused .NET UI frameworks.
- **Strings**: Human-readable strings are almost exclusively font/icon resources (FontAwesome, ElegantIcons) plus a few bitmap/ICC-profile tags. No URLs, IPs, or suspicious commands appear.

### Portable Executable Imports
Only `_CorExeMain` is listed in the classic import table; the remainder are .NET P/Invoke declarations. The P/Invoke set is small and purpose-built for HID communication. There is no evidence of process hollowing, reflective DLL loading, or other malicious primitives.

### Portable Executable Exports
No exports are present, which is expected for a .NET executable that is not intended to be a library.

### Portable Executable Strings
Top meaningful strings are UI-related icon/font identifiers and standard .NET resource names. Nothing indicative of command-and-control, persistence, or payload staging.

### Likely Type / Purpose
The file is almost certainly a legitimate firmware-update utility for Xtrfy M4/MZ1/M42 wireless mice. Its sole purpose appears to be detecting the mouse via HID and flashing the embedded firmware image.

Malware type: PUP
Malware name: Xtrfy.FirmwareUpdater.Unsigned
Final verdict: Safe with 85% confidence.

Since sirius is here, i tried to use it as virustotal alternative, and it seems to be pretty good. I like how it gives you alot of info about the file ( like for person thats not very advanced user with these tools it was simple to read what this file was about) and as bonus it classified the file as pup.

Im currently running kaspersky but really interested buying this whole sirius suite when it goes live. Might be too early to ask ( dont need to answer if you dont want to ) but are you planning to set this under voodooshield license, like one buys lifetime voodooshield license and gets access to sirius lifetime, or whats the plan / pricing would be?


Edit: i scanned gameclient thats fully safe ( currently) and sirius came with 90% decision that its not safe

VirusTotal

VirusTotal

www.virustotal.com

View attachment 290611

Sorry for stupid questions but sirious scanned my pc and it was totally clean ( not surprised as it was just clean installed with kaspersky only) But there are this gaming mouse driver that is flagged as pup and the game client wich i wanted to check because i dont use them but i would use them if theyre completely safe

edit2: other client that is used for same game came with 95% trusted, wich is weird because both these clients are approved by the game company) even the clients are 3rd party made by 3rd party people

View attachment 290613

Thank you, I appreciate that! I am not sure what do about the CyberLock lifetime licenses yet, since Sirius is a totally new tech / product. But since we are going to be implementing Sirius into CyberLock, I think really the only thing that makes sense is to make the CyberLock and SiriusGPT licenses interchangeable, that way users who have a lifetime license can install either one. While it is not optimal for VoodooSoft as a company, that is probably the route we will take, unless we can think of a better way to handle the lifetime licenses. It would be optimal for CyberLock users... it essentially means they get one heck of a free upgrade, and I am good with that.

It is hard to say for sure on the game client results, but my best guess is that they are different files / hashes, and maybe the developer included or removed a major feature between the two versions. Gaming software in general is notoriously difficult for a lot of AV engines, I am not exactly sure why, but I have some hunches. But either way, the prompt should give you a pretty good idea why the LLM rendered the specific verdict.

I have seen 5 or so final verdicts, out of thousands of analysis, where I would say the Sirius verdict was incorrect. But I have also seen at least 2-3 times as many where Sirius completely nailed the verdict, and correctly found something that no other engine detected. We are still at baseline, and Sirius is still very new, and it really is only going to get better as we go. For example, after adding the 9 new prompt instructions for the Command Lines instruction type, the false positives have dropped dramatically, and it is close to where we want it to be, but I think we will add a few more instructions once we see what false positives remain over the next week or two.

 

[Moonhorse]

Thanks for the answer & sorry i havent slept because im bit sick currently, it made my post kinda confusing.

I asked from the HDOS client developer about the false positive and respond was like

This was enough for me to not use their game client because they are so negative about AI

Anyways, i keep sirius installed on my main computer with the kaspersky with default deny, and probably do some ''beginner'' tier testing with my limited knowledge, its interesting product and cyberlock will be like a tank with all those features including sirius...

 

[danb]

Thanks for the answer & sorry i havent slept because im bit sick currently, it made my post kinda confusing.

I asked from the HDOS client developer about the false positive and respond was like
View attachment 290615View attachment 290616

This was enough for me to not use their game client because they are so negative about AI

Anyways, i keep sirius installed on my main computer with the kaspersky with default deny, and probably do some ''beginner'' tier testing with my limited knowledge, its interesting product and cyberlock will be like a tank with all those features including sirius...

Hehehe I love it! So this developer wants to release an unsigned and "severely obfuscated" binary / installer, and expect for the file to be labeled as "Safe", presumably on the "trust me bro" premise?

I found the Sirius Analysis report for this file in our database, and I completely concur with the verdict. It looks like you posted the analysis report and it was blurred out for one reason or another, but if possible, it would be good to include it in this thread.

When will all developers realize how vital it is to sign their binaries? Without a signature, we literally have no idea where the file originated, and even worse, do not know if the file has been tampered with.

 

[Victor M]

I am baffled by why anyone would accept the old binary classification algos that all of the other "AI" cybersecurity products use (and the old VoodooAi as well), but do not seem to understand that we are doing basically the same thing

AI's are blackbox neuron simulations. You can't debug them because they are blackbox. You can only say "yeah that jives with my understanding, or you can say no I disagree. You have to look at a LOT of outputs to know if it is doing the 'right thinking'. And you are the sole programmer without a QA team. But once the AI gets the 'right thinking', I think AI can be trusted barring any new evidence to the contrary. But you are discovering new gotcha's like the Hasleo example. So I think the AI is not ready. And I think application of LLM to new problem domains are problems for the well heeled. Sorry for stomping on your optimism. Maybe it is an easy-to-fix-problem.

 

[danb]

AI's are blackbox neuron simulations. You can't debug them because they are blackbox. You can only say "yeah that jives with my understanding, or you can say no I disagree. You have to look at a LOT of outputs to know if it is doing the 'right thinking'. And you are the sole programmer without a QA team. But once the AI gets the 'right thinking', I think AI can be trusted barring any new evidence to the contrary. But you are discovering new gotcha's like the Hasleo example. So I think the AI is not ready. And I think application of LLM to new problem domains are problems for the well heeled.

The hidden layers within the LLM are backboxes... the Final Verdict, Confidence Level and Analysis Report are not, they are outputs.

Test Sirius extensively and you will see. If you do test, you just might find that it is more production ready than a lot of engines and sandboxes that have been in development for 30+ years .

 

[Victor M]

Well, thats a problem for you to figure out. Don't ask me to test thousands of malware vs safe apps. Maybe it is an easy-to-fix thing.

EDIT: Have you tried the the AI to verify your own products. You know as I know there are thousands of ways to code a program. Static code analysis can only do so much.

EDIT You'll probably have to replicate what the AV vendors are doing with zero days, telemetry and things.

 

[ForgottenSeer 123960]

EDIT: Have you tried the the AI to verify your own products. You know as I know there are thousands of ways to code a program. Static code analysis can only do so much.

Instruction sets work wonders and provide well beyond the generic default output.

 

[danb]

Well, thats a problem for you to figure out. Don't ask me to test thousands of malware vs safe apps. Maybe it is an easy-to-fix thing.

EDIT: Have you tried the the AI to verify your own products. You know as I know there are thousands of ways to code a program. Static code analysis can only do so much.

No, the problem is that you are making assumptions about SiriusGPT's efficacy without testing for yourself first .

Instead, you just assume that LLM malware analysis is impossible, and that it will never be right. Guess what... during the development of Sirius, I felt the same way on multiple occasions and almost scrapped the entire project several times because I thought it was impossible. I had 2-3 obstacles that were particularly difficult to overcome, but I worked even harder, and got a little lucky on a couple of occasions, and now we have an amazing LLM malware engine... just ask the Kyrox developer .

Sorry if that sounds harsh, but it is the truth... we can still be friends if you want . I have said this a million times... instead of assuming ANYTHING, TEST FIRST!

BTW, I stand behind the Hasleo results, and by that I mean it would not hurt to research the files a little more. I stepped back for obvious reasons. But guess what... every file should be highly scrutinized... including our software.

And once again, the unsigned file / "trust me bro" approach is not effective in achieving a truly Safe status.

 

[danb]

Instruction sets work wonders and provide well beyond the generic default output.

Absolutely! For both false positives and negatives. And we have just started .

 

[Victor M]

Instruction sets work wonders and provide well beyond the generic default output.

Care to elaborate further ? I am missing your point about instruction sets.

You missed my edit @danb,
EDIT You'll probably have to replicate what the AV vendors are doing with zero days, telemetry and things.

Of course we'll still be friends, sorry for stomping on your optimism. I am such a skeptic sometimes.

 

[simmerskool]

I am not sure what do about the CyberLock lifetime licenses yet, since Sirius is a totally new tech / product. But since we are going to be implementing Sirius into CyberLock, I think really the only thing that makes sense is to make the CyberLock and SiriusGPT licenses interchangeable, that way users who have a lifetime license can install either one. While it is not optimal for VoodooSoft as a company, that is probably the route we will take, unless we can think of a better way to handle the lifetime licenses. It would be optimal for CyberLock users... it essentially means they get one heck of a free upgrade, and I am good with that.

well (fwiw) I would buy a 2d license for both, or make a donation for your efforts! Your software is reasonably priced and works as advertised, IMO.

 

[Victor M]

Or additionally put the AI to work inside your sandbox.

 

[ErzCrz]

It's been really interesting reading the development and it's certainly coming a long way. I've been a bit busy at this end to give it a whirl but look forward to see how it's implemented into CyberLock. You could package it a lot of different ways like DefenderUIPro contains some CL capabilities. I love what CL does and excited about some Siris parts to be added but you could also do SirisGPT as either an additional tool at a discounted price if you already have CL or and SiriusGPT as a standalone tool for the likes of malware testers etc.

Anyway, great stuff @danb

 

[Victor M]

sorry for stomping on your optimism. I am such a skeptic sometimes.

@danb Please take it to mean only what it literally says.

I do think you have to replicate what the AV vendors are doing for zero days, infrastructure and all. Or otherwise your training data would be outdated in a few days with ever new obfuscation methods and ever new bypass methods. I don't mean this to be a PR disaster for you. But you have to come up with a clever solution. Or maybe it doesn't require any. Maybe the default deny stance is enough. If so, please explain why. I am just challenging you to engage brain in a friendly way. I am an artist by training, and we always challenge the museum visitors to think.