Mistral Large 4 — from unknown binary to detection rule

Malware Triage

A full agent run on an unlabeled CobaltStrike loader, with no human in the loop. Tool calls and findings are taken from the actual trajectory.

As handed to the model: no name, no labels

Ground truthCobaltStrike Artifact Kit loader, hidden from the model

Notable imports

Suspicious string

0x2c00 %c%c%c%c%c%c%c%c%cMSSE-%d-server

the nine %c build \\.\pipe\ at runtime

Source: fingerprint · binary_info · imports · strings (T1–T2)