# Assessing LLMs in Malicious Code Deobfuscation of Real-world Malware Campaigns

> The paper evaluates four LLMs on deobfuscating real-world malicious scripts from the Emotet malware campaign and examines their use in reverse engineering.

- Authors: Constantinos Patsakis; Fran Casino; Nikolaos Lykousas
- Venue: arXiv
- Status: Preprint
- Publication / posting date: April 30, 2024
- Date source: First arXiv submission date.
- First arXiv submission: April 30, 2024
- arXiv: 2404.19715
- Reviewed arXiv version: v1
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original paper: <https://arxiv.org/abs/2404.19715>
- PDF: <https://arxiv.org/pdf/2404.19715>
- BibTeX: <https://awesomerea.org/papers/citations/paper-llm-malware-deobfuscation.bib>
- Catalog page: <https://awesomerea.org/papers/paper-llm-malware-deobfuscation/>
- Record JSON: <https://awesomerea.org/papers/paper-llm-malware-deobfuscation/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/papers/paper-llm-malware-deobfuscation/index.md)

## Scope and limitations

The evaluation covers four LLMs and malicious scripts from the Emotet campaign.

## Why it fits this collection

Deobfuscating malicious scripts helps researchers understand code behavior during malware reverse engineering.

## Publication and review notes

The date and venue come from the arXiv record.

## Primary sources

1. <https://arxiv.org/abs/2404.19715>

## About this entry

Reviewed against the paper and its primary sources. Cite the original authors using the linked paper or BibTeX.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.