SYMBOLCOMMON_NAMEaka. SYNONYMS
win.malterminal (Back to overview)

Malterminal


According to SentinelLabs, MalTerminal is an LLM-enabled malware family written in Python and compiled to a Windows executable, making it the earliest known example of such malware due to its use of a deprecated OpenAI chat completions API endpoint. Its primary capability is dynamically generating ransomware code or a reverse shell using GPT-4 based on operator choice. The family includes Python loader scripts and a more advanced variant with nuanced menu options, though no in-the-wild deployment or distribution was found, suggesting it may be proof-of-concept or red team tooling.

References
2025-09-19SentinelOneAlex Delamotte, Gabriel Bernadett-Shapiro, Vitaly Kamluk
Prompts as Code & Embedded Keys | The Hunt for LLM-Enabled Malware
Malterminal

There is no Yara-Signature yet.