2.9.26
Released 2 Nov 2026
Official CogitoDesk website
Malware analysis agent for Windows 10/11
CogitoDesk is an autonomous AI agent for Windows 10/11 (x64), current version 2.9.26 (released 2 Nov 2026). It runs your malware analysis tools, extracts IOCs, and writes detection rules inside your isolated lab environment.
Read the suspicious attachment, extract IOCs, and draft a YARA rule.
- read_file
suspicious_script.ps1read 1 - grep
http://evil.com1 matches - Shell
certutil -hashfile sample.docx SHA256exit 0 - write_file
rule.yarsaved - edit_file
report.md+1
waiting for your OK before the next stepRejectAccept
34 MB
Standard installer file
25 MB
Single executable file
13
Interface languages supported
3
Cloud, local, built-in
SHA-256 checksum published in the manifest
Verify installer integrity using certutil -hashfile
Malware analysis software for your lab
CogitoDesk performs malware analysis by running commands in your isolated virtual machine and showing every result so you keep full control over the process. Real results. Every action appears in the chat as a card for your review. The version 2.9.26 release includes improved shell commands for better efficiency.
Script examination of scripts
You use read_file to load a suspicious script and grep to find specific strings so you judge intent without execution in the lab environment. Hashing is key. Analysts look the SHA-256 hash up before going further with analysis. The agent drafts a YARA rule based on these extracted strings. This static detection rule matches files by strings or byte patterns. Every file change appears as a diff before you accept.
Tool trace
read_file script.ps1 → read 1
grep -i invoke → 3 matches
write_file rule.yar → savedDynamic malware analysis in VM
You move to the next phase by running the sample inside your isolated virtual machine, and the agent connects via SSH to capture output. Use Shell. Shell runs terminal commands like builds and linters to verify success. Use read_file to read the suspicious script as text without running it. The agent records the indicators of compromise so you can save the report with the new findings. This approach supports dynamic malware analysis effectively by isolating the sample in version 2.9.26.
Tool trace
Shell netstat → exit 0
Shell tasklist → exit 0
Shell reg query → exit 0YARA rule creation
You extract strings from a binary file to create a detection rule, and the agent uses grep to find unique patterns in the sample. Approve the diff. The agent writes a YARA rule file to match those patterns. You test the rule against known-good and known-bad files in the lab. This is malware analysis software for static malware analysis tasks. Cron runs the scheduled check to verify the version 2.9.26 update.
Tool trace
grep -a 'pattern' file → 1 matches
write_file test.yar → saved
Shell yara test.yar sample.txt → exit 0Report writing
The agent compiles your findings into a clear report for your team, and it uses write_file to create the document with a counter showing files created, edited and read. Review it. grep searches for specific strings to extract IOCs from the text. Shell runs the analysis commands in your isolated Windows 10/11 lab. No account is needed to start the malware analysis tools workflow immediately. You can perform pe static analysis ioc enrichment to enrich your data.
Tool trace
write_file report.md → saved
edit_file report.md → +10
read_file report.mdHow CogitoDesk differs from a typical chat assistant
CogitoDesk version 2.9.26 runs commands and shows results, so malware analysis software handles dynamic analysis directly in the chat with real output and detailed logs. Real output.
| Typical chat assistant | CogitoDesk | |
|---|---|---|
| Runs commands | Suggests commands | Runs commands |
| Shows output | No output shown | Shows real output |
| Edits files | Generates text | Edits files with diff |
| Privacy | Data leaves PC | It depends on the model you pick: with a local model nothing leaves the PC |
How to get started with CogitoDesk
- Download the 34 MB installer for Windows 10 or 11.
- Run the setup program or use the portable 25 MB executable.
- Select your model: cloud, local, or built-in.
- Open the working folder and connect to your isolated lab VM (SSH) before touching any sample.
Who uses CogitoDesk and when
Analysts run analysis utilities in an isolated lab because dynamic examination reveals runtime behavior while static inspection examines code without execution to identify hidden threats. CogitoDesk helps. Use advanced analysis when deep inspection is needed for complex samples.
Security researchers draft YARA rules using CogitoDesk, which extracts strings and writes rules while you review the diff before saving the final detection logic. It supports 13 languages. Global teams use it for malware analysis tasks daily.
Incident responders use CogitoDesk to write reports because the agent compiles IOCs and findings while you verify the data in the chosen environment. It runs commands. Local, WSL or SSH to a server you own for analysis tasks.
Frequently asked questions
What is malware analysis?
Malware analysis is the defensive study of suspicious files to understand their behavior and write detection rules, so analysts examine them carefully. Use isolated VMs. Static analysis examines files without running them.
Is cogitocode.org the official CogitoDesk website?
Yes, cogitocode.org is the official CogitoDesk website where you can verify the installer by comparing its SHA-256 checksum with the published manifest using the certutil command. Trust the file. Press Send feedback to report issues to the team.
Does CogitoDesk use dynamic analysis?
Yes, CogitoDesk executes analysis commands inside your isolated virtual machine via SSH, capturing the real output so you can review the findings directly in the chat interface. It runs. Every action appears as a card with its real result.
Does the agent read my files?
Yes, the model you choose processes the text, so data goes to the provider if cloud or stays local, while the diff appears before a change in Ask first only. Diff shown. This ensures you see changes before they happen in Ask first mode.
What is the examination of a file without running it?
Static malware analysis is the examination of a file without running it, so analysts can extract strings and write YARA rules to identify threats. Check IOCs. CogitoDesk uses grep to find patterns and shows the diff before you accept the change.
How do I verify the installer?
The SHA-256 checksum of the 34 MB installer is verified against the published manifest before execution to ensure integrity and prevent running modified files. Match the hash. Compare the output with the manifest.
Can I use a local model?
A local model runs entirely on your PC, so that no data leaves the machine while the agent processes your files securely and keeps your secrets safe from external eyes. It is private. No account is needed to run the software locally on your computer.
Start your malware analysis today
Download the 34 MB installer for Windows 10 or 11 and run commands in your lab to see results, because the agent executes tools and shows real output. Start now.
Download CogitoDesk for Windows ↗Quick links
This website is available in 20 languages.
Product features ↗ Model configuration ↗ Analysis workflows ↗ Download installer ↗ FAQ ↗ Privacy policy ↗
