WS6 - All About Stoopie InfoStealers: Malware Analysis for Understanding, Custom Coding for True Understanding!

Instructed by:  Ryan “@rj_chap” Chapman

Level of Difficulty: Intermediate

Abstract:

Infostealers suck. We all know that. We don't like them. We want you to learn all that you can about them to help thwart the ongoing, ever-evolving threat. On that note, current infostealers are largely rule-based and path-driven, targeting known browser stores and wallets with noisy exfiltration methods. This four-hour workshop, led by Ryan Chapman and Aaron Rosenmund, moves beyond basic comprehension via observation to explore the evolution of precision-based malware. Students will utilize a live, on-demand lab environment to perform deep malware analysis using Ghidra to understand how current stealers operate.

The session then transitions from analysis to creation, where attendees code, compile, and re-build their own "evolved" stealers. We replace static file targeting with in-memory relevance models and trade obvious HTTPS exfiltration for stealthy timing and protocol-native patterns. This hands-on, kinesthetic experience focuses on building a custom arsenal from the ground up. Participants will learn to enhance their tools with behavioral stealth, transitioning from identifying "stoopie" patterns to implementing advanced, AI-driven tradecraft and custom red team tool operations.

You won't just learn how what an infostealer is. You'll learn how they operated end-to-end. Join us :).

Pre-Requisites:

The primary requirement for this course is a desire to learn and the determination to tackle challenging problems. In addition, having some familiarization with the following topics will help students maximize their time in this course:

·      A general background in computing and networking

·      Familiarity with blue and/or red team-oriented tools

·      An understanding of general networking concepts

Familiarity with software compilation and/or debugging - though we’ll cover everything students need to know