Lion Cipher Lab
Characterize an infostealer: what it steals, from where, and how it exfiltrates
- Digital Forensics & IR (DFIR)
- Intermediate
- ~50 min
- Free · no account required
Why it matters
Infostealers are the quiet engine behind a huge share of modern breaches: they run for a few seconds on one laptop, sweep every saved password, cookie and crypto wallet on it, ship the lot to a criminal, and vanish — and the stolen session cookies and passwords then turn up in someone else's incident weeks later. When one lands in your environment, the question your boss asks is not 'what is the file's hash' but 'what did it take, and whose accounts do we burn right now?' You answer that from behavior — the files it touched and the traffic it sent — long before anyone finishes…
What you'll learn
- reading a behavioral sandbox timeline (file, crypto, and network events) to characterize malware
- recognizing the browser credential-store paths an infostealer targets (Chrome Login Data, Firefox logins.json, cookie DBs)
- understanding how saved browser passwords are decrypted (Windows DPAPI + the Chromium Local State AES key)
- spotting the collect-stage-exfiltrate pattern: loot copied to a staging folder, zipped, and POSTed to a C2 gate
- extracting IOCs (paths, filenames, C2 host, user-agent) from a run and mapping behavior to MITRE ATT&CK
- scoping impact from behavior alone: which accounts and secrets to force-reset, in what order
- judgment: when a behavior trace characterizes the stealer and when you must reverse the binary
Steps in this lab
- The scene: you're the analyst, and this is all you have
- Artifact 1 — the file-access timeline: WHERE it went looking
- Artifact 2 — the crypto calls: HOW it turned encrypted blobs into passwords
- Artifact 3 — the rest of the loot: cookies, wallet, autofill, and a screenshot
- Artifact 4 — staging and archive: the loot gets packed for travel
- Artifact 5 — the network capture: HOW it left the building
- Pull the IOCs and map the behavior to MITRE ATT&CK
- The judgment call: when behavior is enough, why this IS the pattern, and how a pro scopes the damage
- What you can now do (and how to practice it safely)