Lion Cipher Lab
Peel a real malware loader with CyberChef: multi-stage deobfuscation and the Magic wand (Part 2)
- Digital Forensics & IR (DFIR)
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Real obfuscation is never one clean layer. A loader that lands on a machine is typically a Base64 blob that gunzips into a list of character codes that rebuild a second Base64 string that XORs into the config that finally names the command-and-control server. Every one of those layers is cheap to add and each one buys the attacker another few minutes of your life. CyberChef is the fastest honest way for one analyst to walk down that stack, verify each step, and come out the other side holding the indicators — the domain, the IP, the scheduled task. This lab teaches the layered-decode habit…
What you'll learn
- running CyberChef fully offline from the GCHQ standalone build
- measuring Shannon entropy before guessing at an encoding
- reading what the Magic operation actually scores — and why to distrust it
- stripping junk with Regular expression and Find / Replace
- building a five-stage recipe that mirrors a real loader's layers
- recovering a single-byte XOR key with XOR Brute Force and a crib
- using Subsection to transform only part of an input
- using Registers to capture a key in one stage and reuse it in the next
- extracting and defanging IOCs (URLs, IP addresses) as the final stage
- saving and sharing a recipe as a portable, reviewable artifact
Steps in this lab
- Where Part 1 stopped, and what this lab adds
- Get your own copy: download the standalone build and pull the plug
- WHEN CyberChef is the right tool — and the three times it is the wrong one
- Why loaders are layered at all — and why you must not download one
- Build the sample: five layers, forward, one at a time
- Measure before you guess: the Entropy operation, and the one thing it cannot see
- Ask Magic — then interrogate the answer
- The real artifact: find the payload inside the file, and strip the junk
- Peel the stack — one layer, then look, then the next
- Finish the job: pull the IOCs out and defang them
- Subsection: transform one field and leave the rest of the evidence intact
- Registers: capture the key in one stage and spend it in the next
- The recipe is the artifact — save it, export it, hand it over
- Do it better: the habits, and knowing when to close the tab and write code
- What you actually learned