Course Overview

This outline first briefly dives into the difference between the goals for the 2 days, after which each day is covered in detail. Both days contain theory sections, but I am a firm believer that nothing beats hands-on experience. As such, the majority of the time in this training is spent hands-on with actual malware samples. During any of the hands-on time, I am available for questions, and I will walk around the classroom to proactively ask attendees to explain what they are doing.

Day 1

The first day begins with introductions, virtual machine setup guidance, and a foundational theory session on navigating and using Ghidra. You will then work through increasingly advanced exercises using malware such as Amadey stealer and XorDDoS. These tasks involve analyzing binaries, decrypting strings, automating workflows, and understanding how Ghidra’s decompiler and APIs operate under the hood. The training demonstrates how automation can accelerate malware analysis. Additionally, you will explore Ghidra’s intermediate language, P-Code, showing how it can abstract away architecture-specific details and enable more flexible automation across different arhitectures.

Day 2

Day two shifts toward advanced malware analysis, AI-assisted reverse engineering, and statically compiled binaries. You will learn how large language models (LLMs) can support reverse engineering by renaming variables, summarizing functions, and improving analyst productivity through automated contextualization. To reduce hallucinations and improve accuracy, you will learn how graph theory concepts can organize function relationships so that LLMs process binaries in a logical bottom-up manner. Practical exercises use malware such as CaddyWiper to demonstrate these techniques, alongside scripts that visually highlight function complexity inside Ghidra to guide analysts during manual review.

The remainder of day two focuses heavily on Golang malware, as they are statically compiled. In particular, you will dig into the the Kuiper ransomware family and qBitStealer. You will examine Golang runtime structures, and learn how to recover missing function information using FunctionID and BSim databases. You will also learn how to create your own recovery databases before applying them to modified ransomware samples with stripped symbols, reinforcing realistic analysis workflows where imperfect recovery is expected. The course concludes with a competitive challenge in which attendees search for coding mistakes in the Kuiper ransomware.