Introducing StealerLens: An LLM-Powered Forensics Microscope to Accelerate InfoStealer ...

Introducing StealerLens: An LLM-Powered Forensics Microscope to Accelerate InfoStealer ...

Speakers: Olivier Bilodeau (Flare)

Conference: FIRSTCON

YouTube: https://www.youtube.com/watch?v=OSCTtAwpjsY

Overview

In the rapidly evolving landscape of cybercrime, information stealer malware remains a pervasive and insidious threat. These malicious programs silently exfiltrate sensitive data, including credentials, cookies, system information, and personal files, often leading to significant organizational breaches and personal compromise. Analyzing the resulting "stealer logs"—the bundled archives of stolen data—is a critical but labor-intensive task for incident responders and threat intelligence analysts. Olivier Bilodeau from Flare, alongside co-author Estelle, introduced StealerLens, an innovative LLM-powered tool designed to automate and accelerate the forensic analysis of these complex artifacts. This talk at FIRSTCON unveiled StealerLens as a "forensics microscope," transforming what was once a daunting manual process into a streamlined, intelligence-driven workflow.

The core challenge StealerLens addresses is the sheer volume and unstructured nature of stealer logs. Each log file, averaging 2.3 megabytes and containing around 30 distinct files, represents a "5,000 pages book" that no human analyst can efficiently parse at scale. By leveraging large language models (LLMs), StealerLens aims to derive a plausible hypothesis of the infection vector, complete with supporting evidence, thereby enabling defenders to quickly understand compromise scenarios, pivot to threat hunting, and bolster their defenses against future attacks. This automation not only saves invaluable time but also allows human analysts to focus their expertise on high-level strategic analysis rather than tedious data sifting.

Background

▶ Watch: Introduction and talk agenda (0:00)

Information stealer malware follows a predictable, yet highly effective, lifecycle. The infection typically begins with common vectors such as drive-by downloads, click-bait strategies, or malicious advertisements. Once executed, the malware operates with the user's privilege level, meticulously "slurping" a wide array of sensitive data. This includes browser credentials, cookies, autofill data, browsing history, clipboard contents, system information, screenshots of the user's desktop at the time of infection, and even files from common directories like the desktop or documents folder. This stolen data is then exfiltrated to a Command and Control (C2) server, frequently via Telegram channels, before being bundled into stealer logs. These logs are subsequently sold on cybercrime forums or Telegram channels, often in bulk, representing a lucrative commodity for other malicious actors.

A single stealer log is a treasure trove of forensic evidence, neatly packaged into distinct files like system_info.txt, passwords.txt, cookies.txt, history.txt, and screenshot.png. While this granular organization is beneficial for incident response, the volume of data within each file is overwhelming. For example, history.txt can contain weeks or months of browsing data, and system_info.txt might include extensive lists of installed software and running processes. Key artifacts like the clipboard.txt often reveal the user's last action before infection, potentially containing links to malicious downloads or PowerShell payloads. Screenshots provide a visual snapshot of the infection moment, frequently depicting fake software installers, crack tutorials, or phishing pages. The system.txt file, in particular, often contains details about the malware's detonation path, installed applications, and running processes, sometimes even advertising the specific stealer family (e.g., "Luma C2"). The challenge lies in efficiently sifting through these disparate pieces of evidence, identifying relevant correlations, and synthesizing a coherent narrative of the infection vector—a process that StealerLens seeks to automate.

Key Findings

▶ Watch: The problem: too much data, introducing LLMs (7:22)

The development of StealerLens revealed several critical insights into leveraging LLMs for complex forensic analysis. The primary finding was that a naive approach of feeding an entire stealer log to an LLM and asking for an infection hypothesis simply does not work. The LLM struggles with the sheer volume of unstructured data and the lack of specific context for each artifact. This led to the fundamental architectural decision of a multi-stage, per-artifact prompting strategy, where each component of the stealer log is processed with a tailored prompt before a final "master prompt" synthesizes the findings.

Another significant finding was the necessity for sophisticated pre-processing and filtering steps, particularly for large artifacts like browser history. Strategies like time-based truncation (keeping only recent entries), filtering benign domains, and proactively identifying suspicious ones (e.g., file-sharing sites) were essential to manage token limits and improve relevance. For visual data, an ad block filter using perceptual hashing was crucial to prevent LLMs from being confused by irrelevant advertisements often found in screenshots. The team also discovered that specific campaign behaviors, such as ClickFix (involving PowerShell payloads), required explicit guidance within the prompts, as these newer tactics might not be inherently understood by the models.

Perhaps the most impactful discovery for reliable output was the adoption of PyDantic models for structured output. Initial attempts to guide the LLM into a consistent output format through regular prompting proved unreliable. By defining the expected output structure using PyDantic, the LLM could reliably generate well-labeled JSON, even inferring categories and boolean flags based on the model's documentation without explicit prompt instructions for each specific case. This significantly enhanced the consistency and machine-readability of StealerLens's output. In early tests, StealerLens successfully generated accurate infection hypotheses for 21 out of 25 stealer logs, demonstrating the viability and effectiveness of this layered LLM approach, while also highlighting areas where more context or specific training was needed for edge cases.

Technical Deep Dive

▶ Watch: Structured output using Pydantic models (23:38)

StealerLens operates on a sophisticated, multi-stage architecture designed to process individual artifacts from a stealer log before synthesizing a comprehensive infection hypothesis. The core principle is to provide the LLM with highly specific, pre-processed, and contextualized information for each data type, significantly improving the quality and relevance of its analysis. The system was initially built with OpenAI models and later transitioned to an abstraction layer allowing flexibility, currently utilizing AWS Bedrock with the Sonnet model, chosen for its affordability and sufficient performance when heavily primed with context.

Artifact-Specific Prompting and Pre-processing

1. Browser Histories (history.txt):

• Challenge: History files are often excessively large, exceeding LLM token windows.
• Strategy: The system first sorts entries by time. For infection vector analysis, only the most recent relevant pieces are kept, typically truncating to the last few days. This strategy is effective for infection vectors but would be unsuitable for victimology.
• Filtering: To further manage context and highlight suspicious activity, the system filters out benign domains (e.g., Netflix, YouTube, Google searches, translation tools) and domains with good reputations, which are rarely direct infection vectors. Conversely, it positively filters suspicious domains known for file sharing, such as Mega, MediaFire, and other popular sharing services. This layered filtering is applied iteratively, checking token window size at each stage before feeding the refined history to the LLM.
• Prompt Guidance: The prompt explicitly guides the LLM to look for correlations (e.g., "YouTube followed by file sharing"), assign confidence levels to suspicious elements (e.g., "cracked," "patch," "keygen" are high confidence; "YouTube," "GitHub," shortened URLs are lower confidence), and focus on infection-related insights.

1. Software Layer:

• The list of installed software is analyzed, often enriched with installation paths where available.
• Correlation: The LLM is prompted to correlate installed software with browsing history to identify recent installations linked to suspicious downloads. An example cited was "kawi flash setup.exe" correlating with "flash installer" in browser history, strengthening the infection hypothesis.
• Token Management: Software lists are generally short enough to stay within token limits, requiring minimal filtering.

1. Processes:

• Many stealer families dump a list of running processes.
• Pre-processing: If only process names are available, the system counts common processes (e.g., dozens of SVC host instances) to provide a concise summary. If more exhaustive data like CPU and memory usage is present, it's reformatted for LLM consumption. Full command-line arguments are particularly valuable, as seen in ClickFix examples where PowerShell payloads are directly visible.
• Prompt Guidance: The prompt alerts the LLM to expect various input formats. It leverages the LLM's inherent knowledge of normal vs. suspicious processes, but also provides hints like "unusual path," "temporary folders," "encoded arguments," or "unusual memory usage" to aid detection. This helps identify process injection scenarios where legitimate executables (e.g., explorer.exe, msbuild.exe) are used as hosts for malicious code.

1. System Information (system.txt):

• This file contains crucial details like the malware's detonation path. Some information, like the infection path, is extracted directly without LLM intervention.
• Process Injection Context: The LLM is informed about common process injection techniques to avoid misidentifying legitimate Windows processes as malicious.
• Artifact Bundling Detection: A significant finding was that in 25% of logs, system.txt bundles installed applications and process lists. The system was trained to detect this bundling and treat these components as separate artifacts for analysis.

1. Clipboard (clipboard.txt):

• The clipboard content, representing the user's last activity, is fed directly to the LLM.
• Prompt Guidance: The LLM is instructed to recognize various types of content, such as direct download links (e.g., Mega links), themed activities (e.g., "Fortnite hack"), or even malicious payloads (e.g., PowerShell commands from ClickFix campaigns).

1. Screenshots (screenshot.png):

• Screenshots undergo a multi-stage analysis:
• Ad Block Filter: Due to cybercriminals replacing legitimate screenshots with ads, a perceptual hash (pHash) filter was implemented. Known ad images are quickly identified and discarded, preventing LLM confusion (e.g., mistaking "Manticore" or "cloud logs" from an ad as the infection vector).
• Evaluation Prompt: The first prompt asks the LLM to describe the screenshot content, focusing on specific elements: files, programs, installers, URLs, browser tabs, or suspicious elements (e.g., "YouTube blog," "specific software"). An example showed the LLM accurately identifying an ESET security window with a YouTube tutorial for "ESET nod32 anti-virus crack" and extracting the URL.
• Vector and Theme Identification: A second prompt layer, detailed in a prior Black Hat presentation and paper, extracts the Infection Vector (e.g., URLs as IOCs) and the Infection Theme (e.g., "cracked software," "gaming hack") for campaign tracking.

The Master Prompt and Structured Output

After individual artifact analysis, the aggregated insights are fed into a Master Prompt. This prompt instructs the LLM: "You are a cyber threat intelligence analyst and you are analyzing a stealer log, a victim stealer log." It then provides top-level system information, followed by the six key inputs: suspicious browsing-software pairs, suspicious processes, clipboard content, screenshot descriptions, and extracted infection vectors from screenshots. It also primes the LLM with knowledge of common campaigns like ClickFix and the significance of PowerShell on the clipboard, YouTube downloads, or file-sharing downloads.

The evolution of the master prompt was crucial:

1. Naive Version: Initial attempts yielded generic responses like "The victim was most likely infected by downloading and executing a malicious file."
2. Refined Hypothesis: Adding "The hypothesis should focus on what is the malicious file and how did the victim get infected" improved specificity (e.g., "infected by a malicious file disguised as keys++ version keygen").
3. Reasoning and Evidence: To provide actionable intelligence for incident responders, "explain your reasoning behind the hypothesis" was added, leading to detailed supporting evidence (e.g., "User visited a Mega download for KMSOto free crack the day of the infection date").

The breakthrough for consistent and machine-readable output was the adoption of PyDantic models. Instead of struggling with unstructured text, the LLM's output is constrained to a predefined JSON schema. This allows for:

• Reliable Labeling: Outputs are consistently labeled (e.g., "infection theme," "suspicious URL").
• Automated Categorization: The LLM can select from predefined enum categories (e.g., "cracked software," "gaming hack") or set boolean flags, leveraging the model's documentation to fill fields accurately without explicit prompting for every possibility.
• Detailed Evidence: The model is instructed to "list the evidence and observation supporting the hypothesis, give us everything you can," ensuring all relevant details are captured in a structured format.

This layered approach, combining artifact-specific pre-processing, intelligent prompting, and structured output, allows StealerLens to efficiently extract critical forensic insights from vast and complex stealer logs.

Demo / Proof of Concept

▶ Watch: StealerLens demo and practical use cases (24:50)

The talk included a live demonstration of StealerLens, showcasing its practical application. The speaker uploaded a stealer log to the web interface, which then initiated the processing workflow. As explained, the multi-stage analysis, involving numerous prompts and filtering steps, typically takes between one and three minutes, which is a significant improvement over hours of manual analysis for a "5,000 pages book."

The demo illustrated the tool's output, which included a clear, concise hypothesis of the infection vector. For instance, an example showed StealerLens identifying an infection related to "Adobe cracked light Adobe Lightroom," along with the exact URL from which it was allegedly downloaded. Crucially, the output also provided supporting evidence, detailing which artifacts contributed to the hypothesis. This included mentions of specific entries found in the history file and insights derived from "extensive screenshot analysis." The output also indicated which artifacts were present or absent in the log, giving analysts a complete picture of the available evidence and how the conclusion was reached.

The demonstration highlighted StealerLens's current focus on infection vector identification, which is considered the safest and most immediate use case. The system runs on AWS Bedrock instances in US East, ensuring that all data remains within Flare's AWS tenant, addressing potential data privacy concerns for users uploading their logs. While future use cases like victim profiling are envisioned, the speaker acknowledged the significant PII challenges involved and the need for careful implementation. The tool is currently gated behind a "verified practitioner" role in Flare's Discord community, reflecting a cautious approach to prevent its misuse by cybercriminals who could leverage it as an "oracle" to refine their tactics or avoid detection.

Defensive Implications

▶ Watch: Q&A: LLM architecture, chaining, and cost challenges (31:50)

StealerLens offers profound defensive implications for organizations and security analysts grappling with the relentless threat of information stealer malware. Its primary benefit is accelerated threat hunting and incident response. By automating the tedious and time-consuming process of sifting through massive stealer logs, StealerLens provides security teams with immediate, actionable intelligence. Instead of manually correlating data points across dozens of files, analysts receive a concise hypothesis of the infection vector and supporting evidence within minutes. This allows them to quickly understand how a compromise occurred, identify the initial access vector, and pivot to proactive measures such as:

• Proactive Threat Hunting: Using the identified infection vectors (e.g., malicious URLs, specific file names, campaign themes), defenders can search their networks and endpoints for similar indicators of compromise (IOCs), identifying other potentially infected systems or preventing future infections from the same source.
• Enhanced Incident Response: With a clear picture of the infection, incident responders can more efficiently contain, eradicate, and recover from breaches. They can prioritize affected systems, understand the scope of data exfiltration, and implement targeted remediation strategies.
• Strategic Defense Improvements: Over time, aggregate data from StealerLens could inform broader defensive strategies. By identifying common themes (e.g., widespread cracked software infections, specific file-sharing services), organizations can enhance user education, block malicious domains, or improve endpoint detection rules.
• Focus on High-Value Tasks: As Olivier Bilodeau aptly put it, StealerLens automates the "boring part" of analysis, effectively "handing the needle" to the analyst. This frees up skilled security professionals to apply their expertise to higher-level analytical tasks, such as understanding campaign motivations, developing new detection strategies, or performing deeper forensic investigations.
• Future Capabilities: The project aims to incorporate high-level attributes like the presence of VPN access or corporate credentials within stealer logs, enabling defenders to quickly identify high-impact victims. There's also an ambition to proactively notify platforms like npm, PyPI, and Rust crates about compromised open-source developers, preventing supply chain attacks. The long-term goal includes enabling community classification rules for identifying novel threats and exploring blast radius analysis, albeit with careful consideration for PII.

However, the tool also highlights critical defensive considerations: the inherent risk of PII exposure in victim profiling and the potential for misuse by cybercriminals. Flare has addressed this by implementing strict access controls (gated access for "verified practitioners" in a TLP: Amber community) and careful data handling, acknowledging the ethical dilemma of open-sourcing such a powerful tool that could inadvertently aid adversaries.

Key Takeaways

• LLMs Streamline Stealer Log Analysis: StealerLens demonstrates that large language models can significantly accelerate the forensic analysis of complex and voluminous information stealer logs, reducing processing time from hours to minutes.
• Multi-Stage Prompting is Crucial: A naive "dump everything" approach fails; effective analysis requires a sophisticated, multi-stage architecture with artifact-specific prompts and intelligent pre-processing (e.g., time-based filtering for history, ad blocking for screenshots).
• Structured Output Enhances Reliability: Leveraging PyDantic models for structured JSON output dramatically improves the consistency, machine-readability, and reliability of LLM-generated hypotheses and supporting evidence, allowing for automated categorization and detailed data extraction.
• Automating the "Boring Parts": StealerLens acts as a "forensics microscope," automating the tedious data sifting and correlation, thereby allowing human analysts to focus their expertise on higher-level strategic analysis and threat hunting.
• Focus on Infection Vector: The tool's primary immediate benefit is identifying the infection vector and providing supporting evidence, enabling rapid incident response and proactive threat hunting for similar compromises.
• Ethical Considerations and Controlled Access: Due to the sensitive nature of stealer logs and the potential for misuse by cybercriminals, StealerLens employs strict access controls (e.g., "verified practitioner" roles) to prevent the tool from becoming an "oracle" for adversaries.

About the Speaker(s)

The primary speaker for this presentation was Olivier Bilodeau, representing Flare. Olivier is a seasoned expert in the cybersecurity field, with a focus on threat intelligence and forensic analysis. His work often involves deep dives into malware artifacts and the development of innovative tools to combat cybercrime. He previously conducted an analysis of 200,000 stealer logs for an RSA presentation, demonstrating his extensive experience in this domain.

Olivier co-authored the StealerLens tool and the presentation with Estelle, whom he affectionately referred to as his "LLM queen." Estelle played a crucial role in developing the LLM prompts and co-writing the presentation, though she was unable to attend the FIRSTCON conference in Denver as she is based in France. Their collaborative effort highlights the interdisciplinary nature of modern cybersecurity research, combining traditional forensic expertise with cutting-edge artificial intelligence. The team also delivered a prior 45-minute Black Hat presentation and released a paper specifically on infection vector detection from information stealer screenshots, showcasing their deep commitment to advancing the field.