Configuration parsing can be fun and useful, but it has never been easy. In this workshop, we will start from the ground by introducing malware configuration then deep diving into parsing and extraction. Using case studies of malware families that leverage various anti-analysis techniques attendees will get guided hand-on exercises in writing their own config parsers. Memory dumps from the execution of malware samples and Python scripts will be provided for attendees to practise. Participants will learn our workflow on writing configuration parsers and how to overcome some anti-analysis techniques. This workshop focuses on malware configuration parsing, therefore assumes that attendees are familiar with malware analysis and reverse engineering. In this workshop, attendees will be taught how to extract configuration from malware step by step using real-world samples (e.g. Guloader and SnakeKeyLogger). The techniques the workshop teaches are applicable to other malware strains out there. There will be common protection design among families, as well as customized anti-analysis we had to tackle in our extractors. Additionally, malware compiled to MSIL (.NET) follows a different ISA and data storage. We will share how to parse a MSIL infostealer named SnakeKeyLogger. Lastly, we will discuss how the configuration used by ransomware posed a different purpose compared to trojans.