Sample Sourcing

Obtain samples only from legal training sources — MalwareBazaar with account, theZoo intentionally, or YOUR org IR samples under policy.

Sample Sourcing• Audio Walkthrough

00:00/03:30

Visual · mal_sample_sourcing

Legal sample sourcing. $MAL_LAB only. Original Cyberlium.

Where the sample came from matters as much as where you run it.

Legal malware analysis uses samples from authorized sources: MalwareBazaar (with account and terms), theZoo (intentionally vulnerable training repo), vendor training sets, or internal IR samples your organization permits for lab use. Random Discord attachments, scraped production infections without authorization, and 'friend sent me this' are out of scope. Cyberlium teaches sourcing literacy so $MAL_LAB work stays defensible. You will NOT collect samples from victims without authorization or redistribute live malware to classmates. Next: Lab Setup.

1. Approved source categories

MalwareBazaar: register, accept terms, download tagged training samples. theZoo: git clone for intentional education — still run only on $MAL_LAB. Org IR: only if policy explicitly allows lab replication with classification rules.

Document source URL, download date, sha256, and terms acceptance in your analysis notes — chain of custody for learning.

Command guide

Try these commands — Approved source categories

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

EICAR standard — https://www.eicar.org/ (safe AV test string) Hybrid Analysis — https://www.hybrid-analysis.com/ (sandbox literacy)

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install python3

macOS:

Command — copy this

brew install python3

Windows: Download https://python.org/downloads/

═══ LINUX / macOS ═══

Command — copy this

mkdir -p "$HOME/cyberlium-lab/t22-mal/samples"
cat > "$HOME/cyberlium-lab/t22-mal/lab.env" <<'EOF'
export LAB_MAL=$HOME/cyberlium-lab/t22-mal
export LAB_HOST=${LAB_HOST:-127.0.0.1}
EOF

Command — copy this

chmod 600 "$HOME/cyberlium-lab/t22-mal/lab.env"
printf '%s
' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"
grep LAB_MAL "$HOME/cyberlium-lab/t22-mal/lab.env"
wc -c "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"

Primary tools to practice this lesson: python3, grep. Reference sites: EICAR standard (https://www.eicar.org/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Sources you must refuse

Unknown email attachments, anonymous paste links, 'latest ransomware leak' torrents, classmate USB drops, or production endpoints copied without IR authorization. Sourcing from harm creates legal and ethical risk.

If you cannot prove legal provenance, do not detonate — static hash lookup in VirusTotal (upload policy permitting) may suffice for literacy without execution.

3. Sharing and storage hygiene

Store samples password-protected or outside sync folders that might spread to cloud backups on daily drivers. Never post live samples in public chat — share sha256 and report summaries instead.

Ship: approved source list + NEVER source list for YOUR $MAL_LAB workflow. Next: Lab Setup.

4. What you ship: legal sample sourcing policy for $MAL_LAB

Approved: MalwareBazaar, theZoo, org IR per policy. NEVER: Discord unknowns, unauthorized prod copies. chmod 600.

5. What you record before the next lesson

Date. Sourcing policy. $MAL_LAB named. File t22-m01-l03-sample-sourcing.txt chmod 600.

6. Wrong vs right: live malware on daily driver vs sandbox

Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.

Wrong: Detonate a random attachment 'to see what it does.' Share live sample zip in class Discord.
Right: Write legal sourcing policy for $MAL_LAB. Next: Lab Setup.

Hands-on Exercise