Evidence Pack

Bundle redacted malware analysis evidence from YOUR $MAL_LAB — index, report, IOC, ethics, no live sample.

Evidence Pack• Audio Walkthrough

00:00/03:01

Visual · t22_evidence_pack

Evidence pack = mentor handoff bundle from $MAL_LAB. Original Cyberlium.

One indexed pack with hashes and redactions beats a zip called samples_final_do_not_open.

Assemble evidence pack: legal sample chain card, lab path diagram, static summary (hash/strings/YARA hits redacted), dynamic summary and net/proc timeline excerpt, IOC table, report draft, share safely checklist completed, ethics pack (pledge, refusal), integrity statement ($MAL_LAB only, no weaponize, no host OS, hashes not live samples). Single directory chmod 600 — index.md lists contents with UTC dates and redactions. Mentor copy has no live binary — SHA256 and report only. Gap paragraph: next steps for Topic 23 reverse engineering on same hash if brief allows defensive RE. No stranger paste, no builder tools, no casual cloud upload.

1. Pack contents

Minimum: chain, path, static/dynamic summaries, IOC table, report, share checklist, ethics pack, index, integrity.

Optional: YARA rule excerpt, PCAP redacted summary — no live pcap with creds.

Command guide

Try these commands — Pack contents

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: yara, strings. Reference sites: YARA capstone (https://yara.readthedocs.io/en/stable/writingrules.html); Hybrid Analysis report (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.