Share Safely

Share hashes not live samples casually — redaction, channel hygiene, STIX/TAXII literacy, $MAL_LAB integrity on export.

Share Safely• Audio Walkthrough

00:00/03:13

Visual · t22_share_safely

Share safely = hashes and redacted IOCs via proper channel. Original Cyberlium.

Defenders want SHA256 and domains through the ticket — not a malware.zip in general chat because you are proud of the detonation.

Safe sharing exports typed IOCs (hashes primary), redacted timeline excerpts, and report PDF/markdown — through mentor ticket, ISAC, or employer IR channel per policy — never casual Discord/Telegram live sample drops. Redact user paths, internal IPs, credentials, and full URIs with tokens. STIX/TAXII literacy: indicators as structured objects with confidence — course level names the concept; do not publish STIX bundles with live binaries attached. Cyberlium enforces: share defensive artifacts from $MAL_LAB legal analysis — NOT 'here is the sample' drive links, NOT IOC+malware combo packs, NOT sharing to offense forums. If recipient needs sample, they use legal malware repositories with their own lab — you provide hash and report.

1. What to share

SHA256, IOC table, behavior summary, detection ideas — redacted report section.

Optional PCAP excerpt redacted — not full pcap with credentials if any lab mistake.

Command guide

Try these commands — What to share

═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══

Inspect PE / ELF binary headers and sections

Command — copy this

readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin

Check binary entropy (high entropy often signals packed or encrypted payloads)

Command — copy this

python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/null

Primary tools to practice this lesson: curl, jq. Reference sites: VirusTotal API docs (https://developers.virustotal.com/); MalwareBazaar hash (https://bazaar.abuse.ch/browse/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.