Malware › Module 1 › Lesson 4
Lab — Lab Setup
Pack analysis mindset — definition, sandbox checklist, sourcing policy — literacy file only, dest $MAL_LAB.
Visual · mal_lab_setup
Lab: write mindset pack. $MAL_LAB only. Original Cyberlium.
Opening
Mindset pack before any sample touches silicon — paperwork discipline analysts expect.
Lessons 1–3 defined malware analysis, sandbox-first rules, and legal sourcing. This lab ships the combined artifact: analysis definition, sandbox checklist, and sourcing policy for $MAL_LAB. No live detonation required — mindset and isolation paperwork first. Next: Quiz — Analysis Mindset and Lab.
1. Lab contract: write the mindset pack
Create $HOME/cyberlium-lab/t22-m01-l04-lab-setup.txt with date, operator, $MAL_LAB VM name, sandbox checklist, sourcing policy, and NEVER daily driver lines.
Optional: one-line proof your analysis VM exists — still no detonation required in this lab.
Command guide
Try these commands — Lab contract: write the mindset pack
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
ANY.RUN — https://any.run/ (public sandbox reports literacy) VirusTotal — https://www.virustotal.com/ (hash lookup literacy — upload YOUR benign lab files only) Practical Malware Analysis — https://nostarch.com/malware (reference reading)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest) Use WSL or install file for Windows
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal grep never "$HOME/cyberlium-lab/t22-mal/roe.txt" file "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" curl -sS https://any.run/ | head -8 curl -sS https://www.eicar.org/ | head -5
═══ WINDOWS ═══
Command — copy this
Get-Content $HOME/cyberlium-lab/t22-mal/roe.txt | Select-String never Get-Content $HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt | Measure-Object -Character
Primary tools to practice this lesson: curl, grep, file. Reference sites: ANY.RUN (https://any.run/); VirusTotal (https://www.virustotal.com/); Practical Malware Analysis (https://nostarch.com/malware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for daily driver paths, Discord sample links, or ransomware interest — redact or delete. Tutorials that skip VM setup get rewritten to $MAL_LAB placeholders before you copy habits.
Classmates build their own mindset packs for their $MAL_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Malware Families Literacy.
Analysts archive lab readiness before first sample; you are practicing that habit early.
4. What you ship: analysis mindset pack for $MAL_LAB
Mindset pack: definition, sandbox checklist, sourcing policy. $MAL_LAB named. NEVER daily driver. chmod 600.
5. What you record before the next lesson
Date. Mindset pack path. $MAL_LAB scope note. File t22-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and detonate on laptop. Add unauthorized sample source to pack.
Right
Write YOUR mindset pack for $MAL_LAB. chmod 600. Next: Quiz — Analysis Mindset and Lab.
Mission: freeze YOUR mindset pack on disk
1) Merge definition, sandbox, sourcing sections. 2) Name $MAL_LAB. 3) chmod 600. Never list daily driver as execution target.
Stuck? Ask Cyberlium AI Mentor
Mindset packs are boring on purpose — boring saves laptops and careers.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on analysis notes.
True or False
Knowledge Check
APPLY: A tutorial detonates on Windows host. You:
Multiple choice