Malware › Module 1 › Lesson 3
Sample Sourcing
Obtain samples only from legal training sources — MalwareBazaar with account, theZoo intentionally, or YOUR org IR samples under policy.
Visual · mal_sample_sourcing
Legal sample sourcing. $MAL_LAB only. Original Cyberlium.
Opening
Where the sample came from matters as much as where you run it.
Legal malware analysis uses samples from authorized sources: MalwareBazaar (with account and terms), theZoo (intentionally vulnerable training repo), vendor training sets, or internal IR samples your organization permits for lab use. Random Discord attachments, scraped production infections without authorization, and 'friend sent me this' are out of scope. Cyberlium teaches sourcing literacy so $MAL_LAB work stays defensible. You will NOT collect samples from victims without authorization or redistribute live malware to classmates. Next: Lab Setup.
1. Approved source categories
MalwareBazaar: register, accept terms, download tagged training samples. theZoo: git clone for intentional education — still run only on $MAL_LAB. Org IR: only if policy explicitly allows lab replication with classification rules.
Document source URL, download date, sha256, and terms acceptance in your analysis notes — chain of custody for learning.
Command guide
Try these commands — Approved source categories
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
EICAR standard — https://www.eicar.org/ (safe AV test string) Hybrid Analysis — https://www.hybrid-analysis.com/ (sandbox literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t22-mal/samples"
cat > "$HOME/cyberlium-lab/t22-mal/lab.env" <<'EOF'
export LAB_MAL=$HOME/cyberlium-lab/t22-mal
export LAB_HOST=${LAB_HOST:-127.0.0.1}
EOFCommand — copy this
chmod 600 "$HOME/cyberlium-lab/t22-mal/lab.env" printf '%s ' 'X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*' > "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" grep LAB_MAL "$HOME/cyberlium-lab/t22-mal/lab.env" wc -c "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"
Primary tools to practice this lesson: python3, grep. Reference sites: EICAR standard (https://www.eicar.org/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Sources you must refuse
Unknown email attachments, anonymous paste links, 'latest ransomware leak' torrents, classmate USB drops, or production endpoints copied without IR authorization. Sourcing from harm creates legal and ethical risk.
If you cannot prove legal provenance, do not detonate — static hash lookup in VirusTotal (upload policy permitting) may suffice for literacy without execution.
3. Sharing and storage hygiene
Store samples password-protected or outside sync folders that might spread to cloud backups on daily drivers. Never post live samples in public chat — share sha256 and report summaries instead.
Ship: approved source list + NEVER source list for YOUR $MAL_LAB workflow. Next: Lab Setup.
4. What you ship: legal sample sourcing policy for $MAL_LAB
Approved: MalwareBazaar, theZoo, org IR per policy. NEVER: Discord unknowns, unauthorized prod copies. chmod 600.
5. What you record before the next lesson
Date. Sourcing policy. $MAL_LAB named. File t22-m01-l03-sample-sourcing.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detonate a random attachment 'to see what it does.' Share live sample zip in class Discord.
Right
Write legal sourcing policy for $MAL_LAB. Next: Lab Setup.
Mission: freeze YOUR sourcing policy
1) List three approved sources. 2) List three forbidden sources. 3) Note sha256 + date logging rule. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
No provenance = no detonation.
Knowledge Check
APPLY: Legal sample sources on Cyberlium include:
Multiple choice
Knowledge Check
APPLY: True or False: Sharing live malware zips in class chat is acceptable.
True or False
Knowledge Check
APPLY: Before detonation you should log:
Multiple choice