Malware › Module 1 › Lesson 2
Sandbox First
Execute samples only inside an isolated analysis VM at $MAL_LAB — snapshot, no host share, no daily-driver detonation.
Visual · mal_sandbox_first
Sandbox first literacy. $MAL_LAB only. Original Cyberlium.
Opening
If the sample is not inside $MAL_LAB with snapshots, it does not get executed.
Sandbox-first discipline means every detonation happens on a disposable analysis VM — no shared folders to your host, no USB passthrough of unknowns, no 'just this once' on Windows/macOS you use for email and banking. Snapshots let you revert after each sample. Cyberlium treats sandbox-first as a hard requirement before any dynamic step in Topic 22. You will NOT bypass isolation because a tutorial skips VM setup. Next: Sample Sourcing.
1. Sandbox VM requirements
Dedicated analysis VM at $MAL_LAB: no personal email, no banking, no production VPN. Disable shared clipboard and drag-drop from host. Network: isolated or heavily filtered per lab policy — many sandboxes use fake internet (INetSim) or no egress.
Snapshot before each sample; revert after analysis. Document VM name, snapshot label, and date in chmod 600 notes.
Command guide
Try these commands — Sandbox VM requirements
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Rules of Engagement — https://www.eicar.org/ (benign test files only in lab) MalwareBazaar about — https://bazaar.abuse.ch/about/ (legal sample literacy — never auto-download) CISA ransomware — https://www.cisa.gov/stopransomware (defender context)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t22-mal/samples" cat > "$HOME/cyberlium-lab/t22-mal/roe.txt" <<'EOF' LAB_MAL=$HOME/cyberlium-lab/t22-mal samples: EICAR + tiny scripts YOU write only never: download live malware, detonate on host OS, weaponize EOF
Command — copy this
grep -E 'LAB_|never|samples' "$HOME/cyberlium-lab/t22-mal/roe.txt" curl -sS https://bazaar.abuse.ch/about/ | head -5
Primary tools to practice this lesson: grep, curl. Reference sites: Rules of Engagement (https://www.eicar.org/); MalwareBazaar about (https://bazaar.abuse.ch/about/); CISA ransomware (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Host vs guest boundary
Your daily driver is for notes and static tools only — sha256sum, strings, YARA on copies stored outside the guest. Never open samples on the host 'because static is safe' if the file is an executable you might double-click by mistake.
Transfer samples to $MAL_LAB via controlled channel — lab share with read-only mount, or copy inside guest from approved source only.
3. Sandbox-first protects you and others
One accidental detonation on a daily driver can encrypt files, steal cookies, or beacon to attacker infrastructure. Sandbox-first is non-negotiable ethics — not optional hardening.
Ship: sandbox checklist — VM name, snapshot plan, host-share OFF, $MAL_LAB network mode. Next: Sample Sourcing.
4. What you ship: sandbox-first checklist for $MAL_LAB
Checklist: dedicated VM, snapshot/revert, no host share, filtered egress. $MAL_LAB named. NEVER daily driver. chmod 600.
5. What you record before the next lesson
Date. Sandbox checklist. $MAL_LAB VM named. File t22-m01-l02-sandbox-first.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Enable shared clipboard to 'speed up' analysis. Detonate on host because 'the VM is slow.'
Right
Write sandbox-first checklist for $MAL_LAB. Next: Sample Sourcing.
Mission: document YOUR sandbox-first rules
1) List five sandbox requirements for $MAL_LAB. 2) Write NEVER daily driver line. 3) Note snapshot/revert plan. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Revert beats reinstalling your real laptop after one mistake.
Knowledge Check
APPLY: Sandbox-first on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Shared clipboard from analysis VM to daily driver is recommended.
True or False
Knowledge Check
APPLY: Before detonation on $MAL_LAB you should:
Multiple choice