Malware › Module 10 › Lesson 1
Checklist
Topic 22 capstone checklist — static, dynamic, net/proc, IOC report, ethics on $MAL_LAB.
Visual · t22_capstone_checklist
Checklist consolidates malware analysis pillars. Original Cyberlium.
Opening
Capstone proves disciplined analysis on legal samples in isolated lab — not a highlight reel of host OS mistakes.
Assemble checklist covering Modules 1–9: analysis mindset and $MAL_LAB setup, families literacy, static workflow and strings/YARA, dynamic hygiene and detonation with revert, net/proc unified timeline, IOC table and report draft, share safely without live samples, never daily driver pledge, legal sample chain, no weaponize refusal signed. Use on capstone walk of YOUR $MAL_LAB analysis — never host detonation, mystery samples, weaponization, or casual malware sharing. Notes chmod 600 under $HOME/cyberlium-lab. Each row links artifact or honest N/A with reason.
1. Scope and ethics
$MAL_LAB named with legal sample chain. NEVER daily driver, mystery USB, weaponize, live sample casual share.
Snapshot revert and share checklist acknowledged in header.
Command guide
Try these commands — Scope and ethics
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Malware analysis capstone — https://malwareunicorn.org/workshops/malwareanalysis101.html EICAR — https://www.eicar.org/ (capstone benign target)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows: Use WSL or install file for Windows
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
file "$HOME/cyberlium-lab/t22-mal/samples/"*
sha256sum "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt"
ls -la "$HOME/cyberlium-lab/t22-mal/"{samples,rules,notes}/Primary tools to practice this lesson: file, openssl. Reference sites: Malware analysis capstone (https://malwareunicorn.org/workshops/malwareanalysis101.html); EICAR (https://www.eicar.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Analysis pillars
Static hash/strings/YARA, dynamic detonation, net/proc timeline, IOC report, share-safe bundle — each row linked.
Integrity: observe only, hashes for share, mandatory VM revert.
3. Teardown
VM reverted, sample vault chmod 600, ethics pack linked, mentor handoff ready.
Defender paragraph: how IOCs help blue block this behavior class.
4. What you ship: Topic 22 capstone checklist
One-page malware analysis checklist for $MAL_LAB capstone path.
5. What you record before the next lesson
Checklist file path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Use checklist to justify host OS detonation 'once.'
Right
Checklist written. Next: Lab Path.
Mission: write malware capstone checklist
1) Ethics/scope section. 2) Static through share pillars. 3) Teardown and defender paragraph section.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Top five capstone artifacts?”
Knowledge Check
APPLY: Checklist includes:
Multiple choice
Knowledge Check
APPLY: True or False: Checklist allows mystery USB samples.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice