Malware › Module 10 › Lesson 3
Evidence Pack
Bundle redacted malware analysis evidence from YOUR $MAL_LAB — index, report, IOC, ethics, no live sample.
Visual · t22_evidence_pack
Evidence pack = mentor handoff bundle from $MAL_LAB. Original Cyberlium.
Opening
One indexed pack with hashes and redactions beats a zip called samples_final_do_not_open.
Assemble evidence pack: legal sample chain card, lab path diagram, static summary (hash/strings/YARA hits redacted), dynamic summary and net/proc timeline excerpt, IOC table, report draft, share safely checklist completed, ethics pack (pledge, refusal), integrity statement ($MAL_LAB only, no weaponize, no host OS, hashes not live samples). Single directory chmod 600 — index.md lists contents with UTC dates and redactions. Mentor copy has no live binary — SHA256 and report only. Gap paragraph: next steps for Topic 23 reverse engineering on same hash if brief allows defensive RE. No stranger paste, no builder tools, no casual cloud upload.
1. Pack contents
Minimum: chain, path, static/dynamic summaries, IOC table, report, share checklist, ethics pack, index, integrity.
Optional: YARA rule excerpt, PCAP redacted summary — no live pcap with creds.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
YARA capstone — https://yara.readthedocs.io/en/stable/writingrules.html Hybrid Analysis report — https://www.hybrid-analysis.com/ (compare to your static pack)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install yara
Built-in (binutils)
macOS:
Command — copy this
brew install yara
Windows:
Command — copy this
choco install yara # or use WSL
Use WSL or install binutils
═══ LINUX / macOS ═══
Optional command
sudo apt install yara
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal
yara "$HOME/cyberlium-lab/t22-mal/rules/eicar.yar" "$HOME/cyberlium-lab/t22-mal/samples/" 2>/dev/null || python3 <<'PY'
from pathlib import Path
import os
lab = os.path.join(os.environ['HOME'], 'cyberlium-lab/t22-mal')
s = Path(lab, 'samples/eicar.com.txt').read_text()
print('EICAR_Test_String MATCH' if 'EICAR-STANDARD' in s else 'miss')
PYCommand — copy this
grep -E 'rule|eicar' "$HOME/cyberlium-lab/t22-mal/rules/eicar.yar"
Primary tools to practice this lesson: yara, strings. Reference sites: YARA capstone (https://yara.readthedocs.io/en/stable/writingrules.html); Hybrid Analysis report (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Index fields
Artifact name, module lesson, path, UTC date, description, redactions applied.
Cross-link checklist row to index row — accountability.
3. Integrity
Statement: $MAL_LAB only, legal source, VM reverted, no weaponize, share-safe export only.
Secure pack — no public upload of live samples folder.
4. What you ship: malware analysis evidence pack
Bundled deliverables + index + integrity lines — chmod 600, no live sample.
5. What you record before the next lesson
Evidence pack path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add live ransomware binary to pack for 'completeness.'
Right
Evidence pack assembled. Next: Capstone Lab.
Mission: assemble evidence pack
1) Bundle report IOC path ethics index. 2) Write integrity statements. 3) Confirm no live binary in folder. 4) Gap paragraph for Topic 23.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum index rows for capstone?”
Knowledge Check
APPLY: Evidence pack includes:
Multiple choice
Knowledge Check
APPLY: True or False: Live sample in mentor pack OK.
True or False
Knowledge Check
APPLY: Integrity line states:
Multiple choice