Malware › Module 10 › Lesson 4
Lab — Capstone
Execute checklist on $MAL_LAB analysis — evidence complete, pack sealed, VM reverted, ethics signed.
Visual · t22_capstone_lab
Capstone: checklist × $MAL_LAB malware evidence. Original Cyberlium.
Opening
Close the analysis loop — legal sample, isolated lab, share-safe handoff — then revert and lock the vault.
Walk Topic 22 checklist on YOUR $MAL_LAB capstone sample: verify legal chain and hash, lab path current, static through net/proc artifacts linked, IOC report and share checklist complete, ethics pack signed, evidence pack indexed, VM reverted post-dynamic, sample vault chmod 600. Update index with capstone UTC completion. Defender paragraph: how YOUR IOCs and behavior summary help blue detect this class on endpoints and network. No host OS steps, no weaponization, no live sample in sealed pack, no mystery sourcing. Optional mentor review — three clarity questions on share-safe export.
1. Execute checklist
Check each row; link artifact or N/A with reason; confirm no refused techniques in any file.
Verify share bundle contains hashes not live binaries — scan folder before seal.
Command guide
Try these commands — Execute checklist
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Malware analysis report — https://malwareunicorn.org/workshops/malwareanalysis101.html VirusTotal — https://www.virustotal.com/ (hash context for lab file) YARA — https://yara.readthedocs.io/en/stable/ CISA — https://www.cisa.gov/stopransomware (defender handoff)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
Built-in (binutils)
Command — copy this
sudo apt install yara
macOS:
Command — copy this
brew install yara
Windows:
Command — copy this
choco install openssl
Use WSL or install binutils
Command — copy this
choco install yara # or use WSL
═══ LINUX / macOS ═══
Optional command
sudo apt install yara
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal sha256sum "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | tee "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" strings "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" | grep -i eicar | tee -a "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" yara "$HOME/cyberlium-lab/t22-mal/rules/eicar.yar" "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" 2>/dev/null | tee -a "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" || echo 'EICAR_Test_STRING (python verified)' | tee -a "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" cat >> "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" <<'EOF' capstone: file + hash + strings + yara on EICAR/demo only scope: LAB_MAL — never host OS detonation EOF
Command — copy this
grep -E 'capstone|eicar|EICAR|never' "$HOME/cyberlium-lab/t22-mal/report-capstone.txt" "$HOME/cyberlium-lab/t22-mal/roe.txt" | head -12
═══ WINDOWS ═══
Command — copy this
Get-FileHash $HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt -Algorithm SHA256 Get-Content $HOME/cyberlium-lab/t22-mal/roe.txt | Select-String never
Primary tools to practice this lesson: openssl, strings, yara, grep. Reference sites: Malware analysis report (https://malwareunicorn.org/workshops/malwareanalysis101.html); VirusTotal (https://www.virustotal.com/); YARA (https://yara.readthedocs.io/en/stable/); CISA (https://www.cisa.gov/stopransomware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender paragraph
One paragraph: static+dynamic key findings → IOC types → suggested block/detect actions for blue.
Name what breaks if you skip $MAL_LAB or weaponize — integrity tie-in.
3. Shutdown
VM snapshot reverted; vault secured; index signed complete UTC.
Optional thank-you to mentor/IR partner for share channel guidance.
4. What you ship: capstone evidence pack complete
Checked checklist + sealed evidence pack + revert proof + defender paragraph.
5. What you record before the next lesson
Capstone pack path. $MAL_LAB quiet.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Capstone evidence from host OS detonation and undocumented sample.
Right
Capstone complete on $MAL_LAB with full teardown. Next: topic quiz.
Mission: Topic 22 capstone
1) Walk checklist with evidence links. 2) Defender paragraph from your path. 3) Revert VM and seal pack. 4) Confirm no live binary in bundle.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum N/A documentation?”
Knowledge Check
APPLY: Capstone target:
Multiple choice
Knowledge Check
APPLY: True or False: Weaponize capstone earns credit.
True or False
Knowledge Check
APPLY: Teardown includes:
Multiple choice