Malware › Module 8 › Lesson 3
Share Safely
Share hashes not live samples casually — redaction, channel hygiene, STIX/TAXII literacy, $MAL_LAB integrity on export.
Visual · t22_share_safely
Share safely = hashes and redacted IOCs via proper channel. Original Cyberlium.
Opening
Defenders want SHA256 and domains through the ticket — not a malware.zip in general chat because you are proud of the detonation.
Safe sharing exports typed IOCs (hashes primary), redacted timeline excerpts, and report PDF/markdown — through mentor ticket, ISAC, or employer IR channel per policy — never casual Discord/Telegram live sample drops. Redact user paths, internal IPs, credentials, and full URIs with tokens. STIX/TAXII literacy: indicators as structured objects with confidence — course level names the concept; do not publish STIX bundles with live binaries attached. Cyberlium enforces: share defensive artifacts from $MAL_LAB legal analysis — NOT 'here is the sample' drive links, NOT IOC+malware combo packs, NOT sharing to offense forums. If recipient needs sample, they use legal malware repositories with their own lab — you provide hash and report.
1. What to share
SHA256, IOC table, behavior summary, detection ideas — redacted report section.
Optional PCAP excerpt redacted — not full pcap with credentials if any lab mistake.
Command guide
Try these commands — What to share
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
VirusTotal API docs — https://developers.virustotal.com/ (hash lookup literacy — no live malware upload) MalwareBazaar hash — https://bazaar.abuse.ch/browse/ (defender hash database literacy) Hybrid Analysis — https://www.hybrid-analysis.com/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install jq
macOS:
Command — copy this
brew install jq
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install jq
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || true curl -sS https://www.virustotal.com/ | head -5 curl -sS https://bazaar.abuse.ch/about/ | head -5 grep . "$HOME/cyberlium-lab/t22-mal/notes/ioc-hashes.txt" 2>/dev/null | head -3
Primary tools to practice this lesson: curl, jq. Reference sites: VirusTotal API docs (https://developers.virustotal.com/); MalwareBazaar hash (https://bazaar.abuse.ch/browse/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What never to share casually
Live malware binaries, builder kits, ransomware notes, weaponized scripts, unredacted home paths.
Public cloud links without access control — treat as accidental distribution.
3. Channel hygiene
Use ticket or approved share with encryption; chmod 600 until sent; confirm recipient lab authorized.
Version IOC list — note if domain sinkholed or hash rotated.
4. What you ship: share safely checklist
Share allowlist + redaction checklist + NEVER live sample casual line.
5. What you record before the next lesson
Share safely checklist path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Upload detonated sample to public Google Drive with IOC readme.
Right
Share safely checklist — hashes not live samples. Next: IOC Lab.
Mission: share safely checklist
1) List five shareable artifact types. 2) List five refused share types. 3) Redaction checklist ≥6 items. 4) Proper channel examples.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “VT submit vs internal ticket — policy?”
Knowledge Check
APPLY: Safe share prioritizes:
Multiple choice
Knowledge Check
APPLY: True or False: Discord malware drop helps defenders.
True or False
Knowledge Check
APPLY: Redact before share:
Multiple choice