Malware › Module 9 › Lesson 4
Lab — Ethics Notes
Assemble ethics pack — daily driver pledge, legal chain, no weaponize refusal, incident response drill on paper.
Visual · t22_ethics_lab
Lab: ethics pack signed for $MAL_LAB practice. Original Cyberlium.
Opening
Sign the lines before the sample — ethics pack proves you know where analysis stops and harm begins.
Build ethics pack from Modules 9-1 through 9-3: (1) never daily driver pledge signed UTC; (2) sample sourcing chain for YOUR capstone sample with hash and manifest ID; (3) no weaponize refusal card signed; (4) paper tabletop: 'USB found in parking lot' and 'friend asks you to improve trojan' — write refused response and escalation steps for each; (5) chmod 600 ethics directory. No live detonation required in this lab — documentation and judgment proof. Optional mentor attestation. Cross-link integrity block for report module. If any prior lab used undocumented sample, stop capstone and fix chain before continuing.
1. Pack contents
Pledge, sourcing chain, refusal card, two tabletop scenarios with responses, mentor sign-off line optional.
Single index.md lists files and UTC dates.
Command guide
Try these commands — Pack contents
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MalwareBazaar — https://bazaar.abuse.ch/about/ (defender-oriented samples) VirusTotal — https://www.virustotal.com/ (hash intelligence) CISA — https://www.cisa.gov/stopransomware (legal incident sharing) EICAR — https://www.eicar.org/ (always-safe lab file)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || true cat >> "$HOME/cyberlium-lab/t22-mal/notes/ethics-sources.txt" <<'EOF' legal: eicar.org, your own lab scripts, authorized feeds literacy: malwarebazaar about, hybrid-analysis, any.run docs never: virusshare bulk download, live C2, weaponize EOF
Command — copy this
grep -E 'legal|never|literacy' "$HOME/cyberlium-lab/t22-mal/notes/ethics-sources.txt" curl -sS https://bazaar.abuse.ch/about/ | head -5
Primary tools to practice this lesson: curl, grep. Reference sites: MalwareBazaar (https://bazaar.abuse.ch/about/); VirusTotal (https://www.virustotal.com/); CISA (https://www.cisa.gov/stopransomware); EICAR (https://www.eicar.org/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tabletop scenarios
Scenario A: unknown USB — refuse host insert, chain of custody to IR not personal analysis.
Scenario B: weaponize request — refusal script, no sample modification, mentor notify.
3. Integrity link
Ethics pack IDs referenced in capstone report integrity block — single accountability thread.
Teardown: secure pack; no public upload of signed pledges with personal address — redact if sharing.
4. What you ship: ethics lab pack
Signed pledge + chain + refusal + two tabletop responses — chmod 600.
5. What you record before the next lesson
Ethics lab pack path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip ethics lab because 'I am careful on host OS.'
Right
Ethics lab pack complete. Next: quiz.
Mission: ethics lab
1) Bundle three signed cards. 2) Write two tabletop responses. 3) Link capstone sample hash to chain. 4) chmod 600 index.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Tabletop — USB found wording?”
Knowledge Check
APPLY: Ethics lab includes:
Multiple choice
Knowledge Check
APPLY: True or False: Skip ethics lab if samples seem benign.
True or False
Knowledge Check
APPLY: Unknown USB scenario:
Multiple choice