Malware › Module 9 › Lesson 2
Legal Samples
Legal sample sourcing chain — intentional lab malware, repositories, instructor manifests; refuse mystery USB and breach dumps.
Visual · t22_legal_samples
Legal samples = documented source chain. $MAL_LAB. Original Cyberlium.
Opening
Where the sample came from matters as much as what it does — mystery binaries are someone else's incident waiting to happen.
Legal malware analysis uses samples with documented provenance: instructor-provided manifests, authorized malware repositories (MalwareBazaar research use, lab curriculum packages), your own intentionally crafted benign EICAR-class or custom lab binaries per brief — each with hash, source URL or mentor ID, and license/use terms. Refused sources: random email attachments, unknown USB, scraped stranger breach archives, 'friend sent me this exe,' torrent pirated software as malware stand-in without chain. Chain of custody note: UTC received, hash verified, stored chmod 600 in $HOME/cyberlium-lab/samples vault — never execute without manifest match. Legal clarity protects you if behavior crosses lines — mystery sample means stop, do not detonate.
1. Allowed source classes
Curriculum manifest, authorized research repo with ToS read, instructor signed package, self-built lab binary per assignment.
Hash must match manifest before $MAL_LAB detonation — mismatch means stop.
Command guide
Try these commands — Allowed source classes
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
MalwareBazaar about — https://bazaar.abuse.ch/about/ (legal sample sharing literacy) VirusTotal acceptable use — https://www.virustotal.com/ (upload policy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://bazaar.abuse.ch/about/ | head -10
curl -sS -o /dev/null -w "MalwareBazaar HTTP %{http_code}
" https://bazaar.abuse.ch/about/
grep never "$HOME/cyberlium-lab/t22-mal/roe.txt"Primary tools to practice this lesson: curl, grep. Reference sites: MalwareBazaar about (https://bazaar.abuse.ch/about/); VirusTotal acceptable use (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Refused sources
Unknown USB, phishing attachments, dark web markets, employer prod quarantine without IR authorization in writing.
Breach dump executables without legal review — often illegal to possess or analyze outside IR scope.
3. Chain of custody
Log: source ID, SHA256, UTC stored, analyst name, $MAL_LAB VM used, revert Y/N after run.
chmod 600 vault — no cloud sync of live samples folder to personal Drive.
4. What you ship: sample sourcing chain card
Allowed sources list + refused sources + custody log fields + hash-verify rule.
5. What you record before the next lesson
Sample sourcing chain path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Detonate unknown exe from Discord because 'good practice sample.'
Right
Sample sourcing chain documented. Next: No Weaponize.
Mission: sample sourcing chain
1) List four allowed source classes. 2) List five refused sources. 3) Custody log field list. 4) Hash-verify before detonate rule.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “MalwareBazaar download — lab policy?”
Knowledge Check
APPLY: Legal sample requires:
Multiple choice
Knowledge Check
APPLY: True or False: Mystery email attachment is valid lab sample.
True or False
Knowledge Check
APPLY: Before detonation verify:
Multiple choice