Malware › Module 4 › Lesson 1
Hashing
sha256 hashing identifies samples and feeds threat intel — compute on copies, never substitute hash for sandbox on $MAL_LAB.
Visual · mal_hashing
sha256 hashing literacy. $MAL_LAB only. Original Cyberlium.
Opening
sha256 is the sample fingerprint analysts share — not a substitute for safe execution discipline.
Cryptographic hashes (sha256 primary) uniquely identify file contents — same bytes, same hash. Analysts log sha256 in reports, search MalwareBazaar/VirusTotal, and correlate campaigns. sha256sum on Linux or Get-FileHash on Windows computes hashes on read-only copies without execution. Cyberlium teaches sha256 as step one in static workflow for $MAL_LAB-bound samples. You will NOT upload unauthorized org data to public scanners without policy. Next: Strings Tool.
1. Why sha256 for malware analysis
sha256 is collision-resistant enough for IOC sharing — defenders block hash, hunters pivot on reuse. Log hash before and after any lab transformation to detect tampering.
Multiple samples can share hash if identical — rare collisions across unrelated families still get dynamic confirmation on $MAL_LAB.
Command guide
Try these commands — Why sha256 for malware analysis
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Hashing for IOCs — https://www.cisa.gov/stopransomware (share hashes with defenders) VirusTotal hash search — https://www.virustotal.com/ (lookup by SHA256 — lab files only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install openssl
macOS: Built-in
Windows:
Command — copy this
choco install openssl
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal sha256sum "$HOME/cyberlium-lab/t22-mal/samples/eicar.com.txt" sha256sum "$HOME/cyberlium-lab/t22-mal/samples/demo_toy.py"
Primary tools to practice this lesson: openssl. Reference sites: Hashing for IOCs (https://www.cisa.gov/stopransomware); VirusTotal hash search (https://www.virustotal.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Computing hash safely
sha256sum sample.bin on a read-only copy — no execute bit needed. Record tool, date, and path in notes. Never hash live ransomware on production shares without IR authorization.
Compare hash to legal source manifest (MalwareBazaar tag) before $MAL_LAB detonation.
3. Hash lookup ethics
VT/MalwareBazaar lookup by hash may avoid upload — follow org policy on external intel. Forbidden: hashing stranger laptops without authorization or posting org samples publicly.
Ship: hash log template — sha256, source, date, lookup result summary. Next: Strings Tool.
4. What you ship: sha256 hash log template
Columns: sha256, source, date, intel summary. Read-only copy rule. $MAL_LAB context. chmod 600.
5. What you record before the next lesson
Date. Hash log template. $MAL_LAB named. File t22-m04-l01-hashing.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip hashing. Upload production disk image to VT without policy.
Right
Write sha256 hash log template. Next: Strings Tool.
Mission: template hash logging
1) Write hash log columns. 2) Note sha256sum on read-only copy. 3) Add intel lookup policy line. 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
Hash first — every report starts with the fingerprint.
Knowledge Check
APPLY: sha256 on Cyberlium is used to:
Multiple choice
Knowledge Check
APPLY: True or False: Same file bytes produce the same sha256.
True or False
Knowledge Check
APPLY: Hash should be computed:
Multiple choice