Malware › Module 1 › Lesson 4
Lab — Lab Setup
Pack analysis mindset — definition, sandbox checklist, sourcing policy — literacy file only, dest $MAL_LAB.
Visual · mal_lab_setup
Lab: write mindset pack. $MAL_LAB only. Original Cyberlium.
Opening
Mindset pack before any sample touches silicon — paperwork discipline analysts expect.
Lessons 1–3 defined malware analysis, sandbox-first rules, and legal sourcing. This lab ships the combined artifact: analysis definition, sandbox checklist, and sourcing policy for $MAL_LAB. No live detonation required — mindset and isolation paperwork first. Next: Quiz — Analysis Mindset and Lab.
1. Lab contract: write the mindset pack
Create $HOME/cyberlium-lab/t22-m01-l04-lab-setup.txt with date, operator, $MAL_LAB VM name, sandbox checklist, sourcing policy, and NEVER daily driver lines.
Optional: one-line proof your analysis VM exists — still no detonation required in this lab.
Command guide
Try these commands — Lab contract: write the mindset pack
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, grep, file. Reference sites: ANY.RUN (https://any.run/); VirusTotal (https://www.virustotal.com/); Practical Malware Analysis (https://nostarch.com/malware). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check against misuse patterns
Grep notes for daily driver paths, Discord sample links, or ransomware interest — redact or delete. Tutorials that skip VM setup get rewritten to $MAL_LAB placeholders before you copy habits.
Classmates build their own mindset packs for their $MAL_LAB — not yours.
3. Lock the proof
chmod 600 on the pack. Quiz is next — then Malware Families Literacy.
Analysts archive lab readiness before first sample; you are practicing that habit early.
4. What you ship: analysis mindset pack for $MAL_LAB
Mindset pack: definition, sandbox checklist, sourcing policy. $MAL_LAB named. NEVER daily driver. chmod 600.
5. What you record before the next lesson
Date. Mindset pack path. $MAL_LAB scope note. File t22-m01-l04-lab-setup.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Skip the file and detonate on laptop. Add unauthorized sample source to pack.
Right
Write YOUR mindset pack for $MAL_LAB. chmod 600. Next: Quiz — Analysis Mindset and Lab.
Mission: freeze YOUR mindset pack on disk
1) Merge definition, sandbox, sourcing sections. 2) Name $MAL_LAB. 3) chmod 600. Never list daily driver as execution target.
Stuck? Ask Cyberlium AI Mentor
Mindset packs are boring on purpose — boring saves laptops and careers.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: You should chmod 600 on analysis notes.
True or False
Knowledge Check
APPLY: A tutorial detonates on Windows host. You:
Multiple choice