Malware › Module 2 › Lesson 4
Lab — Families
Pack malware families literacy — trojan/worm/virus, ransomware defender view, spyware/APT — literacy file only, dest $MAL_LAB.
Visual · mal_families_lab
Lab: write families pack. $MAL_LAB only. Original Cyberlium.
Opening
Families pack before sample labels — taxonomy on paper first.
Lessons 2-1 through 2-3 covered trojan/worm/virus, ransomware defender view, and spyware/APT naming. This lab merges them into one families literacy pack for $MAL_LAB report templates. No live sample required — classification vocabulary first. Next: Quiz — Malware Families Literacy.
1. Lab contract: write the families pack
Create $HOME/cyberlium-lab/t22-m02-l04-families-lab.txt merging family table, ransomware defender checklist, spyware/APT note, and NEVER authorship/encryption lines.
Optional: label one legal training sample hash with best-fit family category — static metadata only.
Command guide
Try these commands — Lab contract: write the families pack
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: grep, curl, python3. Reference sites: CISA ransomware resources (https://www.cisa.gov/stopransomware); VirusTotal intelligence (https://www.virustotal.com/); Microsoft threat names (https://learn.microsoft.com/en-us/defender-endpoint/malware-naming). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Cross-check weaponization language
Grep pack for builder links, encrypt loops, keylogger steps — delete. Tutorials showing ransomware construction get rewritten to defender detection notes only.
Classmates write their own families packs for their $MAL_LAB.
3. Lock the proof
chmod 600 on the pack. Quiz next — then Static Analysis Basics.
Family labels feed static triage in Module 3.
4. What you ship: malware families literacy pack for $MAL_LAB
Family table + ransomware defender checklist + spyware/APT note merged. $MAL_LAB named. No builders. chmod 600.
5. What you record before the next lesson
Date. Families pack path. $MAL_LAB named. File t22-m02-l04-families-lab.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Add ransomware builder URL to pack. Include keylogger tutorial steps.
Right
Write YOUR families literacy pack for $MAL_LAB. chmod 600. Next: Quiz — Malware Families Literacy.
Mission: freeze YOUR families pack on disk
1) Merge all M2 literacy sections. 2) Name $MAL_LAB. 3) chmod 600. Never include encryption or spyware deployment steps.
Stuck? Ask Cyberlium AI Mentor
Taxonomy packs make reports consistent — keep them defender-focused.
Knowledge Check
APPLY: This lab requires:
Multiple choice
Knowledge Check
APPLY: True or False: Families pack should include NEVER encryption how-to line.
True or False
Knowledge Check
APPLY: Ransomware section belongs in pack as:
Multiple choice