Malware › Module 8 › Lesson 3
Share Safely
Share hashes not live samples casually — redaction, channel hygiene, STIX/TAXII literacy, $MAL_LAB integrity on export.
Visual · t22_share_safely
Share safely = hashes and redacted IOCs via proper channel. Original Cyberlium.
Opening
Defenders want SHA256 and domains through the ticket — not a malware.zip in general chat because you are proud of the detonation.
Safe sharing exports typed IOCs (hashes primary), redacted timeline excerpts, and report PDF/markdown — through mentor ticket, ISAC, or employer IR channel per policy — never casual Discord/Telegram live sample drops. Redact user paths, internal IPs, credentials, and full URIs with tokens. STIX/TAXII literacy: indicators as structured objects with confidence — course level names the concept; do not publish STIX bundles with live binaries attached. Cyberlium enforces: share defensive artifacts from $MAL_LAB legal analysis — NOT 'here is the sample' drive links, NOT IOC+malware combo packs, NOT sharing to offense forums. If recipient needs sample, they use legal malware repositories with their own lab — you provide hash and report.
1. What to share
SHA256, IOC table, behavior summary, detection ideas — redacted report section.
Optional PCAP excerpt redacted — not full pcap with credentials if any lab mistake.
Command guide
Try these commands — What to share
═══ LINUX / macOS (Malware Static & Dynamic Triage) ═══
Inspect PE / ELF binary headers and sections
Command — copy this
readelf -h sample.bin 2>/dev/null || xxd -g 1 -l 32 sample.bin
Check binary entropy (high entropy often signals packed or encrypted payloads)
Command — copy this
python3 -c "
import math, sys
data = open('sample.bin', 'rb').read() if len(sys.argv) > 1 else b'MZX\x00\x90'
ent = -sum((data.count(bytes([b]))/len(data))*math.log2(data.count(bytes([b]))/len(data)) for b in set(data))
print(f'Calculated File Entropy: {ent:.4f} (Entropy > 7.0 suggests packed/encrypted)')
" sample.bin 2>/dev/nullPrimary tools to practice this lesson: curl, jq. Reference sites: VirusTotal API docs (https://developers.virustotal.com/); MalwareBazaar hash (https://bazaar.abuse.ch/browse/); Hybrid Analysis (https://www.hybrid-analysis.com/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. What never to share casually
Live malware binaries, builder kits, ransomware notes, weaponized scripts, unredacted home paths.
Public cloud links without access control — treat as accidental distribution.
3. Channel hygiene
Use ticket or approved share with encryption; chmod 600 until sent; confirm recipient lab authorized.
Version IOC list — note if domain sinkholed or hash rotated.
4. What you ship: share safely checklist
Share allowlist + redaction checklist + NEVER live sample casual line.
5. What you record before the next lesson
Share safely checklist path.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Upload detonated sample to public Google Drive with IOC readme.
Right
Share safely checklist — hashes not live samples. Next: IOC Lab.
Mission: share safely checklist
1) List five shareable artifact types. 2) List five refused share types. 3) Redaction checklist ≥6 items. 4) Proper channel examples.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “VT submit vs internal ticket — policy?”
Knowledge Check
APPLY: Safe share prioritizes:
Multiple choice
Knowledge Check
APPLY: True or False: Discord malware drop helps defenders.
True or False
Knowledge Check
APPLY: Redact before share:
Multiple choice