123 lines
4.1 KiB
Markdown
123 lines
4.1 KiB
Markdown
---
|
|
name: handling-malware-samples-safely
|
|
description: 'Establishes safe practices for acquiring, storing, transferring, and disposing
|
|
of malware samples: password-protected archives, neutralized extensions, hashing for
|
|
identity, and chain-of-custody. Activates for requests about safely storing or sharing
|
|
malware, sample handling hygiene, or defanging artifacts.'
|
|
domain: cybersecurity
|
|
subdomain: lab-foundations
|
|
tags:
|
|
- malware
|
|
- sample-handling
|
|
- hashing
|
|
- defanging
|
|
- chain-of-custody
|
|
- hygiene
|
|
version: 1.0.0
|
|
author: analyst-ai-pack
|
|
license: Apache-2.0
|
|
mitre_attack:
|
|
- T1027
|
|
d3fend:
|
|
- D3-FA
|
|
references:
|
|
- 'MalwareBazaar — https://bazaar.abuse.ch/'
|
|
- 'NIST SP 800-86 Guide to Integrating Forensic Techniques — https://csrc.nist.gov/pubs/sp/800/86/final'
|
|
---
|
|
|
|
# Handling Malware Samples Safely
|
|
|
|
## When to Use
|
|
|
|
- You are receiving, storing, or sharing a malicious file and need to prevent accidental
|
|
execution or contamination.
|
|
- You need a consistent naming and identity scheme so a sample can be tracked across tools
|
|
and tickets.
|
|
- You are packaging a sample to send to another analyst or a sandbox.
|
|
|
|
**Do not use** these conventions as a substitute for an isolated detonation environment; safe
|
|
storage prevents accidents but analysis still requires an isolated lab.
|
|
|
|
## Prerequisites
|
|
|
|
- An archive tool that supports password-protected, encrypted archives (7-Zip).
|
|
- A hashing utility (`sha256sum`, `certutil`, or the bundled script).
|
|
- A defined storage location with restricted access, separate from general file shares.
|
|
|
|
## Safety & Handling
|
|
|
|
- Treat every sample as live. Never double-click; never leave it with its original
|
|
executable extension on a working machine.
|
|
- Store samples inside an **encrypted, password-protected archive** with the conventional
|
|
password `infected`.
|
|
- **Neutralize the extension** on disk (e.g. `sample.exe` → `sample.exe.bin` or
|
|
`sample.exe_`) so the OS will not execute it on a stray click.
|
|
- **Defang indicators** in any text leaving the lab: `hxxp://`, `1.2.3[.]4`, `evil[.]com`.
|
|
|
|
## Workflow
|
|
|
|
### Step 1: Identify the sample by hash
|
|
|
|
A sample's identity is its SHA-256, not its filename. Compute hashes immediately:
|
|
|
|
```bash
|
|
python scripts/analyst.py hash sample.exe
|
|
# md5, sha1, sha256, size, ssdeep-like size bucket
|
|
```
|
|
|
|
Rename the working copy to its SHA-256 so identity travels with the file:
|
|
|
|
```bash
|
|
mv sample.exe 9f86d0818...<sha256>.bin
|
|
```
|
|
|
|
### Step 2: Store in an encrypted archive
|
|
|
|
```bash
|
|
7z a -p"infected" -mhe=on <sha256>.7z <sha256>.bin
|
|
# -mhe=on encrypts filenames too
|
|
```
|
|
|
|
Keep the loose, neutralized copy only inside the lab; the archive is the storage/transfer
|
|
form.
|
|
|
|
### Step 3: Record provenance
|
|
|
|
Capture where the sample came from, when, and who handled it. The script can emit a JSON
|
|
metadata record:
|
|
|
|
```bash
|
|
python scripts/analyst.py record <sha256>.bin --source "MalwareBazaar" --case CASE-001
|
|
```
|
|
|
|
### Step 4: Defang before sharing
|
|
|
|
When pasting URLs/IPs into a report or ticket, defang them:
|
|
|
|
```bash
|
|
python scripts/analyst.py defang ioc.txt
|
|
# http://evil.com/x -> hxxp://evil[.]com/x
|
|
```
|
|
|
|
## Validation
|
|
|
|
- `7z l -slt <sha256>.7z` shows encrypted headers (filenames not visible without password).
|
|
- The on-disk working copy has a neutralized extension and matches the recorded SHA-256.
|
|
- The provenance record contains source, timestamp, case ID, and all three hashes.
|
|
- No raw clickable URLs/IPs remain in any artifact destined to leave the lab.
|
|
|
|
## Pitfalls
|
|
|
|
- Sharing a sample in a plain zip — mail gateways and AV will quarantine or mangle it, and
|
|
recipients risk accidental execution. Always password-encrypt.
|
|
- Trusting the filename or first-seen label as identity; only the hash is authoritative.
|
|
- Forgetting filename encryption (`-mhe=on`), which leaks the sample name and your naming
|
|
scheme.
|
|
- Defanging only URLs but leaving live IPs or email addresses in the report.
|
|
|
|
## References
|
|
|
|
- See [`references/api-reference.md`](references/api-reference.md) for the hashing,
|
|
provenance, and defang tooling.
|
|
- MalwareBazaar and NIST SP 800-86 (linked in frontmatter).
|