Malware Analysis Series

Security & Safe-Handling Policy

MalwareAnalysisSeries hosts live malware samples, unpacked stages, and functional recreations of offensive techniques (TTPs) for education and research. Treat every file in this repository as hostile until proven otherwise.

Handling Rules

  1. Isolate everything. Only open, unpack, or execute samples inside a dedicated analysis virtual machine (e.g. FLARE-VM, REMnux) with:
    • no shared folders or clipboard bridge to the host,
    • no access to production credentials, tokens, or data,
    • host-only or fully simulated networking (INetSim / FakeNet) unless controlled detonation is explicitly required.
  2. Snapshot before detonation and revert afterwards. Never reuse a contaminated VM.
  3. Passwords. All sample archives are encrypted with the password infected. This is intentional — it prevents accidental execution and keeps automated scanners from flagging or auto-detonating the files.
  4. Do not run binaries on a host you cannot re-image. This includes the compiled TTP proof-of-concepts under Extracted_TTPs/.
  5. Defanged samples (files suffixed _defanged) are patched to remove a dangerous behavior (e.g. process injection). They are still malware — treat them the same way.

Scope of This Repository

Everything here is provided strictly for defensive research, detection engineering, and education. It is not to be used to attack systems you do not own or lack explicit written authorization to test.

Reporting a Problem

If you believe something in this repository is mislabeled, accidentally exposes secrets, is not properly defanged/archived, or otherwise poses a risk that should be addressed, please report it privately rather than opening a public issue:

Please include the file path and a clear description of the concern. There is no formal SLA for this personal research project, but genuine safety reports will be prioritized.