Uploading Malware

Overview

When creating a Document Group in ThreatConnect®, you can upload the file attachment for the Group to the malware vault to ensure that other users do not download it while it is retained for the purpose of analysis. Files uploaded to the malware vault must be password protected, zipped, and encrypted before they are uploaded in ThreatConnect. In Communities, document storage can be restricted to the malware vault to prevent users from downloading unencrypted executable malware files.

Hint

You cannot use the Malware Group to upload malware to the malware vault. The Malware Group represents a malware family, but does not contain files. Instead, use the Document Group to store malware files in the malware vault and then, if desired, create a Malware Group and associate it to the Document Group.

Before You Start

User Roles

To upload a file to the malware vault when creating a Document Group, your user account must have an Organization role of Standard User, Sharing User, Organization Administrator, or App Developer.
To restrict document storage to the malware vault in a Community, your user account must have a Community role of Director or Editor in that Community.

Upload a File to the Malware Vault

Follow these steps to upload a file attachment to the malware vault when creating a Document Group:

On the Create Document screen, add a password-protected, zipped, and encrypted file containing the malware sample to the Upload Document field.
Important
TCinfected is the preferred password for files uploaded to the malware vault.
Select the Add to Malware Vault checkbox.
Important
In Communities that restrict document storage to the malware vault, you must select Add to Malware Vault. If you do not, then you will not be able to save the Document Group.
Enter the password for the uploaded file in the Password field. TCinfected, the recommended password, is the default entry.
Fill out the rest of the fields on the Create Document screen.
Hint
It is recommended to enter the filename of the malware sample, including the file extension, inside the password protected .zip folder (e.g., bad.exe) as the Document Group’s Summary.
Save the Document Group.

Restrict Document Storage to Malware Vault

When document storage is restricted to the malware vault in a Community, users must upload all file attachments for Document Groups to the malware vault. Follow these steps to restrict document storage to the malware vault in a Community:

From the Settingsmenu on the top navigation bar, select Organization Settings.
Select the Communities/Sources tab.
Select a Community.
On the Community’s Information screen, select the Restrict Document Storage To Malware Vault checkbox.

ThreatConnect® is a registered trademark of ThreatConnect, Inc.

20036-01 v.09.A