---
title: "Uploading Malware | Dataminr"
slug: "uploading-malware"
description: "This article describes how to upload a file for a Document Group to the malware vault and how to restrict file uploads in Communities to the malware vault."
tags: ["Importing Data", "Analytical Tools"]
status: "update"
updated: 2026-10-09T15:53:54Z
published: 2026-10-09T15:53:54Z
canonical: "knowledge.threatconnect.com/uploading-malware"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://knowledge.threatconnect.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Uploading Malware

## Overview

When creating a Document Group in ThreatConnect®, you can upload the file attachment for the Group to the malware vault to ensure that other users do not download it while it is retained for the purpose of analysis. Files uploaded to the malware vault must be password protected, zipped, and encrypted before they are uploaded in ThreatConnect. In Communities, document storage can be restricted to the malware vault to prevent users from downloading unencrypted executable malware files.

HintYou cannot use the Malware Group to upload malware to the malware vault. The Malware Group represents a malware family, but does not contain files. Instead, use the Document Group to store malware files in the malware vault and then, if desired, create a Malware Group and [associate](https://knowledge.threatconnect.com/docs/associations) it to the Document Group.

## Before You Start

### User Roles

- To upload a file to the malware vault when creating a Document Group, your user account must have an [Organization role](https://knowledge.threatconnect.com/docs/organization-roles) of Standard User, Sharing User, Organization Administrator, or App Developer.
- To restrict document storage to the malware vault in a Community, your user account must have a [Community role](https://knowledge.threatconnect.com/docs/community-roles) of Director or Editor in that Community.

## Upload a File to the Malware Vault

Follow these steps to upload a file attachment to the malware vault when [creating a Document Group](https://knowledge.threatconnect.com/docs/creating-groups):

1. On the **Create Document** screen, add a password-protected, zipped, and encrypted file containing the malware sample to the **Upload Document** field.Important`TCinfected` is the preferred password for files uploaded to the malware vault.
2. Select the **Add to Malware Vault** checkbox.ImportantIn [Communities that restrict document storage to the malware vault](/v1/docs/uploading-malware#restrict-document-storage-to-malware-vault), you must select **Add to Malware Vault**. If you do not, then you will not be able to save the Document Group.
3. Enter the password for the uploaded file in the **Password** field. `TCinfected`, the recommended password, is the default entry.
4. Fill out the rest of the fields on the **Create Document** screen.HintIt is recommended to enter the filename of the malware sample, including the file extension, inside the password protected .zip folder (e.g., **bad.exe**) as the Document Group’s **Summary**.
5. Save the Document Group.

## Restrict Document Storage to Malware Vault

When document storage is restricted to the malware vault in a Community, users must upload all file attachments for Document Groups to the malware vault. Follow these steps to restrict document storage to the malware vault in a Community:

1. From the **Settings**![Settings icon](https://cdn.document360.io/dfc206c8-1c9f-4725-b74d-a66f83432320/Images/Documentation/Settings%20icon.png)menu on the top navigation bar, select **Organization Settings**.
2. Select the **Communities/Sources** tab.
3. Select a Community.
4. On the Community’s **Information** screen, select the **Restrict Document Storage To Malware Vault** checkbox.

---

*ThreatConnect® is a registered trademark of ThreatConnect, Inc.*

20036-01 v.09.A