How To Provide A Malware Sample To Carbon Black Support

[#1]

Environment

• All Carbon Black Products

Objective

Explain how to provide a malware sample when requested by Support

Resolution

1. Search for the hash on VirusTotal.com
   • If the hash is known to VT, a sample can be downloaded
   • If this is the case, let Support know the file can be downloaded via VirusTotal and ignore further steps
2. Put the file in question in an encrypted ZIP archive with password "infected"
3. Upload the resulting ZIP file via Malware Sample Uploads as described in Malware Sample Upload Instructions
4. Once uploaded, communicate the filename to Support via the case

Additional Notes

• Do not upload any files without request from Support
• Files should not be uploaded simply to analyze if something is a false positive or malicious. To be made aware of malicious hashes in an environment, consider adding on Managed Detection to a VMware CB Cloud instance by contacting an assigned Sales Account Manager.
• Malware should never be attached to an email or Support case
• Malware uploaded is only visible by the Threat Analysis Unit

Related Content

https://community.carbonblack.com/t5/Malware-Sample-Uploads/gp-p/malware_uploads
Malware Sample Upload Instructions - PLEASE READ BEFORE UPLOADING
https://community.carbonblack.com/t5/Managed-Detection/ct-p/cb-threatsight