Private Malware Analysis Without Alerting the Attacker

PSOE By islever Editorial Last updated

Developing and implementing mechanisms to detect risks and identify threats. Leveraging threat intelligence for detection.

Short answer

C Upload the malware to Google Threat Intelligence with Private Scanning so it is analyzed in an isolated environment without sharing the sample or its hash publicly.

Question

You have identified and isolated a new malware sample installed by an advanced threat group that you believe was developed specifically for an attack against your organization. You want to quickly and efficiently analyze this malware to get IOCs without alerting the threat group. What should you do?
  1. Search for the threat group in Google Threat Intelligence.
  2. Upload the malware to Google Threat Intelligence by using VirusTotal.
  3. Upload the malware to Google Threat Intelligence by using Private Scanning. Correct Answer
  4. Calculate the file checksum for the malware, and search for the checksum in GoogleThreat Intelligence by using VirusTotal.

Key Takeaways

The question tests whether you know which Google Threat Intelligence capability analyzes a sample in a non-shared, private environment, versus public VirusTotal upload or mere hash lookups that yield nothing for a never-before-seen sample.

When analyzing a bespoke, targeted malware sample, you need IOCs extracted without the sample or its hash propagating to public multi-scanner results the threat group could monitor. Google Threat Intelligence's Private Scanning provides exactly that, making option C the right choice for covert analysis of a custom implant.

Common mistake: Option B (uploading via VirusTotal) is the instinctive answer but is wrong here: a public VirusTotal upload shares the sample and its detection results with all subscribers, including vendors and researchers monitored by the threat group, effectively burning the sample and the investigation.

Expert Analysis

Why the Answer Is Correct

Private Scanning is the Google Threat Intelligence capability designed precisely for this scenario: it submits the file for scanning and sandbox detonation in an environment where results are visible only to your organization. Because neither the sample nor its hash is disclosed to the broader scanning-engine community or other VT users, an advanced threat group watching for its custom tool to appear in open intelligence sources receives no signal that you possess it. In return you still receive behavioral sandbox output, network and persistence indicators, and private-engine detections that you can convert into your own IOCs and detections.

Why the Other Options Are Wrong

Option A only queries existing intelligence about the group and cannot analyze a brand-new, custom-developed sample that has never been catalogued, so it yields no IOCs from your specimen. Option D searches for the checksum of a sample you already possess; for a novel implant the hash will not exist in any repository, so the lookup returns nothing useful and reveals nothing about behavior. Option B, uploading through standard VirusTotal, directly violates the stated constraint of not alerting the group, because public VT sharing distributes the sample and scan results across vendors, sandboxes, and the community at large.

Community Comment Notes

The single community comment agrees with the verdict, explaining that Private Scanning 'lets you detonate and analyze the sample in an isolated, non-shared environment' and that 'you get sandbox behavior, IOCs, and detection engine results without the sample or its hash being shared with the broader community.' That reasoning matches the exam doctrine on protecting the confidentiality of an active, targeted investigation while still leveraging threat intelligence tooling.

Exam Strategy

Read the constraint clause first — in this question, 'without alerting the threat group' is the deciding phrase, and any action that shares the sample or its hash publicly is disqualified. Expect variants where the correct move is a private, scoped, or embargoed capability rather than the default public workflow.

Frequently Asked Questions

Why can't I just upload the sample to VirusTotal to get IOCs?

A standard VirusTotal upload shares the sample and its scan results with the broader community and scanning vendors, which an advanced threat group monitoring for its custom tool would likely observe, ending your covert access to it.

Why is searching for the malware's checksum useless here?

The sample was developed specifically for your organization and is brand new, so its hash will not exist in any intelligence repository; a checksum lookup returns no behavior or IOC data about a file you already hold.

More PSOE FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

  1. 4d49dd6 👍 1 Answered C
    Google Threat Intelligence's Private Scanning (via VirusTotal Private Scanning/Private Analysis) lets you detonate and analyze the sample in an isolated, non-shared environment. You get sandbox behavior, IOCs, and detection engine results without the sample or its hash being shared with the broader community

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Ingesting On-Prem NAS Logs into Google SecOps Without IP Aliasing

S-grade

Which Log Source Completes principal.user.userid Matching?

S-grade

Reducing Secops Alert Noise with High-Value Asset Context

S-grade

Handling Vendor Parser Field Changes in Google SecOps

S-grade

← Back to PSOE Study Guide