To analyze a malware sample efficiently for IOCs without alerting the threat group, which Threat Intelligence action should you take?

• A. Search for the threat group in Google Threat Intelligence
• B. Upload the malware to Google Threat Intelligence by using VirusTotal
• C. Upload the malware to Google Threat Intelligence by using Private Scanning
• D. Calculate the file checksum for the malware, and search for the checksum in Google Threat Intelligence by using VirusTotal

Answer: (C)

Keeping the malware analysis private is the key idea here. Private Scanning in Google Threat Intelligence lets you submit the sample to VirusTotal in a private channel, so the file isn’t exposed to the public database or threat actors while the analysis runs. The results—IOCs, file behavior, and other artifacts—come back to you privately, enabling efficient triage and rapid IOC extraction without tipping off the threat group.

Other options don’t fit as well. Looking up the threat actor in Threat Intelligence might provide context, but it won’t generate the IOCs from your specific sample. Uploading for public scanning would share the sample and its results with many parties, increasing the chance of alerting the attacker. Calculating a hash and searching for it only reveals known matches and doesn’t perform the deeper analysis needed to derive new IOCs from the current sample.