Benign Download

01/b7/01b754177650694c7a8fd11c56a88e9caadb9cfe85519a9ce925b618e9d4db22

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-25601b754177650694c7a8fd11c56a88e9caadb9cfe85519a9ce925b618e9d4db22
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–24
1defaults:
2 platforms: [openbsd, bsd, unix]
3 for: [javascript]
4 attack: T1041
5
6traits:
7 - id: node-process-snapshot
8 desc: Node creates process snapshot
9 crit: suspicious
10 conf: 0.88
11 if:
12 type: text
13 substr: /tmp/.ps_snapshot.json
14
15composite_rules:
⋯9 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.