Benign Download

Dockerfile

GitHub releases download URLcurl or wget fetches an HTTP URL

SHA-2560c97965fef0a644f4ee059bbf5fc9a964893b18b34875d5c7df8a9e986d27a23

Evidence

rm -rf shell command lines 14–16

  binutils \
  ca-certificates \
  && rm -rf /var/lib/apt/lists/*

curl command lines 18–20

18# Install Rust via rustup
19RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
20ENV PATH="/root/.cargo/bin:${PATH}"

curl or wget fetches an HTTP URL lines 62–66

62# Download and install Ghidra 12 (includes PyGhidra)
63WORKDIR /opt
64RUN wget -q https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_12.0_build/ghidra_12.0_PUBLIC_20251205.zip \
65    && unzip -q ghidra_12.0_PUBLIC_20251205.zip \
66    && mv ghidra_12.0_PUBLIC ghidra \