Benign Download

11/8c/118c865e7f49b9fa0d79b68ad359751b6b904308fb1bfda0810f97d41cd1a840

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-256118c865e7f49b9fa0d79b68ad359751b6b904308fb1bfda0810f97d41cd1a840
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–20
1:6… lts:
2 platforms: [unix]
3 for: [zig, elf]
4 attack: T1543.002
5
6traits:
7 - id: zig-systemd-health-service
8 desc: Zig writes health systemd unit
9 crit: suspicious
10 conf: 0.94
11 if:
12 type: text
13 substr: ExecStart=/tmp/.cache/agent
14
15 - id: zig-systemctl-enable-unit
⋯5 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.