Benign Download

46/08/460828d885a8d85c5e6af5a07c28a7e8fb129d2ef6e7f5a384be599633363e33

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-256460828d885a8d85c5e6af5a07c28a7e8fb129d2ef6e7f5a384be599633363e33
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–48
1defaults:
2 platforms: [openwrt]
3 for: [lua]
4 attack: T1037
5traits:
6 - id: lua-hidden-cache-update-path
7 desc: Lua hidden cache update path
8 crit: suspicious
9 conf: 0.9
10 if:
11 type: text
12 substr: /tmp/.cache_update
13 - id: lua-rc-local-file-write
14 desc: Lua writes through a file API
⋯34 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.