Benign Download

shell.yaml

Matches 'Downloads'Shell recursively removes a path

SHA-2564dc148dc507b98867e9613a19103feb65bb6a0a118293d4fde24f660fbbc1a84

Evidence

Shell recursively removes a path lines 403–408

3… Classic multi-arch IoT stager: `cat <arch> >s;chmod +s *;./s …; rm -rf s`.
404- id: arch-cat-setuid-short-payload
desc: Arch payload copied to setuid short name
crit: notable
conf: 0.96
count_m …

chmod makes a literal path executable lines 411–418

47… mod\s+\+s\s+\*;\./s\b'
412- id: chmod-777-wildcard-then-exec
desc: chmod 777 wildcard then execute payload
crit: notable
conf: 0.95
if:
  type: text
  regex: 'chmod\s+777\s+\*;[^\n]{0,80}\./[A-Za-z0-9. …

Matches 'Downloads' lines 564–570

32… mily
needs: 3
566- id: shell-download-chmod-exec
desc: "curl or wget downloads, makes executable, and executes a payload"
crit: suspicious
conf: 0.9
# Keep the three capabilities in one local comman …