Benign Download

5e/f4/5ef40b996f9c1819b4eaf26d33e7ac4707620d7430cb2787fccf71280d7c531f

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-2565ef40b996f9c1819b4eaf26d33e7ac4707620d7430cb2787fccf71280d7c531f
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 24–33
⋯5 lines
29 mbc: B0024
30
31traits:
32 # AmnesiaStealer / Atomic-style loaders hide the Mach-O under a Developer
33 # Tools-looking name in /tmp. The numeric suffix …
Trait criticality field lines 34–42
34:9… tmp-apple-devtools-masquerade-path
35 desc: Hides payload under /tmp/.com.apple.dt name
36 crit: suspicious
37 conf: 0.96
38 attack: T1036.005
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.