Benign Download

6e/c3/6ec3a55d9e93d922923813de1bfe9901e4d4c69940fb7209e6f29ad7e8ac7977

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-2566ec3a55d9e93d922923813de1bfe9901e4d4c69940fb7209e6f29ad7e8ac7977
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 3–15
3:14… ts, binaries, go, java, kotlin, csharp, swift]
4 attack: T1055
5
6traits:
7 - id: netscaler-proc-environ-ldpreload
8 desc: NetScaler proc environ LD_PRELOAD
9 crit: suspicious
10 conf: 0.98
11 if:
⋯4 lines
Hidden path prefix in /tmp lines 18–27
18 conf: 0.96
19 if:
20 type: text
21 substr: LD_PRELOAD=/tmp/.malicious.so
22
23 - id: netscaler-proc-mem-pid-path
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.