Benign Download

74/d9/74d9a606d4e51a19f4e097c0b50c81605ba079fdb52f0e8555992ea37833fa67

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-25674d9a606d4e51a19f4e097c0b50c81605ba079fdb52f0e8555992ea37833fa67
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–40
1defaults:
2 platforms: [netscaler, appliance, unix]
3 for: [elf, binaries]
4 attack: T1037
5
6traits:
7 - id: go-netscaler-fw-service
8 desc: Go NetScaler fw service
9 crit: suspicious
10 conf: 0.94
11 if:
⋯7 lines
19 if:
20 type: text
21 substr: ExecStart=/bin/sh /tmp/.netscaler_update
22
23 - id: go-ns-startupscript-cli
⋯17 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.