Benign Download

80/fd/80fdf82301160ca62bf046c0852d107b22314afffff8691fbf324da82fc6ee36

Hidden path prefix in /tmpTop-level traits or composite_rules key

SHA-25680fdf82301160ca62bf046c0852d107b22314afffff8691fbf324da82fc6ee36

Evidence

Top-level traits or composite_rules key lines 2–8

2:28… 
3  for: [elf, macho, go, shell, python, javascript, typescript]
4traits:
5# A hardcoded hidden dotfile under /tmp is a stealth artifact: malware stashes
6# run-once/state markers (e.g. `/tmp/.base58_detection_sent`, checked to avoid
7# re-exfiltrating) and small payloads there so casual `ls /tmp` misses them.
8# Kept nota …

Trait criticality field lines 10–17

4… d: hidden-tmp-state-file
desc: Hidden dotfile stashed in /tmp
crit: notable
conf: 0.8
for: [elf, macho, go, shell, python, javascript, typescript, swift]
if:
  type: text
  regex: '(^|[^A-Za-z0 …

Hidden path prefix in /tmp lines 24–34

70…  stashed
  # state files; keep literal hidden dotfiles such as /tmp/.foo_sent covered.
  - regex: '/tmp/\.[A-Za-z0-9][A-Za-z0-9._-]{1,64}\.X{3,}'
  - regex: '/tmp/\.[A-Za-z0-9][A-Za-z0-9._-]{1,64}\$\$'
  - substr: '.curl'
  - substr: '/tmp/.gocache'
  - substr: '/tmp/.noeta-tavily-'
  - substr: '/tmp/.homebrew_pkg_user'
unless:
  - id: metadata/lang/upstream::linux-kernel-primary-tree-path
  - id: metadata/file/extension/i …