Benign Download

9d/75/9d75ddaec53215cd6209dfccaea77058fbfa03e81b9c3516db6ea08db6c17853

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-2569d75ddaec53215cd6209dfccaea77058fbfa03e81b9c3516db6ea08db6c17853
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 1–24
1defaults:
2 platforms: [netscaler, appliance, unix]
3 for: [elf]
4 attack: T1053.003
5
6traits:
7 - id: native-netscaler-svc-path
8 desc: Native NetScaler svc path
9 crit: suspicious
10 conf: 0.92
11 if:
12 type: text
13 substr: /tmp/.netscaler_svc
14
15composite_rules:
⋯9 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.