Benign Download

a7/04/a7040fbf9c838e3d6cde2e1b7ce7698a9df964c37414b1a20196987e07bc1b8d

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-256a7040fbf9c838e3d6cde2e1b7ce7698a9df964c37414b1a20196987e07bc1b8d
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 8–23
8:23… text]
9 attack: T1195.002
10 size_min: 8
11 size_max: 500000000
12
13traits:
14 - id: litellm-exfil-domain
15 desc: TeamPCP LiteLLM credential exfiltration domain
16 crit: notable
17 conf: 0.99
18 if:
⋯5 lines
Hidden path prefix in /tmp lines 44–62
⋯9 lines
53
54 - id: pg-state-path
55 desc: TeamPCP /tmp/.pg_state download state path
56 crit: notable
57 conf: 0.97
⋯5 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.