Benign Download

passworded-archive-gatekeeper.yaml

Hidden path prefix in /tmpComposite catalog lists alternative rules
SHA-256a7673fe30ba047080a9312fd13a477e80c55eb5c094c6ac79b646bacbbab2a13
MaleculeH(F)Md

Evidence

Top-level traits or composite_rules key lines 24–33
⋯5 lines
29 mbc: B0024
30
31traits:
32 # AmnesiaStealer / Atomic-style loaders hide the Mach-O under a Developer
33 # Tools-looking name in /tmp. The numeric suffix …
Trait criticality field lines 34–42
34:9… tmp-apple-devtools-masquerade-path
35 desc: Hides payload under /tmp/.com.apple.dt name
36 crit: suspicious
37 conf: 0.96
38 attack: T1036.005
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.