Benign Download

arm64-img/2026-09-15-raspios-trixie-arm64.img/2026-09-15-raspios-trixie-arm64.img.d/1.img.d/usr/bin

Reads the D-Bus session bus addressShell command invokes sudo
SHA-256d1e9691f391009987c2a4dcf1821621c424c2098f0e8a409f49f1a14899c1613
MaleculeH₂(CmOs)

Evidence

Invokes a D-Bus command-line client lines 1–4
1#!/bin/sh
2
3if [ ! -z $SUDO_UID ] ; then
4 sudo -u "#$SUDO_UID" DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/$SUDO_UID/bus dbus-send --session --dest=com.raspberrypi.wfpanelpi --type=method_call /com/raspberrypi/wfpanelpi com.raspberrypi.wfpanelpi.command strin …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.