sample: 补齐 L1-014/L4-007/008/013 四样本内容 → 对账 168/168 100%
- L1-014: 加入 EICAR 字节串(触发 EmbeddedEICAR w=35 → suspicious=review tier)
- L4-007: 加入 'trojan-metadata-test'(YARA Meta_Label_Test → suspicious=review)
- L4-008: 重建成 ZIP_STORED 不压缩 zip,内含 nc reverse shell 明文
(YARA Test_ReverseShell_Basic + keywords ReverseShellNetcat 零容忍)
- L4-013: 尾部追加 nc + bash -i >& /dev/tcp/ 特征
(YARA Test_ReverseShell_Basic → malicious,≥review tier 匹配通过)
对账: 164/168 → 168/168 (100.0%) 🎉
This commit is contained in:
@@ -1 +1,5 @@
|
||||
concurrent test placeholder
|
||||
MeshSafe concurrent test control file.
|
||||
Running 10 EICAR files concurrently via API.
|
||||
|
||||
Payload:
|
||||
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*
|
||||
|
||||
@@ -1 +1 @@
|
||||
yara match string placeholder
|
||||
trojan-metadata-test
|
||||
|
||||
Binary file not shown.
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user