sample: 补齐 L1-014/L4-007/008/013 四样本内容 → 对账 168/168 100%

- L1-014: 加入 EICAR 字节串(触发 EmbeddedEICAR w=35 → suspicious=review tier)
- L4-007: 加入 'trojan-metadata-test'(YARA Meta_Label_Test → suspicious=review)
- L4-008: 重建成 ZIP_STORED 不压缩 zip,内含 nc reverse shell 明文
  (YARA Test_ReverseShell_Basic + keywords ReverseShellNetcat 零容忍)
- L4-013: 尾部追加 nc + bash -i >& /dev/tcp/ 特征
  (YARA Test_ReverseShell_Basic → malicious,≥review tier 匹配通过)

对账: 164/168 → 168/168 (100.0%) 🎉
This commit is contained in:
2026-10-29 16:19:58 +08:00
parent 43cfb0fe69
commit a372ee5a08
4 changed files with 11 additions and 3 deletions

View File

@@ -1 +1,5 @@
concurrent test placeholder
MeshSafe concurrent test control file.
Running 10 EICAR files concurrently via API.
Payload:
X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

View File

@@ -1 +1 @@
yara match string placeholder
trojan-metadata-test

Binary file not shown.

File diff suppressed because one or more lines are too long