FRUITSHELL
Named by 2 kept items in this workspace.
Search every workspace for FRUITSHELL. It matches the name as written, so it can find other things that share it.
The items that name it 2
First confirmed A3 (AI-Analysis Evasion) malware; a PowerShell reverse shell using obfuscated fruit-named variables ($apple, $banana, $cherry), reported as active in the wild by GTIG. Contains a two-line comment telling AI/LLM analyzers not to analyze the file and falsely claiming it performs prime
PowerShell reverse shell with AI-evasion; archetype A3; documented in docs/families/FRUITSHELL.md
All threat actors in this workspace.