Add new Quark rule for Exodus malware detection

[pulorsok]

Three Exodus samples — MITRE S0405 — joined the malware corpus. This adds one new rule and resyncs the retrained weights.

New rule #00279 — TelephonyManager.getDeviceId + TelephonyManager.getSubscriberId, "Collect device IMEI and subscriber IMSI identifiers".

• Trained score +0.86
• Fires at level 5 in 126 of 718 malware samples and 0 of 190 benign samples; benign hits never exceed level 2
• No existing rule pairs these two APIs
• In all three Exodus samples it fires in Llib/operatore/core/b;c, the method that registers the device with the operator's server

The rule the pruning step auto-selected (Base64.decode + KeyFactory.generatePublic) trained to -1.63 and was discarded; #00279 was chosen from the pruned candidates on its malware-to-benign separation.

Score resync — 266 existing rules changed score. No rule content changed; the diff on existing files touches only the score field.

The accompanying analysis report is submitted separately to quark-engine.

🤖 Generated with Claude Code