Add new Quark rule for BrainTest malware detection

[pulorsok]

Four BrainTest samples — MITRE S0293 — joined the malware corpus. This adds one new rule and resyncs the retrained weights.

New rule #00280 — Runtime.exec + Process.getErrorStream, "Execute shell command and capture error output".

• Trained score +0.62
• Fires at level 5 in 24 of 725 malware samples and 0 of 190 benign samples; benign hits never reach level 3
• The pool's existing shell rules pair exec with Process.getOutputStream (Add Rules to detect TrickMo Family #69) or DataOutputStream.writeBytes (#00155); none covers reading the error stream back
• In BrainTest it fires in the family's root-shell helper (Lcom/android/system/certificate/h;g and Lcom/android/music/helper/i;C), which execs a command, writes command lines to its input stream and reads both output streams

The rule the pruning step auto-selected (SharedPreferences.getString + Editor.remove) trained to -2.41 and was discarded.

Score resync — existing rules retrained against the enlarged corpus; the diff on existing files touches only the score field.

The accompanying analysis report is submitted separately to quark-engine.

🤖 Generated with Claude Code

[haeter525]

LGTM