This is not "shutting down" rsyslog. The kill command sends a SIGHUP to rsyslog, which causes it to reopen its log files - what you are seeing is a normal logrotation, not an attempt to terminate the process.

I suspect virustotal did the check in a container with a logrotation job still running, and it happened to run right in the moment when yt-dlp was being tested.

You mean this `systemctl kill -s HUP rsyslog.service` ? This just tells syslog to reload itself

Why would yt-dlp tell syslog to reload?

It seems VirusTotal spins up a virtual machine/container to run the program, and monitors what happens inside that environment. And it further seems that during that time syslog (or something else, probably the distribution) reloaded itself. And some other process tried to connect to the TOR IPs.

And since we're all amateurs here who don't understand what VirusTotal is doing, some of us think "ZOMG yt-dlp compromised?!?".

If you look at the process tree, the process that reloaded rsyslog wasn't spawned from the yt-dlp_linux process.

I don't see anything trying to delete syslogs. There's a line for reloading new configuration (kill -HUP ...) - is that what you meant?