{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.99922776222229, "class": 2 }, { "id": 1, "prob": 0.99922776222229, "class": 2 } ], "prob": 0.99922776, "class": 2, "models": [ { "m": "az", "prob": 0.9813781, "class": 0 }, { "m": "az/archive", "prob": 0.99021214, "class": 0 }, { "m": "az/zip", "prob": 0.8682698, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9953178, 0.9991311 ], "analyzed_at": "2026-05-02T19:13:39Z" }, "path": "55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea.zip", "raw": { "v": "4", "fs": [ { "f": "O₈(Al₄C₃I₃As₄Er₂Dy₂LaP)H₇(Os₄Cm₂Cr₈Db₆F₄Po₁₀Hf)Md₂(Bi₄He)", "x": 206, "id": 0, "ss": [ [ 1047004, "zPI68Fl6eocJ+XLcPN9dvG3o/SV04F2zE7nWUhBbwsBHiX8bIquqVyVV+Y93FOCn" ], [ 1047069, "eJODySiy+bLZ1QfXKMjoNbhHq+aeuYCV8na3LF3hoGpST6uJpXUxbhZOBqHHbbx6" ], [ 1047134, "vVy1fXOUEvaEOhqkglfDUQ7/fH6sT1p/3RyCtGi3o7588oMHOVgz3jZux2dqp9Zy" ], [ 1047199, "Ps9MqZs0OtcBAXTG4EmD8yz2RgH+D9j756snWNZeknnjNO+KUARDSICKFOYtb3wz" ], [ 1047264, "xYFVvACB3sJuTpAJ2HuaWIEo8NljGsMkNTqy3tFY0WnUBxAgt7AMUM+Ex75DGa9H" ], [ 1047329, "IAXd+bTOfo+zyUGKiUFBqBZjo8T0ueTpr8BZb98fl5/LFpXmBuR/dJBfeuq3a4vK" ], [ 1047394, "Fpxx796zUe/hoiBSvw9GzLyYa5A5Lbcz2qOi9RTYTEmZDX9qss+GfI54ZM2vrxyC" ], [ 1047459, "nUJz/dDxxjFOujMJJBN9b1G9KIgiD3Sh41RLfEEemOG4Fo+1TbegKcK11a3LvUfL" ], [ 1047524, "g3PhwflhaZwuwz3Nrie9vS9NKM+935rCkjeP1tap8NvrKow4F0KPg0loES06/fjm" ], [ 1047589, "47PI12ZrUc6YE5zH3CwtiCXW4BUlpPacZgUJRpvZAODHYlejTnxtiWvq4XLe1A+3" ] ], "sz": 1155404, "ts": [ { "a": "T1011", "c": 0.699999988079071, "d": "Raw socket terminology", "e": [ "RAW_SOCKET" ], "i": "micro-behaviors/communications/socket/raw::raw-socket-ref", "l": 1, "m": "C0001" }, { "c": 0.8999999761581421, "d": "OpenSSL ChaCha20-Poly1305", "e": [ "ChaCha20-Poly1305" ], "i": "objectives/command-and-control/backdoor/binary/stealth::openssl-chacha-poly", "l": 3, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Executes shell command and captures", "e": [ "fgets", "popen" ], "i": "micro-behaviors/process/create/shell::capture-command-output", "l": 1 }, { "a": "T1082", "c": 0.699999988079071, "d": "Access CPU info via /sys/devices", "e": [ "/sys/devices/system/cpu" ], "i": "micro-behaviors/os/sysinfo/cpu::sys-devices", "l": 3 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v2 onion address (deprecated)", "e": [ "tfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v2", "l": 3, "m": "C0026" }, { "c": 0.6000000238418579, "d": "RSA_public_encrypt reference", "e": [ "RSA_public_encrypt" ], "i": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-encrypt", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 3227364.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.75, "d": "HKDF key derivation", "e": [ "HKDF" ], "i": "micro-behaviors/crypto/kdf::hkdf", "l": 2 }, { "c": 0.20000000298023224, "d": "Format time as string", "e": [ "strftime", "sym.strftime" ], "i": "micro-behaviors/time/query::strftime", "l": 2 }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt", "ENCRYPT", "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "c": 0.30000001192092896, "d": "Sleep for specified duration", "e": [ "sleep" ], "i": "micro-behaviors/time/query::sleep-func", "l": 2 }, { "c": 0.4000000059604645, "d": "Password hash or data", "e": [ "password_hash" ], "i": "objectives/evasion/kernel-hide/ebpf::password-string-direct-b", "l": 3 }, { "c": 0.6600000262260437, "d": "Get CPU info from /proc/cpuinfo", "e": [ "Failed to open '/proc/cpuinfo'", "/proc/cpuinfo" ], "i": "micro-behaviors/fs/proc/system::system-cpuinfo", "l": 3 }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool SIGUSR1 handler error message", "e": [ "thread_do(): cannot handle SIGUSR1" ], "i": "objectives/impact/ransom/esxi::thpool-sigusr", "l": 1, "m": "C0027" }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "prctl system call symbol", "e": [ "prctl" ], "i": "objectives/evasion/masquerade/identity::prctl-symbol", "l": 3, "m": "F0004" }, { "a": "T1497.003", "d": "Timing measurement with delays (sandbox/VM", "e": [ "gettimeofday", "sleep", "nanosleep", "usleep" ], "i": "objectives/anti-analysis/timing/evasion::timing-evasion", "l": 3, "m": "B0003.005" }, { "a": "T1069", "c": 0.699999988079071, "d": "User/group ID gathering", "e": [ "getgid", "getegid", "geteuid" ], "i": "objectives/discovery/host/permissions::uid-gid-gathering", "l": 1 }, { "c": 0.20000000298023224, "d": "localtime function (symbol)", "e": [ "time_localtime_tzi", "localtime_r", "localtime", "GI_localtime", "GI_localtime_r", "sym.localtime", "sym.localtime_r", "sym.__time_localtime_tzi" ], "i": "micro-behaviors/time/query::localtime-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": ".onion domain reference", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/infrastructure/domain::onion-domain", "l": 3, "m": "C0002" }, { "c": 0.699999988079071, "d": "PEM begin marker", "e": [ "-----BEGIN PUBLIC KEY-----", "-----BEGIN" ], "i": "micro-behaviors/crypto/certificate::pem-begin", "l": 2 }, { "d": "pthread threading library", "e": [ "pthread_create", "sym.pthread_create" ], "i": "micro-behaviors/process/threading::pthread", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 1.0, "d": "Binary has 1000+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-1000", "l": 1 }, { "c": 0.8500000238418579, "d": "vim-cmd vmsvc command", "e": [ "vim-cmd vmsvc" ], "i": "objectives/impact/ransom/esxi::vim-cmd-vmsvc", "l": 1 }, { "a": "T1059", "c": 0.75, "d": "Get terminal attributes", "e": [ "GI_tcgetattr", "tcgetattr", "sym.__GI_tcgetattr" ], "i": "micro-behaviors/process/tty/pty::tcgetattr", "l": 3 }, { "c": 0.20000000298023224, "d": "Convert time to UTC time", "e": [ "OPENSSL_gmtime_adj", "gmtime", "X509_gmtime_adj", "OPENSSL_gmtime", "OPENSSL_gmtime_diff", "sym.X509_gmtime_adj", "sym.OPENSSL_gmtime", "sym.OPENSSL_gmtime_adj", "sym.OPENSSL_gmtime_diff", "sym.gmtime" ], "i": "micro-behaviors/time/query::gmtime", "l": 2 }, { "c": 0.6000000238418579, "d": "RSA_public_decrypt reference", "e": [ "RSA_public_decrypt" ], "i": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-decrypt", "l": 3 }, { "a": "T1106", "c": 0.8999999761581421, "d": "execve system call symbol", "e": [ "execve" ], "i": "micro-behaviors/process/create/direct::execve-symbol", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 3227364.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "a": "T1497.001", "d": "VirtualBox string detection", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/emulator-detect::virtualbox-word", "l": 1, "m": "B0009" }, { "a": "T1562", "c": 0.6000000238418579, "d": "Send signal to process", "e": [ "kill" ], "i": "micro-behaviors/process/terminate/signal::kill", "l": 3, "m": "E1562" }, { "c": 0.75, "d": "PBKDF2 key derivation", "e": [ "PBKDF2", "PKCS5_v2_PBKDF2_keyivgen", "pbkdf2 error", "PKCS5_pbkdf2_set", "PBKDF2PARAM", "PBKDF2PARAM_free", "PBKDF2PARAM_it", "PBKDF2PARAM_new", "PBKDF2PARAM_st", "d2i_PBKDF2PARAM", "PBKDF2PARAM_seq_tt", "i2d_PBKDF2PARAM", "PKCS5_PBKDF2_HMAC", "PKCS5_PBKDF2_HMAC_SHA1" ], "i": "micro-behaviors/crypto/kdf::pbkdf2", "l": 3 }, { "c": 0.949999988079071, "d": "FreeBSD string marker", "e": [ "FreeBSD" ], "i": "metadata/binary/section/content::freebsd-marker", "l": 1 }, { "d": "certificate string reference", "e": [ "certificate", "Certificate", "Certificate", "Certificate", "certificate", "Certificate", "Certificate", "Certificate", "Certificate", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "Certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate::certificate-ref", "l": 2 }, { "c": 0.8500000238418579, "d": "Creates eagerzeroedthick disk", "e": [ "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk; vmkfstools …", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk \u003e /dev/null;…" ], "i": "objectives/impact/ransom/esxi::eagerzeroedthick-disk", "l": 3 }, { "c": 0.6600000262260437, "d": "Uses readdir64", "e": [ "readdir64" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "l": 2 }, { "c": 1.0, "d": "/dev/null (legitimate discard device)", "e": [ "/dev/null", "vim-cmd vmsvc/snapshot.removeall %llu \u003e /dev/null 2\u003e\u00261", "…eroedthick $I/eztDisk \u003e /dev/null; vmkfstools -U $I/eztDi…", "…fstools -U $I/eztDisk \u003e /dev/null; done" ], "i": "micro-behaviors/fs/path/device::dev-null", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files (64-bit)", "e": [ "fopen64" ], "i": "micro-behaviors/fs/file/open::fopen64", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses getdents64", "e": [ "getdents64" ], "i": "micro-behaviors/fs/directory/readdir::readdir-getdents64", "l": 2 }, { "c": 0.6600000262260437, "d": "Wait for child process state", "e": [ "waitpid" ], "i": "micro-behaviors/process/control/wait::waitpid", "l": 2 }, { "d": "Detect if running in terminal (isatty)", "e": [ "isatty", "GI_isatty", "sym.isatty" ], "i": "micro-behaviors/process/tty/terminal::isatty", "l": 2 }, { "c": 0.8500000238418579, "d": "Reference to ESXi VM process list command", "e": [ "esxcli vm process list" ], "i": "micro-behaviors/os/sysinfo/vmware::esxcli-vm-list", "l": 3 }, { "c": 0.6600000262260437, "d": "Open files (legacy 64-bit)", "e": [ "open64" ], "i": "micro-behaviors/fs/file/open::open64", "l": 2 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "sym.__GI_fseeko64", "sym.fseeko", "fseeko64", "fwrite", "write", "fseek", "GI_fseek", "GI_fseeko64", "fseeko" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "a": "T1106", "c": 0.8999999761581421, "d": "Direct execve program execution", "e": [ "execve" ], "i": "micro-behaviors/process/create/direct::execve-import", "l": 3 }, { "c": 0.8999999761581421, "d": "Reference to ESXi VM World ID", "e": [ "World ID:" ], "i": "micro-behaviors/os/sysinfo/vmware::vm-world-id", "l": 3 }, { "a": "T1573", "c": 0.8799999952316284, "d": "X25519 key exchange marker", "e": [ "X25519" ], "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "l": 3, "m": "C0027" }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 200.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 1.0, "d": "Lock memory pages (mlock)", "e": [ "mlock" ], "i": "micro-behaviors/mem/lock/pages::mlock", "l": 2 }, { "c": 1.0, "d": "setsid() function import", "e": [ "setsid" ], "i": "micro-behaviors/process/create/setsid::import", "l": 1, "m": "F0003" }, { "c": 0.699999988079071, "d": "Short -h help flag", "e": [ "-h," ], "i": "metadata/package/help::usage-help", "l": 2 }, { "c": 0.800000011920929, "d": "RAND_bytes function", "e": [ "RAND_bytes" ], "i": "micro-behaviors/os/random::rand-bytes", "l": 2 }, { "c": 1.0, "d": "ARM direct write(2) syscall", "e": [ "04 70 a0 e3 00 00 00 ef" ], "i": "micro-behaviors/os/syscall/invoke::svc-write", "l": 3 }, { "d": "Truncate file", "e": [ "ftruncate64" ], "i": "micro-behaviors/fs/file/truncate::truncate", "l": 2 }, { "c": 0.8999999761581421, "d": "ESXi CLI tool", "e": [ "esxcli vm process kill -t force -w %llu", "for I in $(esxcli storage filesystem list…", "esxcli vm process list" ], "i": "objectives/impact/ransom/esxi::esxcli-tool", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.08" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "a": "T1046", "c": 0.8600000143051147, "d": "Connection scan status strings", "e": [ "Connection timed out", "Connection refused" ], "i": "objectives/discovery/network/scan/port::connection-status-messages", "l": 1, "m": "E1046" }, { "c": 0.8999999761581421, "d": "influxdb string", "e": [ "influxdb" ], "i": "micro-behaviors/data/db/conn/influxdb::influxdb-string", "l": 3 }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "c": 0.6000000238418579, "d": "/boot directory reference", "e": [ "/boot/" ], "i": "micro-behaviors/fs/path/system::boot-dir", "l": 2 }, { "c": 1.0, "d": "ELF32 class marker", "e": [ "elf.class_bits = 32.00" ], "i": "objectives/anti-static/pack/detection::elf32-class", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "thread-pool", "threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/handle::fcntl", "l": 2, "m": "E1083" }, { "c": 0.8500000238418579, "d": "vmsvc/snapshot command", "e": [ "vmsvc/snapshot" ], "i": "objectives/impact/ransom/esxi::vmsvc-snapshot", "l": 1 }, { "a": "T1083", "c": 0.4000000059604645, "d": "Reference to /lib/ directory", "e": [ "/lib64/" ], "i": "micro-behaviors/fs/path/library::lib-path", "l": 2, "m": "E1083" }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool job add OOM error message", "e": [ "thpool_add_work(): Could not allocate memory for new job" ], "i": "objectives/impact/ransom/esxi::thpool-job-oom", "l": 1, "m": "C0027" }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 0.800000011920929, "d": "esxcfg- tool prefix", "e": [ "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval" ], "i": "objectives/impact/ransom/esxi::esxcfg-prefix", "l": 1 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.function_count = 4806.00", "binary.string_count = 12400.00", "Usage:\n\t%s OPTION ...\n\nOPTIONS…" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x100614" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords::pipe", "l": 1 }, { "c": 0.75, "d": "EVP_PKEY_derive function", "e": [ "EVP_PKEY_derive_init", "EVP_PKEY_derive_set_peer", "EVP_PKEY_derive" ], "i": "micro-behaviors/crypto/kdf::evp-pkey-derive", "l": 2 }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 1.0, "d": "/dev/tty terminal device", "e": [ "/dev/tty" ], "i": "micro-behaviors/fs/path/device/terminal::dev-tty", "l": 2 }, { "c": 0.75, "d": "Large base64-like string (512+ chars)", "e": [ "f////0002/////00//////////////////00000/////00//////////////////00000/////00//////////////////00000/////00//////////////////0000" ], "i": "objectives/anti-static/obfuscation/payload::large-base64-string-dup", "l": 3 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "UI_get0_output_string", "asn1_output_data", "Failed to open log file '%s' (%d: %s). Falling back to console output", "output would overflow", "Input/output error" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "ZLIB", "zlib" ], "i": "micro-behaviors/dylib/library::zlib-ref", "l": 2 }, { "d": "overflow keyword", "e": [ "random pool overflow", "output would overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "GI_fseeko64", "GI_fseek", "fseeko64", "fseek", "sym.fseeko", "sym.__GI_fseeko64" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.949999988079071, "d": "OpenSSL EVP API symbols", "e": [ "EVP_EncryptInit" ], "i": "well-known/lib/openssl::openssl-evp-api", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.800000011920929, "d": "Password command-line argument", "e": [ "--password", "--password" ], "i": "micro-behaviors/process/argument/credential::password-required-flag", "l": 1 }, { "c": 0.75, "d": "PKCS5_PBKDF2_HMAC function", "e": [ "PKCS5_PBKDF2_HMAC", "PKCS5_PBKDF2_HMAC_SHA1" ], "i": "micro-behaviors/crypto/kdf::pkcs5-pbkdf2", "l": 2 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "elf.class_bits = 32.00", "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 }, { "c": 1.0, "d": ".onion address pattern", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/impact/ransom/encrypt::onion-address", "l": 1 }, { "c": 0.75, "d": "scrypt key derivation", "e": [ "scrypt", "scrypt", "scrypt" ], "i": "micro-behaviors/crypto/kdf::scrypt", "l": 2 }, { "c": 0.6600000262260437, "d": "Process forking", "e": [ "fork", "GI_fork", "clone", "vfork", "GI_vfork", "sym.__clone" ], "i": "micro-behaviors/process/fork/clone::fork", "l": 2 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.6600000262260437, "d": "Parse IP with inet_pton", "e": [ "inet_pton" ], "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "VMware vim-cmd tool", "e": [ "vim-cmd" ], "i": "objectives/impact/ransom/esxi::vim-cmd-tool", "l": 3 }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "Token", "Token", "token", "token" ], "i": "micro-behaviors/data/text/keywords::token", "l": 1 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "VM detection via vendor/product strings", "e": [ "virtualbox", "qemu" ], "i": "objectives/anti-analysis/emulator-detect/heuristics::detect-vendors", "l": 4, "m": "B0009" }, { "c": 0.6600000262260437, "d": "Rename files", "e": [ "rename" ], "i": "micro-behaviors/fs/file/rename::rename-base", "l": 2 }, { "c": 0.8999999761581421, "d": "OpenSSL EVP encryption functions", "e": [ "EVP_CipherInit_ex", "EVP_EncryptInit_ex", "AES_cbc_encrypt", "AES_set_encrypt_key", "AES_set_encrypt_key" ], "i": "micro-behaviors/crypto/library::openssl-evp-encrypt", "l": 3 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v3 onion address", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v3", "l": 4, "m": "C0026" }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "hexsecret", "secretary", "secret", "secretBag", "missing secret" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "a": "T1497.001", "d": "qemu lowercase string", "e": [ "qemu" ], "i": "objectives/anti-analysis/emulator-detect::qemu-lower", "l": 3, "m": "B0009" }, { "c": 1.0, "d": "torproject.org domain", "e": [ "1) Download tor browser: https://www.torproject.org/download/" ], "i": "objectives/impact/ransom/encrypt::torproject-domain", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 29.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "a": "T1059.004", "c": 0.6499999761581421, "d": "References /bin/sh in binary", "e": [ "/bin/sh" ], "i": "micro-behaviors/process/create/shell/encoded::bin-sh-binary-text", "l": 3, "m": "E1059.004" }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2 }, { "c": 0.8999999761581421, "d": "Firmware platform marker", "e": [ "LEDE" ], "i": "micro-behaviors/hardware/flash/device::firmware-platform-marker", "l": 1 }, { "c": 0.800000011920929, "d": "CRYPTOGAMS OpenSSL support marker", "e": [ "GHASH for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "GHASH for ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA256 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA512 block transform for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "AES for ARMv4, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "Bit-sliced AES for NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], "i": "micro-behaviors/crypto/library::cryptogams-marker", "l": 2 }, { "d": "password keyword", "e": [ "id-PasswordBasedMAC", "userPassword", "problems getting password", "… for files search\n\t --password \u003cstring\u003e Password for…", "Password: %s", "PKCS8 decrypt password", "password based MAC", "password_hash", "No password specified!", "PKCS12 import password", "opt_password", "challengePassword", "Password is not correct!", "--password \u003cstring\u003e Password for startup", "password", "pem_password_cb" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 3227364.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.30000001192092896, "d": "libcrypto library reference", "e": [ "common libcrypto routines" ], "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1082", "c": 0.4000000059604645, "d": "Query system configuration information", "e": [ "GI_sysconf", "sysconf", "sym.__GI_sysconf" ], "i": "micro-behaviors/os/sysinfo/config::sysconf", "l": 2, "m": "E1082" }, { "c": 0.6000000238418579, "d": "Examine or change blocked signals", "e": [ "sigprocmask" ], "i": "micro-behaviors/process/terminate/signal::sigprocmask", "l": 2 }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "Password is not" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "c": 0.8999999761581421, "d": "snapshot.removeall command", "e": [ "snapshot.removeall" ], "i": "objectives/impact/ransom/esxi::snapshot-removeall", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.9399999976158142, "d": "AES-256-CTR cipher marker", "e": [ "AES-256-CTR", "aes-256-ctr" ], "i": "micro-behaviors/crypto/symmetric/aes/ctr::aes-256-ctr-term", "l": 3, "m": "C0021.001" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "c": 0.8999999761581421, "d": "vm process kill command", "e": [ "esxcli vm process kill -t force -w %llu" ], "i": "objectives/impact/ransom/esxi::vm-process-kill", "l": 1 }, { "c": 0.9300000071525574, "d": "ESXi storage pre-encryption prep", "e": [ "vmkfstools", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk; vmkfstools …", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval", "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk \u003e /dev/null;…" ], "i": "objectives/impact/ransom/esxi::storage-pre-encryption-prep", "l": 4 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "fstat", "stat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "fstat", "stat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 }, { "d": "Usage: label in binary strings", "e": [ "Usage:\n\t%s OPTION ...\n\nOPTIONS…" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.8999999761581421, "d": "Simple VM termination message", "e": [ "Killing VM " ], "i": "micro-behaviors/os/sysinfo/vmware::killing-vm-simple", "l": 4 }, { "c": 0.949999988079071, "d": "SHA1 hashing functions", "e": [ "SHA1_Update", "SHA1_Final", "SHA1_Init" ], "i": "micro-behaviors/crypto/hash/digest::sha1", "l": 3 }, { "c": 0.8500000238418579, "d": "snapshot.remove command", "e": [ "snapshot.remove" ], "i": "objectives/impact/ransom/esxi::snapshot-remove", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF has 500 or more strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::firmware-string-count-500-plus", "l": 1 }, { "c": 1.0, "d": "signatures word", "e": [ "signatures" ], "i": "objectives/impact/ransom/encrypt::fp-signatures-word", "l": 1 }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "f////0002/////00//////////////////00000/////00//////////////////00000/////00//////////////////00000/////00//////////////////0000" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043" }, { "a": "T1486", "c": 0.8500000238418579, "d": "Data leak extortion threat", "e": [ "data will be published" ], "i": "objectives/impact/ransom/native::data-will-be-published", "l": 4, "m": "C0027" }, { "c": 0.6600000262260437, "d": "Parse IP with inet_ntop", "e": [ "inet_ntop" ], "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "l": 2 }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.08" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "unlink" ], "i": "micro-behaviors/fs/file/delete::unlink", "l": 3 }, { "c": 0.30000001192092896, "d": "Sleep for nanosecond duration", "e": [ "nanosleep" ], "i": "micro-behaviors/time/query::nanosleep-func", "l": 2 }, { "c": 0.949999988079071, "d": "Reference to ESXi VM process kill commands", "e": [ "esxcli vm process kill" ], "i": "micro-behaviors/os/sysinfo/vmware::esxcli-vm-kill", "l": 4 }, { "c": 0.949999988079071, "d": "MD5 hashing functions", "e": [ "MD5_Update", "MD5_Final", "MD5_Transform", "EVP_md5", "md5_block_data_order", "MD5_Init", "sym.EVP_md5", "sym.MD5_Update", "sym.MD5_Transform", "sym.MD5_Final", "sym.MD5_Init", "sym.md5_block_data_order" ], "i": "micro-behaviors/crypto/hash/digest::md5", "l": 2 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlinkat" ], "i": "micro-behaviors/fs/link/symlink::readlinkat", "l": 2 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "Failed to read(\"/dev/urandom\"): %d (%s)", "/dev/urandom", "Failed to open(\"/dev/urandom\"): %d (%s)" ], "i": "micro-behaviors/os/random::urandom", "l": 2 }, { "c": 0.6600000262260437, "d": "Resolve symbolic links to canonical", "e": [ "GI_realpath", "realpath", "sym.__GI_realpath" ], "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/asn1/a_octet.c", "crypto/rsa/rsa_crpt.c", "crypto/asn1/asn1_err.c", "crypto/err/err.c", "crypto/conf/conf_lib.c", "crypto/pem/pem_all.c", "crypto/bio/bio_err.c", "crypto/kdf/hkdf.c", "ossl_init_load_crypto_strings_ossl_", "crypto/x509v3/pcy_lib.c", "crypto/evp/pmeth_lib.c", "crypto/pkcs7/pk7_doit.c", "crypto/evp/evp_lib.c", "crypto/rsa/rsa_sign.c", "crypto/evp/e_aes.c", "crypto/evp/evp_pbe.c" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "c": 0.949999988079071, "d": "Tor onion domain handling", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/backdoor/binary/stealth::onion-domain-handling", "l": 4, "m": "B0030" }, { "c": 0.8500000238418579, "d": "VMFS buffer max capacity", "e": [ "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity" ], "i": "objectives/impact/ransom/esxi::buffer-cache-maxcapacity", "l": 3 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses getdents", "e": [ "getdents" ], "i": "micro-behaviors/fs/directory/readdir::readdir-getdents", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "a": "T1574.006", "c": 0.800000011920929, "d": "Dynamic linker TLS allocation internal 1", "e": [ "_dl_allocate_tls_storage", "_dl_allocate_tls_init", "_dl_allocate_tls" ], "i": "objectives/evasion/hijack-execution-flow/linker::dl-allocate-tls-1", "l": 1, "m": "F0015" }, { "c": 0.800000011920929, "d": "C-style exec family functions", "e": [ "execl" ], "i": "micro-behaviors/process/create/execv::c-exec-variants", "l": 3 }, { "c": 0.800000011920929, "d": "Read file status and metadata (legacy 64-bit)", "e": [ "stat64", "lstat64", "fstat64" ], "i": "micro-behaviors/fs/file/stat::stat-legacy64", "l": 3 }, { "c": 0.699999988079071, "d": "HTTP REQUEST method", "e": [ "REQUEST", "REQUEST" ], "i": "micro-behaviors/communications/http/request::request", "l": 2 }, { "c": 0.8999999761581421, "d": "elasticsearch string", "e": [ "/var/lib/elasticsearch" ], "i": "micro-behaviors/data/db/conn/elasticsearch::elasticsearch-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Interactive process monitors (htop/atop)", "e": [ "atop" ], "i": "micro-behaviors/os/sysinfo/performance/monitoring::htop-atop", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.45" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1106", "c": 0.8500000238418579, "d": "d_reclen field access", "e": [ "d_reclen" ], "i": "micro-behaviors/os/syscall/invoke::d-reclen-field", "l": 1 }, { "c": 0.949999988079071, "d": "Reference to VMware snapshot removal command", "e": [ "vim-cmd vmsvc/snapshot.remove" ], "i": "micro-behaviors/os/sysinfo/vmware::vimcmd-snapshot-remove", "l": 4 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "unknown control command", "command not supported", "ssl command section empty", "ssl command section not found", "control command failed" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "d": "uClibc reference", "e": [ "uclibc", "uclibc", "uclibc", "uclibc", "uClibc", "uClibc", "uclibc", "uclibc", "uclibc", "__uclibc_", "__uclibc_", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc" ], "i": "micro-behaviors/dylib/library/libc::uclibc-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF overall entropy is low", "e": [ "binary.overall_entropy = 4.08" ], "i": "metadata/binary/metrics::firmware-overall-entropy-low", "l": 1 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "c": 0.949999988079071, "d": "ChaCha20/Salsa20 cipher constant", "e": [ "expand 32-byte k" ], "i": "micro-behaviors/crypto/symmetric/stream::chacha-salsa-constant", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 4806.00", "binary.overall_entropy = 4.08", "binary.export_count = 3397.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.699999988079071, "d": "X509_ function prefix", "e": [ "PEM_write_bio_X509_REQ", "X509_get_default_private_dir", "X509_REQ_INFO_seq_tt", "X509_get_default_cert_file", "X509_OBJECT_get0_X509", "X509_REQ_new", "X509_check_ca", "X509_REQ_delete_attr", "X509_VAL_new", "X509_STORE_CTX_new", "X509_str_functs", "PEM_write_bio_X509_CRL", "i2d_X509_REQ", "X509_NAME_ENTRY", "X509_add_ext", "X509_CINF" ], "i": "micro-behaviors/crypto/certificate::x509-prefix", "l": 2 }, { "a": "T1497.001", "c": 0.6000000238418579, "d": "VirtualBox hypervisor vendor string", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/vm-detect::vendor-virtualbox", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto" ], "i": "micro-behaviors/data/text/keywords::crypto-word", "l": 1 }, { "a": "T1082", "c": 0.6000000238418579, "d": "Query system name and information", "e": [ "uname" ], "i": "micro-behaviors/os/sysinfo/platform::uname", "l": 3, "m": "E1082" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 4806.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "SHA256 hashing functions", "e": [ "SHA256_Update", "SHA256_Final", "SHA256", "SHA256_Init" ], "i": "micro-behaviors/crypto/hash/digest::sha256", "l": 3 }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "/etc/localtime", "__GI_localtime_r", "time_localtime_tzi", "localtime.c", "GI_localtime_r", "_time_localtime_tzi.c", "localtime_r", "__GI_localtime", "GI_localtime", "__time_localtime_tzi", "localtime_r.c", "localtime" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "uclibc", "uclibc", "uclibc", "uclibc", "uClibc", "uClibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 4806.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.949999988079071, "d": "SHA512 hashing functions", "e": [ "sha512_256_init", "EVP_sha512_256", "EVP_sha512", "SHA512_Update", "SHA512", "SHA512_Final", "sha512_block_data_order_neon", "SHA512_Transform", "sha512_224_init", "sha512_block_data_order", "EVP_sha512_224", "SHA512_Init", "sym.EVP_sha512_224", "sym.EVP_sha512_256", "sym.EVP_sha512", "sym.sha512_224_init" ], "i": "micro-behaviors/crypto/hash/digest::sha512", "l": 3 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e /dev/null" ], "i": "micro-behaviors/process/daemonize::redirect-dev-null", "l": 1 }, { "c": 1.0, "d": "ARM direct read(2) syscall", "e": [ "03 70 a0 e3 00 00 00 ef" ], "i": "micro-behaviors/os/syscall/invoke::svc-read", "l": 3 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/resolv.conf", "()*+/etc/TZ", "/etc/motd", "/etc/motd.template", "Failed to write to '/etc/motd'", "/etc/localtime" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "c": 0.4000000059604645, "d": "Set resource limits for process", "e": [ "setrlimit", "setrlimit64", "GI_setrlimit", "sym.setrlimit64", "sym.setrlimit" ], "i": "micro-behaviors/process/resources/limits::setrlimit", "l": 2 }, { "c": 0.6600000262260437, "d": "Rename files by fd/path", "e": [ "renameat" ], "i": "micro-behaviors/fs/file/rename::renameat", "l": 2 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509", "X509", "X509", "X509", "X509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509" ], "i": "micro-behaviors/crypto/certificate::x509-string", "l": 2 }, { "a": "T1543", "c": 0.75, "d": "Unix daemon persistence mechanism", "e": [ "fork", "sym.__clone", "clone", "vfork", "GI_fork", "GI_vfork", "setsid" ], "i": "objectives/persistence/system/daemon/init::unix-daemon-persistence", "l": 1, "m": "F0006" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Executes command and captures output", "e": [ "popen" ], "i": "micro-behaviors/process/create/popen::c-popen", "l": 3, "m": "E1059.004" }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc/resolv.conf", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/fs/path/config::config-resolv", "l": 3 }, { "c": 0.8999999761581421, "d": "Embedded PEM RSA public key block", "e": [ "-----BEGIN PUBLIC KEY-----" ], "i": "micro-behaviors/crypto/asymmetric/rsa::pem-public-key-embedded", "l": 3 }, { "c": 0.800000011920929, "d": "esxcli storage command", "e": [ "for I in $(esxcli storage filesystem list |grep '…" ], "i": "objectives/impact/ransom/esxi::esxcli-storage", "l": 1 }, { "a": "T1057", "d": "Dev app vim", "e": [ "vim", "vim" ], "i": "micro-behaviors/process/enumerate/apps::dev-apps-vim", "l": 3, "m": "E1592" }, { "c": 0.699999988079071, "d": "PEM end marker", "e": [ "-----END CIPHERTEXT BLOCK-----", "-----END", "-----END PUBLIC KEY-----" ], "i": "micro-behaviors/crypto/certificate::pem-end", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher" ], "i": "micro-behaviors/crypto/library::cipher-keyword", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write", "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 0.699999988079071, "d": "AES S-box start bytes", "e": [ "63 7C 77 7B F2 6B 6F C5" ], "i": "micro-behaviors/crypto/symmetric/aes::aes-sbox-bytes", "l": 3, "m": "C0021.001" }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlink" ], "i": "micro-behaviors/fs/link/symlink::readlink", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses fdopendir", "e": [ "fdopendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "l": 2 }, { "c": 0.800000011920929, "d": "vmkfstools command", "e": [ "vmkfstools", "vmkfstools", "vmkfstools", "vmkfstools" ], "i": "objectives/impact/ransom/esxi::vmkfstools-cmd", "l": 1 }, { "c": 0.8500000238418579, "d": "VMFS buffer flush interval", "e": [ "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval" ], "i": "objectives/impact/ransom/esxi::buffer-cache-flushinterval", "l": 3 }, { "c": 0.800000011920929, "d": "storage filesystem list command", "e": [ "for I in $(esxcli storage filesystem list |grep 'VMFS-5' |awk '{p…", "for I in $(esxcli storage filesystem list |grep 'VMFS-6' |awk '{p…" ], "i": "objectives/impact/ransom/esxi::storage-filesystem-list", "l": 1 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Formatted input from file", "e": [ "vfscanf" ], "i": "micro-behaviors/fs/file/read::fscanf", "l": 2 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa/rsa_ossl.c", "crypto/rsa/rsa_gen.c", "crypto/rsa/rsa_chk.c", "crypto/rsa", "crypto/rsa/rsa_asn1.c", "crypto/rsa/rsa_ssl.c", "crypto/rsa/rsa_oaep.c", "crypto/rsa/rsa_crpt.c", "crypto/rsa/rsa_err.c", "crypto/rsa/rsa_sign.c", "crypto/rsa/rsa_ameth.c", "crypto/rsa/rsa_none.c", "crypto/rsa/rsa_x931.c", "crypto/rsa/rsa_saos.c", "crypto/rsa/rsa_pmeth.c", "crypto/rsa/rsa_lib.c" ], "i": "objectives/impact/ransom/encrypt::go-crypto-rsa", "l": 1 }, { "c": 0.30000001192092896, "d": "glibc reference", "e": [ "GI___glibc_strerror_r", "glibc_strerror_r", "__GI___glibc_strerror_r", "__glibc_strerror_r.c" ], "i": "micro-behaviors/dylib/library/libc::glibc-ref", "l": 2 }, { "a": "T1059", "c": 0.75, "d": "Set terminal attributes", "e": [ "tcsetattr", "GI_tcsetattr", "sym.tcsetattr" ], "i": "micro-behaviors/process/tty/pty::tcsetattr", "l": 3 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "X509_get_default_private_dir", "X509_REQ_INFO_seq_tt", "X509_CINF", "X509_check_ca", "PEM_write_bio_X509_CRL", "i2d_X509_REQ", "X509_OBJECT_get0_X509", "X509_VAL_new", "X509_REQ_delete_attr", "X509_REQ_new", "X509_NAME_ENTRY", "X509_STORE_CTX_new", "X509_add_ext", "PEM_write_bio_X509_REQ", "X509_str_functs", "X509_get_default_cert_file" ], "i": "micro-behaviors/crypto/certificate::certificate-handling", "l": 2 }, { "c": 0.6600000262260437, "d": "Get system statistics from /proc/stat", "e": [ "/proc/stat" ], "i": "micro-behaviors/fs/proc/system::system-stat", "l": 3 }, { "c": 0.30000001192092896, "d": "Full daemon behavior (fork + setsid + devnull)", "e": [ "…eroedthick $I/eztDisk \u003e /dev/null; vmkfstools -U $I/eztDi…", "clone", "…fstools -U $I/eztDisk \u003e /dev/null; done", "GI_vfork", "GI_fork", "/dev/null", "sym.__clone", "fork", "vim-cmd vmsvc/snapshot.removeall %llu \u003e /dev/null 2\u003e\u00261", "vfork", "setsid" ], "i": "micro-behaviors/process/daemonize::full-daemon", "l": 2 }, { "c": 0.4000000059604645, "d": "EVP_PKEY reference", "e": [ "EVP_PKEY_asn1_get_count", "EVP_PKEY_meth_set_init", "EVP_PKEY_set_type", "EVP_PKEY_size", "EVP_PKEY_meth_get_check", "EVP_PKEY_type", "EVP_PKEY_paramgen", "EVP_PKEY_CTX_set0_keygen_info", "EVP_PKEY_encrypt_init", "EVP_PKEY_paramgen_init", "EVP_PKEY_get_default_digest_nid", "EVP_PKEY_check", "EVP_PKEY_base_id", "sk_EVP_PKEY_ASN1_METHOD_compfunc", "EVP_PKEY_asn1_copy", "EVP_PKEY_asn1_get0_info" ], "i": "micro-behaviors/crypto/asymmetric/rsa::evp-pkey-ref", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "crypto/aes/aesv8-armx.S", "crypto/aes/aes_cbc.c", "crypto/aes", "crypto/aes/aes-armv4.S", "crypto/aes/bsaes-armv7.S" ], "i": "objectives/impact/ransom/encrypt::go-crypto-aes", "l": 1 }, { "a": "T1071.004", "c": 0.6600000262260437, "d": "Reads DNS resolver configuration", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/communications/dns/lookup::lookup-resolv", "l": 3, "m": "C0011" }, { "a": "T1082", "c": 0.4000000059604645, "d": "Query resource limits for process", "e": [ "GI_getrlimit", "getrlimit", "sym.__GI_getrlimit" ], "i": "micro-behaviors/process/resources/limits::getrlimit", "l": 2, "m": "E1082" }, { "c": 0.699999988079071, "d": "/dev/random access", "e": [ "/dev/random" ], "i": "micro-behaviors/os/random::dev-random", "l": 2 }, { "c": 0.8999999761581421, "d": "cassandra string", "e": [ "cassandra" ], "i": "micro-behaviors/data/db/conn/cassandra::cassandra-string", "l": 3 }, { "a": "T1082", "d": "Get hostname of current machine", "e": [ "gethostname", "GI_gethostname", "sym.gethostname" ], "i": "micro-behaviors/os/sysinfo/hostname::gethostname", "l": 2, "m": "E1082" }, { "c": 0.30000001192092896, "d": "Sleep for microsecond duration", "e": [ "usleep" ], "i": "micro-behaviors/time/query::usleep-func", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords::payload", "l": 1 }, { "a": "T1486", "c": 0.800000011920929, "d": "ESXi CLI tools for attack", "e": [ "vim-cmd", "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval", "for I in $(esxcli storage filesystem list…", "vmkfstools", "esxcli vm process list", "esxcli vm process kill -t force -w %llu" ], "i": "objectives/impact/ransom/esxi::cli-tools", "l": 3, "m": "C0027" }, { "c": 1.0, "d": "Memory advisory hints (madvise)", "e": [ "madvise" ], "i": "micro-behaviors/mem/advise/hints::madvise", "l": 2 }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool init OOM error message", "e": [ "thpool_init(): Could not allocate memory for thread pool" ], "i": "objectives/impact/ransom/esxi::thpool-init-oom", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-200", "l": 1 }, { "c": 0.6600000262260437, "d": "Unmap files from memory", "e": [ "GI_munmap", "munmap", "sym.__GI_munmap" ], "i": "micro-behaviors/fs/memory/mmap::munmap", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 35740.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 } ], "sha": "083ac61d0f649b00da9443e89795e3c168beeeecdbc2cb3c94038a88b876b7b9", "path": "/data/samples/bad/datasets/malware-souk/corpus/Qilin/samples/55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea.zip", "type": "zip" }, { "f": "O₈(Al₄C₃I₃As₄Er₂Dy₂LaP)H₇(Os₄Cm₂Cr₈Db₆F₄Po₁₀Hf)Md₂(Bi₄He)", "x": 206, "dp": 1, "id": 1, "ms": { "elf": { "relro": "partial", "e_type": 2.0, "has_got": true, "e_machine": 40.0, "class_bits": 32.0, "nx_enabled": true, "entry_point": 69040.0, "has_eh_frame": true, "stack_canary": true, "symtab_count": 8526.0, "entry_section": ".text", "little_endian": true, "debug_section_count": 9.0, "program_header_count": 6.0, "section_header_count": 30.0, "load_segment_max_p_memsz": 1227072.0, "load_segment_max_p_filesz": 1227072.0 }, "binary": { "code_size": 1038620.0, "file_size": 3227364.0, "entry_point": 69040.0, "has_overlay": true, "code_entropy": 4.4, "data_entropy": 3.66, "export_count": 3397.0, "overlay_size": 1200.0, "string_count": 12400.0, "overlay_ratio": 0.0, "section_count": 29.0, "avg_complexity": 4.45, "function_count": 4806.0, "max_complexity": 249.0, "string_density": 12.23, "aliased_exports": 373.0, "overall_entropy": 4.08, "overlay_entropy": 2.25, "avg_basic_blocks": 7.44, "avg_section_size": 112340.93, "entropy_variance": 1.3, "function_density": 4.74, "avg_function_size": 213.81, "avg_string_length": 16.53, "complexity_per_kb": 0.0, "max_string_length": 1235.0, "wide_string_count": 2.0, "avg_string_entropy": 3.3, "code_to_data_ratio": 0.47, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.32, "total_basic_blocks": 35740.0, "high_entropy_strings": 1.0, "string_length_stddev": 17.51, "debug_reference_count": 9.0, "largest_section_ratio": 0.32, "sentence_string_count": 1022.0, "sentence_string_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 31.0, "nonstandard_section_name_count": 15.0 } }, "ss": [ [ 585056, "expand 32-byte k" ], [ 689164, "SHA256 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 806644, "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 864756, "GHASH for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 865440, "GHASH for ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 885172, "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 889758, "Dl j" ], [ 895420, "SHA512 block transform for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 905268, "D\u003c\u003cx" ], [ 905947, "9JLX" ], [ 909656, "AES for ARMv4, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 914432, "Bit-sliced AES for NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], [ 1039072, "Adding job: id: %08x; path: '%s'" ], [ 1039108, "Cannot queue job %08x: queue is full. Waiting..." ], [ 1039160, "Usage:\n\t%s OPTION ...\n\nOPTIONS:\n\t-d,--debug Enable debug mode (logging level set to DEBUG, disables backgrounding)" ], [ 1039168, "%s OPTION ..." ], [ 1039193, "-d,--debug Enable debug mode (logging level set to DEBUG, disables backgrounding)" ], [ 1039290, "--dry-run Perform scan for files to be processed, do not modify them" ], [ 1039411, "-l,--log-level \u003cnumber\u003e Set logging level. Values are from 0 for FATAL up to 5 for DEBUG" ], [ 1039502, "--no-df Ignore configured white-/black- lists of directories" ], [ 1039581, "--no-ef Ignore configured white-/black- lists of extensions" ], [ 1039659, "--no-ff Ignore configured white-/black- lists of files" ], [ 1039732, "--no-proc-kill Disables process kill" ], [ 1039780, "-R,--no-rename Disables rename of completed files" ], [ 1039841, "--no-snap-rm Disables snapshot deletion" ], [ 1039894, "--no-vm-kill Disables VM kill" ], [ 1039937, "-p,--path \u003cstring\u003e Specifies top-level directory for files search" ], [ 1040010, "--password \u003cstring\u003e Password for startup" ], [ 1040057, "-r,--rename Enables rename of completed files (default)" ], [ 1040127, "-t,--timer \u003cnumber\u003e Enabled timed delay before encryption (seconds)" ], [ 1040201, "-w,--whitelist Use whitelists for inclusion instead of blacklists for exclusion (later is default behavior)" ], [ 1040320, "-y,--yes Assume answer 'yes' on all questions (script mode)" ], [ 1040404, "Failed to write to '/etc/motd'" ], [ 1040436, "Failed to load RSA public key" ], [ 1040468, "20b4340108e36af7f27ea289762f3e754d9db281ea42048c64ef117b1f1e84ba" ], [ 1040536, "Failed to setrlimit(%d): %d (%s)" ], [ 1040572, "Number of threads: %u" ], [ 1040596, "%s_RECOVER.txt" ], [ 1040628, "Debug logging enabled" ], [ 1040652, "Backgrounding disabled" ], [ 1040676, "Dry run enabled" ], [ 1040696, "Logging level set to %d" ], [ 1040724, "Ignore configured white-/black- lists of directories" ], [ 1040780, "Ignore configured white-/black- lists of extensions" ], [ 1040836, "Ignore configured white-/black- lists of files" ], [ 1040884, "Kill processes disabled" ], [ 1040912, "Rename final file disabled" ], [ 1040940, "Remove snapshots disabled" ], [ 1040968, "Kill VMs disabled" ], [ 1040988, "Search path: %s" ], [ 1041008, "Password: %s" ], [ 1041024, "Rename final file enabled" ], [ 1041052, "Enabled timer: %d" ], [ 1041072, "Enabled whitelist mode: %d" ], [ 1041100, "Assume answer 'yes' on all questions enabled (script mode)" ], [ 1041160, "No path specified! It is mandatory for blacklist mode" ], [ 1041216, "No password specified!" ], [ 1041240, "Password is not correct!" ], [ 1041268, "-- Qilin" ], [ 1041281, "Your network/system was encrypted." ], [ 1041318, "Encrypted files have new extension." ], [ 1041358, "-- Compromising and sensitive data" ], [ 1041397, "We have downloaded compromising and sensitive data from you system/network" ], [ 1041474, "If you refuse to communicate with us and we do not come to an agreement, your data will be published." ], [ 1041578, "Data includes:" ], [ 1041595, "- Employees personal data, CVs, DL , SSN." ], [ 1041639, "- Complete network map including credentials for local and remote services." ], [ 1041717, "- Financial information including clients data, bills, budgets, annual reports, bank statements." ], [ 1041816, "- Complete datagrams/schemas/drawings for manufacturing in solidworks format" ], [ 1041913, "-- Warning" ], [ 1041928, "1) If you modify files - our decrypt software won't able to recover data" ], [ 1042003, "2) If you use third party software - you can damage/modify files (see item 1)" ], [ 1042083, "3) You need cipher key / our decrypt software to restore you files." ], [ 1042153, "4) The police or authorities will not be able to help you get the cipher key. We encourage you to consider your decisions." ], [ 1042280, "-- Recovery" ], [ 1042296, "1) Download tor browser: https://www.torproject.org/download/" ], [ 1042378, "3) Enter credentials-- Credentials" ], [ 1042415, "Extension: o7L03e8F9J" ], [ 1042438, "Domain: 73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], [ 1042510, "login: a4r1PcL5RukvOqERpdoic5e_UNEzK9Dz" ], [ 1042564, "Are you sure to start encryption? (y/n)" ], [ 1042608, "Failed to clone(): %s (%d)" ], [ 1042636, "Process gone into background" ], [ 1042668, "%s.log.%d" ], [ 1042680, "Failed to open log file '%s' (%d: %s). Falling back to console output" ], [ 1042752, "Log file '%s' opened..." ], [ 1042780, "/etc/motd.template" ], [ 1042800, "/var/run/motd" ], [ 1042816, "/etc/motd" ], [ 1042852, "%s_%zu" ], [ 1042884, "PASS #%lu: NORMAL" ], [ 1042904, "File tree traversing done. Waiting workers to complete..." ], [ 1042964, "Done. Cleaning up..." ], [ 1043000, "debug" ], [ 1043008, "dry-run" ], [ 1043024, "log-level" ], [ 1043060, "no-proc-kill" ], [ 1043076, "no-rename" ], [ 1043088, "no-snap-rm" ], [ 1043100, "no-vm-kill" ], [ 1043112, "path" ], [ 1043120, "password" ], [ 1043132, "rename" ], [ 1043140, "timer" ], [ 1043148, "whitelist" ], [ 1043184, "[%08x] Started job..." ], [ 1043208, "[%08x] Failed to generate random nonce" ], [ 1043248, "[%08x] Re-adding job: id: %08x; path: '%s'..." ], [ 1043296, "[%08x] Retries exeeded (%lu). Aborting job..." ], [ 1043344, "[%08x] Elapsed for nonce generation: %llu ms" ], [ 1043392, "[%08x] Failed to generate random key" ], [ 1043432, "[%08x] Elapsed for key generation: %llu ms" ], [ 1043476, "[%08x] Encrypting file '%s': FAILURE (fd): %d (%s)" ], [ 1043528, "[%08x] Encrypting file '%s': FAILURE (metadata)" ], [ 1043580, "[%08x] Failed to truncate CC at %lu: %d (%s)" ], [ 1043628, "[%08x] Failed to write CC at %lu: %d (%s)" ], [ 1043672, "[%08x] Elapsed for payload encryption: %llu ms" ], [ 1043720, "[%08x] Encrypting file '%s': FAILURE (main loop)" ], [ 1043772, "[%08x] Failed to write CP at %lu: %d (%s)" ], [ 1043816, "[%08x] Elapsed for data encryption: %llu ms, speed: %.02f MiB/s" ], [ 1043884, "[%08x] Encrypting file '%s': SUCCESS (nonce: %s)" ], [ 1043944, "[%08x] Failed to create file '%s'" ], [ 1043980, "[%08x] Failed to write to '%s'" ], [ 1044028, ".%s_%zu" ], [ 1044040, "[%08x] Failed to rename encrypted file to '%s': %d (%s)!" ], [ 1044100, "[%08x] Failed to write metadata for '%s'" ], [ 1044144, "[%08x] Failed to truncate '%s' at %lu (SB): %d (%s)" ], [ 1044200, "-----END CIPHERTEXT BLOCK-----" ], [ 1044232, "[%08x] Failed to write endblock mark for '%s'" ], [ 1044280, "[%08x] Failed to write startblock mark for '%s'" ], [ 1044333, "[%uG%.3f%%" ], [ 1044388, "aiff" ], [ 1044416, "atom" ], [ 1044504, "crdownload" ], [ 1044556, "desktop" ], [ 1044636, "epub" ], [ 1044676, "h264" ], [ 1044708, "ibooks" ], [ 1044728, "image" ], [ 1044756, "java" ], [ 1044868, "mobi" ], [ 1044912, "numbers" ], [ 1044952, "pages" ], [ 1044960, "parallels" ], [ 1045032, "prproj" ], [ 1045064, "qcow2" ], [ 1045132, "sketch" ], [ 1045184, "torrent" ], [ 1045364, "/usr/home" ], [ 1045376, "/tmp" ], [ 1045384, "/var/www" ], [ 1045396, "/usr/local/www" ], [ 1045412, "/mnt" ], [ 1045420, "/media" ], [ 1045428, "/srv" ], [ 1045436, "/data" ], [ 1045444, "/backup" ], [ 1045452, "/var/lib/mysql" ], [ 1045468, "/var/mail" ], [ 1045480, "/var/spool/mail" ], [ 1045496, "/var/vm" ], [ 1045504, "/var/lib/vmware" ], [ 1045520, "/opt/virtualbox" ], [ 1045536, "/var/lib/xen" ], [ 1045552, "/var/opt/xen" ], [ 1045568, "/kvm" ], [ 1045576, "/var/lib/docker" ], [ 1045592, "/var/lib/libvirt" ], [ 1045612, "/var/run/sr-mount" ], [ 1045632, "/var/lib/postgresql" ], [ 1045652, "/var/lib/redis" ], [ 1045668, "/var/lib/mongodb" ], [ 1045688, "/var/lib/couchdb" ], [ 1045708, "/var/lib/neo4j" ], [ 1045724, "/var/lib/cassandra" ], [ 1045744, "/var/lib/riak" ], [ 1045760, "/var/lib/influxdb" ], [ 1045780, "/var/lib/elasticsearch" ], [ 1045924, "initrd" ], [ 1045932, "vmlinuz" ], [ 1045940, "basemisc.tgz" ], [ 1045956, "boot.cfg" ], [ 1045968, "bootpart.gz" ], [ 1045980, "features.gz" ], [ 1045992, "imgdb.tgz" ], [ 1046004, "jumpstrt.gz" ], [ 1046016, "onetime.tgz" ], [ 1046028, "state.tgz" ], [ 1046040, "useropts.gz" ], [ 1046052, "/boot/" ], [ 1046060, "/proc/" ], [ 1046124, "/lib64/" ], [ 1046132, "/vmware/lifecycle/" ], [ 1046152, "/vdtc/" ], [ 1046160, "/healthd/" ], [ 1046176, "qemu" ], [ 1046200, "[%08x] ERROR: failed to read data from %s" ], [ 1046244, "[%08x] ERROR: failed to encrypt data @%ll" ], [ 1046288, "[%08x] ERROR: failed to decrypt data @%ll" ], [ 1046332, "[%08x] ERROR: failed to write data to %s" ], [ 1046376, "[%08x] Startblock size: %d" ], [ 1046404, "[%08x] ERROR: failed to init enc cipher!" ], [ 1046448, "[%08x] ERROR: failed to init dec cipher!" ], [ 1046492, "[%08x] ERROR: failed to process data in %s" ], [ 1046536, "WARNING: stepskipcfg_setup() configured with unknown mode '%s'!\nWARNING: defaulting to STEPSKIP_NORMAL" ], [ 1046600, "WARNING: defaulting to STEPSKIP_NORMAL" ], [ 1046640, "WARNING: stepskipcfg contains unknown mode %d!\nWARNING: defaulting to STEPSKIP_NORMAL" ], [ 1046728, "UNKNOWN" ], [ 1046736, "STEPSKIP for %zu file: step=%zu, skip=%zu" ], [ 1046780, "NORMAL" ], [ 1046788, "STEPSKIP" ], [ 1046800, "FAST" ], [ 1046812, "MULTIPASS" ], [ 1046912, "-----BEGIN PUBLIC KEY-----" ], [ 1046939, "MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA3a4G68kgJX2bwWZX23Yz" ], [ 1047004, "zPI68Fl6eocJ+XLcPN9dvG3o/SV04F2zE7nWUhBbwsBHiX8bIquqVyVV+Y93FOCn" ], [ 1047069, "eJODySiy+bLZ1QfXKMjoNbhHq+aeuYCV8na3LF3hoGpST6uJpXUxbhZOBqHHbbx6" ], [ 1047134, "vVy1fXOUEvaEOhqkglfDUQ7/fH6sT1p/3RyCtGi3o7588oMHOVgz3jZux2dqp9Zy" ], [ 1047199, "Ps9MqZs0OtcBAXTG4EmD8yz2RgH+D9j756snWNZeknnjNO+KUARDSICKFOYtb3wz" ], [ 1047264, "xYFVvACB3sJuTpAJ2HuaWIEo8NljGsMkNTqy3tFY0WnUBxAgt7AMUM+Ex75DGa9H" ], [ 1047329, "IAXd+bTOfo+zyUGKiUFBqBZjo8T0ueTpr8BZb98fl5/LFpXmBuR/dJBfeuq3a4vK" ], [ 1047394, "Fpxx796zUe/hoiBSvw9GzLyYa5A5Lbcz2qOi9RTYTEmZDX9qss+GfI54ZM2vrxyC" ], [ 1047459, "nUJz/dDxxjFOujMJJBN9b1G9KIgiD3Sh41RLfEEemOG4Fo+1TbegKcK11a3LvUfL" ], [ 1047524, "g3PhwflhaZwuwz3Nrie9vS9NKM+935rCkjeP1tap8NvrKow4F0KPg0loES06/fjm" ], [ 1047589, "47PI12ZrUc6YE5zH3CwtiCXW4BUlpPacZgUJRpvZAODHYlejTnxtiWvq4XLe1A+3" ], [ 1047654, "98/IXu0IMoFWAH2KnlPsczsCAwEAAQ==" ], [ 1047687, "-----END PUBLIC KEY-----" ], [ 1047716, "Failed to ENCRYPT data: %s" ], [ 1047744, "%Y-%m-%d %H:%M:%S" ], [ 1047764, "[%s] %7s: %s" ], [ 1047784, "%s\"%s\"" ], [ 1047792, "--- Configuration start ---" ], [ 1047820, "VM whitelist: [%s]" ], [ 1047840, "Process blacklist: [%s]" ], [ 1047868, "Directory blacklist: [%s]" ], [ 1047896, "File blacklist: [%s]" ], [ 1047920, "File extensions blacklist: [%s]" ], [ 1047956, "Directory whitelist: [%s]" ], [ 1047984, "File whitelist: [%s]" ], [ 1048008, "File extensions whitelist: [%s]" ], [ 1048044, "Encrypted extension: \"%s\"" ], [ 1048072, "Stepskip mode: \"%s\"" ], [ 1048096, "--- Configuration end ---" ], [ 1048140, "FATAL" ], [ 1048148, "ERROR" ], [ 1048156, "WARNING" ], [ 1048164, "INFO" ], [ 1048172, "DEBUG" ], [ 1048200, "Write error %d: %s" ], [ 1048220, "Read error %d: %s" ], [ 1048240, "Directory `%s` matches" ], [ 1048264, "File `%s` matches" ], [ 1048284, "Failed to nftw(): %d (%m)" ], [ 1048312, "out of memory" ], [ 1048328, "Failed to get system type: %d (%s)" ], [ 1048364, "Linux" ] ], "sz": 3227364, "ts": [ { "c": 0.949999988079071, "d": "Reference to VMware snapshot removal command", "e": [ "vim-cmd vmsvc/snapshot.remove" ], "i": "micro-behaviors/os/sysinfo/vmware::vimcmd-snapshot-remove", "l": 4 }, { "c": 0.8500000238418579, "d": "snapshot.remove command", "e": [ "snapshot.remove" ], "i": "objectives/impact/ransom/esxi::snapshot-remove", "l": 1 }, { "c": 0.8999999761581421, "d": "snapshot.removeall command", "e": [ "snapshot.removeall" ], "i": "objectives/impact/ransom/esxi::snapshot-removeall", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.8999999761581421, "d": "VMware vim-cmd tool", "e": [ "vim-cmd" ], "i": "objectives/impact/ransom/esxi::vim-cmd-tool", "l": 3 }, { "c": 0.8500000238418579, "d": "vim-cmd vmsvc command", "e": [ "vim-cmd vmsvc" ], "i": "objectives/impact/ransom/esxi::vim-cmd-vmsvc", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e /dev/null" ], "i": "micro-behaviors/process/daemonize::redirect-dev-null", "l": 1 }, { "c": 0.8500000238418579, "d": "vmsvc/snapshot command", "e": [ "vmsvc/snapshot" ], "i": "objectives/impact/ransom/esxi::vmsvc-snapshot", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 200.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x100614" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.6000000238418579, "d": "RSA_public_encrypt reference", "e": [ "RSA_public_encrypt" ], "i": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-encrypt", "l": 3 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v3 onion address", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v3", "l": 4, "m": "C0026" }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "c": 0.8999999761581421, "d": "Embedded PEM RSA public key block", "e": [ "-----BEGIN PUBLIC KEY-----" ], "i": "micro-behaviors/crypto/asymmetric/rsa::pem-public-key-embedded", "l": 3 }, { "d": "Usage: label in binary strings", "e": [ "Usage:\n\t%s OPTION ...\n\nOPTIONS…" ], "i": "metadata/package/help::usage-title-string", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.6600000262260437, "d": "Parse IP with inet_ntop", "e": [ "inet_ntop" ], "i": "micro-behaviors/communications/ip/parse::inet-ntop-symbol", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto" ], "i": "micro-behaviors/data/text/keywords::crypto-word", "l": 1 }, { "c": 0.800000011920929, "d": "esxcli storage command", "e": [ "for I in $(esxcli storage filesystem list |grep '…" ], "i": "objectives/impact/ransom/esxi::esxcli-storage", "l": 1 }, { "a": "T1046", "c": 0.8600000143051147, "d": "Connection scan status strings", "e": [ "Connection timed out", "Connection refused" ], "i": "objectives/discovery/network/scan/port::connection-status-messages", "l": 1, "m": "E1046" }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Memory advisory hints (madvise)", "e": [ "madvise" ], "i": "micro-behaviors/mem/advise/hints::madvise", "l": 2 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509", "X509", "X509", "X509", "X509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509" ], "i": "micro-behaviors/crypto/certificate::x509-string", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "c": 0.8999999761581421, "d": "Install signal handler", "e": [ "signal" ], "i": "micro-behaviors/os/signal/handler::signal", "l": 2 }, { "c": 1.0, "d": "setsid() function import", "e": [ "setsid" ], "i": "micro-behaviors/process/create/setsid::import", "l": 1, "m": "F0003" }, { "c": 0.75, "d": "String to integer conversion (atoi)", "e": [ "atoi" ], "i": "micro-behaviors/data/string/conversion::atoi", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/asn1/a_octet.c", "crypto/rsa/rsa_crpt.c", "crypto/asn1/asn1_err.c", "crypto/err/err.c", "crypto/conf/conf_lib.c", "crypto/pem/pem_all.c", "crypto/bio/bio_err.c", "crypto/kdf/hkdf.c", "ossl_init_load_crypto_strings_ossl_", "crypto/x509v3/pcy_lib.c", "crypto/evp/pmeth_lib.c", "crypto/pkcs7/pk7_doit.c", "crypto/evp/evp_lib.c", "crypto/rsa/rsa_sign.c", "crypto/evp/e_aes.c", "crypto/evp/evp_pbe.c" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.4000000059604645, "d": "EVP_PKEY reference", "e": [ "EVP_PKEY_asn1_get_count", "EVP_PKEY_meth_set_init", "EVP_PKEY_set_type", "EVP_PKEY_size", "EVP_PKEY_meth_get_check", "EVP_PKEY_type", "EVP_PKEY_paramgen", "EVP_PKEY_CTX_set0_keygen_info", "EVP_PKEY_encrypt_init", "EVP_PKEY_paramgen_init", "EVP_PKEY_get_default_digest_nid", "EVP_PKEY_check", "EVP_PKEY_base_id", "sk_EVP_PKEY_ASN1_METHOD_compfunc", "EVP_PKEY_asn1_copy", "EVP_PKEY_asn1_get0_info" ], "i": "micro-behaviors/crypto/asymmetric/rsa::evp-pkey-ref", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "c": 0.8999999761581421, "d": "influxdb string", "e": [ "influxdb" ], "i": "micro-behaviors/data/db/conn/influxdb::influxdb-string", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF has 500 or more strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::firmware-string-count-500-plus", "l": 1 }, { "c": 0.75, "d": "PKCS5_PBKDF2_HMAC function", "e": [ "PKCS5_PBKDF2_HMAC", "PKCS5_PBKDF2_HMAC_SHA1" ], "i": "micro-behaviors/crypto/kdf::pkcs5-pbkdf2", "l": 2 }, { "a": "T1082", "d": "Get hostname of current machine", "e": [ "gethostname", "GI_gethostname", "sym.gethostname" ], "i": "micro-behaviors/os/sysinfo/hostname::gethostname", "l": 2, "m": "E1082" }, { "a": "T1106", "c": 0.8500000238418579, "d": "d_reclen field access", "e": [ "d_reclen" ], "i": "micro-behaviors/os/syscall/invoke::d-reclen-field", "l": 1 }, { "c": 0.6600000262260437, "d": "Process forking", "e": [ "fork", "GI_fork", "clone", "vfork", "GI_vfork", "sym.__clone" ], "i": "micro-behaviors/process/fork/clone::fork", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.30" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "Token", "Token", "token", "token" ], "i": "micro-behaviors/data/text/keywords::token", "l": 1 }, { "c": 0.30000001192092896, "d": "glibc reference", "e": [ "GI___glibc_strerror_r", "glibc_strerror_r", "__GI___glibc_strerror_r", "__glibc_strerror_r.c" ], "i": "micro-behaviors/dylib/library/libc::glibc-ref", "l": 2 }, { "c": 0.699999988079071, "d": "Short -h help flag", "e": [ "-h," ], "i": "metadata/package/help::usage-help", "l": 2 }, { "d": "password keyword", "e": [ "id-PasswordBasedMAC", "userPassword", "problems getting password", "… for files search\n\t --password \u003cstring\u003e Password for…", "Password: %s", "PKCS8 decrypt password", "password based MAC", "password_hash", "No password specified!", "PKCS12 import password", "opt_password", "challengePassword", "Password is not correct!", "--password \u003cstring\u003e Password for startup", "password", "pem_password_cb" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "a": "T1497.001", "d": "qemu lowercase string", "e": [ "qemu" ], "i": "objectives/anti-analysis/emulator-detect::qemu-lower", "l": 3, "m": "B0009" }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool init OOM error message", "e": [ "thpool_init(): Could not allocate memory for thread pool" ], "i": "objectives/impact/ransom/esxi::thpool-init-oom", "l": 1, "m": "C0027" }, { "a": "T1082", "c": 0.6000000238418579, "d": "Query system name and information", "e": [ "uname" ], "i": "micro-behaviors/os/sysinfo/platform::uname", "l": 3, "m": "E1082" }, { "c": 0.6600000262260437, "d": "Uses getdents", "e": [ "getdents" ], "i": "micro-behaviors/fs/directory/readdir::readdir-getdents", "l": 2 }, { "c": 0.4000000059604645, "d": "Set resource limits for process", "e": [ "setrlimit", "setrlimit64", "GI_setrlimit", "sym.setrlimit64", "sym.setrlimit" ], "i": "micro-behaviors/process/resources/limits::setrlimit", "l": 2 }, { "c": 0.20000000298023224, "d": "Convert time to UTC time", "e": [ "OPENSSL_gmtime_adj", "gmtime", "X509_gmtime_adj", "OPENSSL_gmtime", "OPENSSL_gmtime_diff", "sym.X509_gmtime_adj", "sym.OPENSSL_gmtime", "sym.OPENSSL_gmtime_adj", "sym.OPENSSL_gmtime_diff", "sym.gmtime" ], "i": "micro-behaviors/time/query::gmtime", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files (legacy 64-bit)", "e": [ "open64" ], "i": "micro-behaviors/fs/file/open::open64", "l": 2 }, { "c": 0.949999988079071, "d": "FreeBSD string marker", "e": [ "FreeBSD" ], "i": "metadata/binary/section/content::freebsd-marker", "l": 1 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current calendar time (seconds)", "e": [ "time" ], "i": "micro-behaviors/time/query::time", "l": 2, "m": "T1124" }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "d": "certificate string reference", "e": [ "certificate", "Certificate", "Certificate", "Certificate", "certificate", "Certificate", "Certificate", "Certificate", "Certificate", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "CERTIFICATE", "Certificate", "certificate" ], "i": "micro-behaviors/crypto/certificate::certificate-ref", "l": 2 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 1.0, "d": "ARM direct write(2) syscall", "e": [ "04 70 a0 e3 00 00 00 ef" ], "i": "micro-behaviors/os/syscall/invoke::svc-write", "l": 3 }, { "a": "T1486", "c": 0.8500000238418579, "d": "Data leak extortion threat", "e": [ "data will be published" ], "i": "objectives/impact/ransom/native::data-will-be-published", "l": 4, "m": "C0027" }, { "c": 1.0, "d": "signatures word", "e": [ "signatures" ], "i": "objectives/impact/ransom/encrypt::fp-signatures-word", "l": 1 }, { "c": 0.75, "d": "HKDF key derivation", "e": [ "HKDF" ], "i": "micro-behaviors/crypto/kdf::hkdf", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "c": 0.6600000262260437, "d": "Resolve symbolic links to canonical", "e": [ "GI_realpath", "realpath", "sym.__GI_realpath" ], "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "l": 2 }, { "c": 0.800000011920929, "d": "storage filesystem list command", "e": [ "for I in $(esxcli storage filesystem list |grep 'VMFS-5' |awk '{p…", "for I in $(esxcli storage filesystem list |grep 'VMFS-6' |awk '{p…" ], "i": "objectives/impact/ransom/esxi::storage-filesystem-list", "l": 1 }, { "a": "T1082", "c": 0.4000000059604645, "d": "Query resource limits for process", "e": [ "GI_getrlimit", "getrlimit", "sym.__GI_getrlimit" ], "i": "micro-behaviors/process/resources/limits::getrlimit", "l": 2, "m": "E1082" }, { "c": 0.8999999761581421, "d": "ELF overall entropy is low", "e": [ "binary.overall_entropy = 4.08" ], "i": "metadata/binary/metrics::firmware-overall-entropy-low", "l": 1 }, { "c": 1.0, "d": "/dev/tty terminal device", "e": [ "/dev/tty" ], "i": "micro-behaviors/fs/path/device/terminal::dev-tty", "l": 2 }, { "d": "Truncate file", "e": [ "ftruncate64" ], "i": "micro-behaviors/fs/file/truncate::truncate", "l": 2 }, { "c": 0.949999988079071, "d": "MD5 hashing functions", "e": [ "MD5_Update", "MD5_Final", "MD5_Transform", "EVP_md5", "md5_block_data_order", "MD5_Init", "sym.EVP_md5", "sym.MD5_Update", "sym.MD5_Transform", "sym.MD5_Final", "sym.MD5_Init", "sym.md5_block_data_order" ], "i": "micro-behaviors/crypto/hash/digest::md5", "l": 2 }, { "c": 0.6000000238418579, "d": "Examine or change blocked signals", "e": [ "sigprocmask" ], "i": "micro-behaviors/process/terminate/signal::sigprocmask", "l": 2 }, { "c": 0.30000001192092896, "d": "Sleep for nanosecond duration", "e": [ "nanosleep" ], "i": "micro-behaviors/time/query::nanosleep-func", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": ".onion domain reference", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/infrastructure/domain::onion-domain", "l": 3, "m": "C0002" }, { "c": 0.75, "d": "String to long integer conversion (strtol)", "e": [ "strtol" ], "i": "micro-behaviors/data/string/conversion::strtol", "l": 1 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.699999988079071, "d": "PEM end marker", "e": [ "-----END CIPHERTEXT BLOCK-----", "-----END", "-----END PUBLIC KEY-----" ], "i": "micro-behaviors/crypto/certificate::pem-end", "l": 2 }, { "a": "T1057", "d": "Dev app vim", "e": [ "vim", "vim" ], "i": "micro-behaviors/process/enumerate/apps::dev-apps-vim", "l": 3, "m": "E1592" }, { "c": 1.0, "d": "ELF32 class marker", "e": [ "elf.class_bits = 32.00" ], "i": "objectives/anti-static/pack/detection::elf32-class", "l": 1 }, { "c": 0.699999988079071, "d": "X509_ function prefix", "e": [ "PEM_write_bio_X509_REQ", "X509_get_default_private_dir", "X509_REQ_INFO_seq_tt", "X509_get_default_cert_file", "X509_OBJECT_get0_X509", "X509_REQ_new", "X509_check_ca", "X509_REQ_delete_attr", "X509_VAL_new", "X509_STORE_CTX_new", "X509_str_functs", "PEM_write_bio_X509_CRL", "i2d_X509_REQ", "X509_NAME_ENTRY", "X509_add_ext", "X509_CINF" ], "i": "micro-behaviors/crypto/certificate::x509-prefix", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 1.0, "d": "/dev/null (legitimate discard device)", "e": [ "/dev/null", "vim-cmd vmsvc/snapshot.removeall %llu \u003e /dev/null 2\u003e\u00261", "…eroedthick $I/eztDisk \u003e /dev/null; vmkfstools -U $I/eztDi…", "…fstools -U $I/eztDisk \u003e /dev/null; done" ], "i": "micro-behaviors/fs/path/device::dev-null", "l": 2 }, { "c": 0.8500000238418579, "d": "VMFS buffer max capacity", "e": [ "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity" ], "i": "objectives/impact/ransom/esxi::buffer-cache-maxcapacity", "l": 3 }, { "a": "T1071.004", "c": 0.6600000262260437, "d": "Reads DNS resolver configuration", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/communications/dns/lookup::lookup-resolv", "l": 3, "m": "C0011" }, { "c": 1.0, "d": "Binary has 1000+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-1000", "l": 1 }, { "a": "T1005", "c": 0.4000000059604645, "d": "Seeks to position in file", "e": [ "fseeko", "GI_fseeko64", "GI_fseek", "fseeko64", "fseek", "sym.fseeko", "sym.__GI_fseeko64" ], "i": "micro-behaviors/fs/file/binary::fseek-func", "l": 2 }, { "c": 0.6600000262260437, "d": "Get CPU info from /proc/cpuinfo", "e": [ "Failed to open '/proc/cpuinfo'", "/proc/cpuinfo" ], "i": "micro-behaviors/fs/proc/system::system-cpuinfo", "l": 3 }, { "c": 1.0, "d": "ARM direct read(2) syscall", "e": [ "03 70 a0 e3 00 00 00 ef" ], "i": "micro-behaviors/os/syscall/invoke::svc-read", "l": 3 }, { "c": 0.30000001192092896, "d": "libcrypto library reference", "e": [ "common libcrypto routines" ], "i": "micro-behaviors/dylib/library/ssl::libcrypto-ref", "l": 2 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.08" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.6000000238418579, "d": "/boot directory reference", "e": [ "/boot/" ], "i": "micro-behaviors/fs/path/system::boot-dir", "l": 2 }, { "c": 0.8999999761581421, "d": "elasticsearch string", "e": [ "/var/lib/elasticsearch" ], "i": "micro-behaviors/data/db/conn/elasticsearch::elasticsearch-string", "l": 1 }, { "c": 0.8999999761581421, "d": "OpenSSL EVP encryption functions", "e": [ "EVP_CipherInit_ex", "EVP_EncryptInit_ex", "AES_cbc_encrypt", "AES_set_encrypt_key", "AES_set_encrypt_key" ], "i": "micro-behaviors/crypto/library::openssl-evp-encrypt", "l": 3 }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords::pipe", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1573", "c": 0.8799999952316284, "d": "X25519 key exchange marker", "e": [ "X25519" ], "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "l": 3, "m": "C0027" }, { "a": "T1574.006", "c": 0.800000011920929, "d": "Dynamic linker TLS allocation internal 1", "e": [ "_dl_allocate_tls_storage", "_dl_allocate_tls_init", "_dl_allocate_tls" ], "i": "objectives/evasion/hijack-execution-flow/linker::dl-allocate-tls-1", "l": 1, "m": "F0015" }, { "c": 0.8999999761581421, "d": "ESXi CLI tool", "e": [ "esxcli vm process kill -t force -w %llu", "for I in $(esxcli storage filesystem list…", "esxcli vm process list" ], "i": "objectives/impact/ransom/esxi::esxcli-tool", "l": 3 }, { "c": 0.8999999761581421, "d": "vm process kill command", "e": [ "esxcli vm process kill -t force -w %llu" ], "i": "objectives/impact/ransom/esxi::vm-process-kill", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool job add OOM error message", "e": [ "thpool_add_work(): Could not allocate memory for new job" ], "i": "objectives/impact/ransom/esxi::thpool-job-oom", "l": 1, "m": "C0027" }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Executes command and captures output", "e": [ "popen" ], "i": "micro-behaviors/process/create/popen::c-popen", "l": 3, "m": "E1059.004" }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "unknown control command", "command not supported", "ssl command section empty", "ssl command section not found", "control command failed" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.949999988079071, "d": "Reference to ESXi VM process kill commands", "e": [ "esxcli vm process kill" ], "i": "micro-behaviors/os/sysinfo/vmware::esxcli-vm-kill", "l": 4 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.6600000262260437, "d": "Rename files by fd/path", "e": [ "renameat" ], "i": "micro-behaviors/fs/file/rename::renameat", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 3227364.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.6000000238418579, "d": "RSA_public_decrypt reference", "e": [ "RSA_public_decrypt" ], "i": "micro-behaviors/crypto/asymmetric/rsa::rsa-public-decrypt", "l": 3 }, { "c": 0.6600000262260437, "d": "Uses getdents64", "e": [ "getdents64" ], "i": "micro-behaviors/fs/directory/readdir::readdir-getdents64", "l": 2 }, { "c": 0.6600000262260437, "d": "Parse IP with inet_pton", "e": [ "inet_pton" ], "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 29.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "a": "T1106", "c": 0.8999999761581421, "d": "execve system call symbol", "e": [ "execve" ], "i": "micro-behaviors/process/create/direct::execve-symbol", "l": 1 }, { "c": 0.8999999761581421, "d": "Reference to ESXi VM World ID", "e": [ "World ID:" ], "i": "micro-behaviors/os/sysinfo/vmware::vm-world-id", "l": 3 }, { "c": 0.30000001192092896, "d": "Sleep for specified duration", "e": [ "sleep" ], "i": "micro-behaviors/time/query::sleep-func", "l": 2 }, { "a": "T1082", "c": 0.4000000059604645, "d": "Query system configuration information", "e": [ "GI_sysconf", "sysconf", "sym.__GI_sysconf" ], "i": "micro-behaviors/os/sysinfo/config::sysconf", "l": 2, "m": "E1082" }, { "c": 0.949999988079071, "d": "SHA256 hashing functions", "e": [ "SHA256_Update", "SHA256_Final", "SHA256", "SHA256_Init" ], "i": "micro-behaviors/crypto/hash/digest::sha256", "l": 3 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 35740.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.800000011920929, "d": "Read file status and metadata (legacy 64-bit)", "e": [ "stat64", "lstat64", "fstat64" ], "i": "micro-behaviors/fs/file/stat::stat-legacy64", "l": 3 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher" ], "i": "micro-behaviors/crypto/library::cipher-keyword", "l": 2 }, { "d": "pthread threading library", "e": [ "pthread_create", "sym.pthread_create" ], "i": "micro-behaviors/process/threading::pthread", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "d": "POSIX \"Permission denied\" error message", "e": [ "Permission denied" ], "i": "micro-behaviors/os/message/error::permission-denied", "l": 2 }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "ZLIB", "zlib" ], "i": "micro-behaviors/dylib/library::zlib-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Interactive process monitors (htop/atop)", "e": [ "atop" ], "i": "micro-behaviors/os/sysinfo/performance/monitoring::htop-atop", "l": 2 }, { "c": 0.4000000059604645, "d": "Password hash or data", "e": [ "password_hash" ], "i": "objectives/evasion/kernel-hide/ebpf::password-string-direct-b", "l": 3 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt", "ENCRYPT", "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "fstat", "stat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "c": 0.800000011920929, "d": "RAND_bytes function", "e": [ "RAND_bytes" ], "i": "micro-behaviors/os/random::rand-bytes", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write", "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.699999988079071, "d": "/dev/random access", "e": [ "/dev/random" ], "i": "micro-behaviors/os/random::dev-random", "l": 2 }, { "d": "uClibc reference", "e": [ "uclibc", "uclibc", "uclibc", "uclibc", "uClibc", "uClibc", "uclibc", "uclibc", "uclibc", "__uclibc_", "__uclibc_", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc" ], "i": "micro-behaviors/dylib/library/libc::uclibc-ref", "l": 2 }, { "c": 0.8999999761581421, "d": "Simple VM termination message", "e": [ "Killing VM " ], "i": "micro-behaviors/os/sysinfo/vmware::killing-vm-simple", "l": 4 }, { "c": 0.6600000262260437, "d": "Open files (64-bit)", "e": [ "fopen64" ], "i": "micro-behaviors/fs/file/open::fopen64", "l": 2 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlink" ], "i": "micro-behaviors/fs/link/symlink::readlink", "l": 2 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "hexsecret", "secretary", "secret", "secretBag", "missing secret" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "c": 0.8999999761581421, "d": "Firmware platform marker", "e": [ "LEDE" ], "i": "micro-behaviors/hardware/flash/device::firmware-platform-marker", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.45" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.699999988079071, "d": "AES S-box start bytes", "e": [ "63 7C 77 7B F2 6B 6F C5" ], "i": "micro-behaviors/crypto/symmetric/aes::aes-sbox-bytes", "l": 3, "m": "C0021.001" }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "uclibc", "uclibc", "uclibc", "uclibc", "uClibc", "uClibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc", "uclibc" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 0.8500000238418579, "d": "Send signal to self", "e": [ "raise" ], "i": "micro-behaviors/os/signal/handler::raise", "l": 2 }, { "c": 0.800000011920929, "d": "C-style exec family functions", "e": [ "execl" ], "i": "micro-behaviors/process/create/execv::c-exec-variants", "l": 3 }, { "c": 1.0, "d": "torproject.org domain", "e": [ "1) Download tor browser: https://www.torproject.org/download/" ], "i": "objectives/impact/ransom/encrypt::torproject-domain", "l": 1 }, { "d": "Detect if running in terminal (isatty)", "e": [ "isatty", "GI_isatty", "sym.isatty" ], "i": "micro-behaviors/process/tty/terminal::isatty", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses fdopendir", "e": [ "fdopendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-fdopendir", "l": 2 }, { "c": 0.800000011920929, "d": "Read symbolic link target path", "e": [ "readlinkat" ], "i": "micro-behaviors/fs/link/symlink::readlinkat", "l": 2 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "Failed to read(\"/dev/urandom\"): %d (%s)", "/dev/urandom", "Failed to open(\"/dev/urandom\"): %d (%s)" ], "i": "micro-behaviors/os/random::urandom", "l": 2 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "c": 0.6600000262260437, "d": "Rename files", "e": [ "rename" ], "i": "micro-behaviors/fs/file/rename::rename-base", "l": 2 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "Lock memory pages (mlock)", "e": [ "mlock" ], "i": "micro-behaviors/mem/lock/pages::mlock", "l": 2 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/resolv.conf", "()*+/etc/TZ", "/etc/motd", "/etc/motd.template", "Failed to write to '/etc/motd'", "/etc/localtime" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "c": 0.699999988079071, "d": "Formatted input from file", "e": [ "vfscanf" ], "i": "micro-behaviors/fs/file/read::fscanf", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "prctl system call symbol", "e": [ "prctl" ], "i": "objectives/evasion/masquerade/identity::prctl-symbol", "l": 3, "m": "F0004" }, { "c": 0.699999988079071, "d": "PEM begin marker", "e": [ "-----BEGIN PUBLIC KEY-----", "-----BEGIN" ], "i": "micro-behaviors/crypto/certificate::pem-begin", "l": 2 }, { "c": 0.6600000262260437, "d": "Wait for child process state", "e": [ "waitpid" ], "i": "micro-behaviors/process/control/wait::waitpid", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.75, "d": "EVP_PKEY_derive function", "e": [ "EVP_PKEY_derive_init", "EVP_PKEY_derive_set_peer", "EVP_PKEY_derive" ], "i": "micro-behaviors/crypto/kdf::evp-pkey-derive", "l": 2 }, { "c": 0.800000011920929, "d": "vmkfstools command", "e": [ "vmkfstools", "vmkfstools", "vmkfstools", "vmkfstools" ], "i": "objectives/impact/ransom/esxi::vmkfstools-cmd", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP REQUEST method", "e": [ "REQUEST", "REQUEST" ], "i": "micro-behaviors/communications/http/request::request", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.20000000298023224, "d": "Format time as string", "e": [ "strftime", "sym.strftime" ], "i": "micro-behaviors/time/query::strftime", "l": 2 }, { "c": 0.800000011920929, "d": "esxcfg- tool prefix", "e": [ "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval" ], "i": "objectives/impact/ransom/esxi::esxcfg-prefix", "l": 1 }, { "a": "T1083", "c": 0.4000000059604645, "d": "Reference to /lib/ directory", "e": [ "/lib64/" ], "i": "micro-behaviors/fs/path/library::lib-path", "l": 2, "m": "E1083" }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords::payload", "l": 1 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "crypto/aes/aesv8-armx.S", "crypto/aes/aes_cbc.c", "crypto/aes", "crypto/aes/aes-armv4.S", "crypto/aes/bsaes-armv7.S" ], "i": "objectives/impact/ransom/encrypt::go-crypto-aes", "l": 1 }, { "c": 0.75, "d": "scrypt key derivation", "e": [ "scrypt", "scrypt", "scrypt" ], "i": "micro-behaviors/crypto/kdf::scrypt", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc/resolv.conf", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/fs/path/config::config-resolv", "l": 3 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "thread-pool", "threadpool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "/etc/localtime", "__GI_localtime_r", "time_localtime_tzi", "localtime.c", "GI_localtime_r", "_time_localtime_tzi.c", "localtime_r", "__GI_localtime", "GI_localtime", "__time_localtime_tzi", "localtime_r.c", "localtime" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2 }, { "a": "T1486", "c": 0.949999988079071, "d": "Thread pool SIGUSR1 handler error message", "e": [ "thread_do(): cannot handle SIGUSR1" ], "i": "objectives/impact/ransom/esxi::thpool-sigusr", "l": 1, "m": "C0027" }, { "c": 0.949999988079071, "d": "Tor onion domain handling", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/backdoor/binary/stealth::onion-domain-handling", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-200", "l": 1 }, { "c": 0.75, "d": "Large base64-like string (512+ chars)", "e": [ "f////0002/////00//////////////////00000/////00//////////////////00000/////00//////////////////00000/////00//////////////////0000" ], "i": "objectives/anti-static/obfuscation/payload::large-base64-string-dup", "l": 3 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 0.8500000238418579, "d": "VMFS buffer flush interval", "e": [ "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval" ], "i": "objectives/impact/ransom/esxi::buffer-cache-flushinterval", "l": 3 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses readdir64", "e": [ "readdir64" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir64", "l": 2 }, { "c": 0.20000000298023224, "d": "localtime function (symbol)", "e": [ "time_localtime_tzi", "localtime_r", "localtime", "GI_localtime", "GI_localtime_r", "sym.localtime", "sym.localtime_r", "sym.__time_localtime_tzi" ], "i": "micro-behaviors/time/query::localtime-symbol", "l": 2 }, { "c": 1.0, "d": ".onion address pattern", "e": [ "73drzy7olfr6qn2mgzavx2mdrfr2w47c3yo7x3urtfh4kgsj2sdx27id.onion" ], "i": "objectives/impact/ransom/encrypt::onion-address", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.08" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.949999988079071, "d": "SHA512 hashing functions", "e": [ "sha512_256_init", "EVP_sha512_256", "EVP_sha512", "SHA512_Update", "SHA512", "SHA512_Final", "sha512_block_data_order_neon", "SHA512_Transform", "sha512_224_init", "sha512_block_data_order", "EVP_sha512_224", "SHA512_Init", "sym.EVP_sha512_224", "sym.EVP_sha512_256", "sym.EVP_sha512", "sym.sha512_224_init" ], "i": "micro-behaviors/crypto/hash/digest::sha512", "l": 3 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 3227364.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "a": "T1083", "c": 0.4000000059604645, "d": "File descriptor manipulation and control", "e": [ "fcntl" ], "i": "micro-behaviors/fs/file/handle::fcntl", "l": 2, "m": "E1083" }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.6600000262260437, "d": "Unmap files from memory", "e": [ "GI_munmap", "munmap", "sym.__GI_munmap" ], "i": "micro-behaviors/fs/memory/mmap::munmap", "l": 2 }, { "c": 0.6600000262260437, "d": "Get system statistics from /proc/stat", "e": [ "/proc/stat" ], "i": "micro-behaviors/fs/proc/system::system-stat", "l": 3 }, { "c": 0.9399999976158142, "d": "AES-256-CTR cipher marker", "e": [ "AES-256-CTR", "aes-256-ctr" ], "i": "micro-behaviors/crypto/symmetric/aes/ctr::aes-256-ctr-term", "l": 3, "m": "C0021.001" }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v2 onion address (deprecated)", "e": [ "tfh4kgsj2sdx27id.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v2", "l": 3, "m": "C0026" }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa/rsa_ossl.c", "crypto/rsa/rsa_gen.c", "crypto/rsa/rsa_chk.c", "crypto/rsa", "crypto/rsa/rsa_asn1.c", "crypto/rsa/rsa_ssl.c", "crypto/rsa/rsa_oaep.c", "crypto/rsa/rsa_crpt.c", "crypto/rsa/rsa_err.c", "crypto/rsa/rsa_sign.c", "crypto/rsa/rsa_ameth.c", "crypto/rsa/rsa_none.c", "crypto/rsa/rsa_x931.c", "crypto/rsa/rsa_saos.c", "crypto/rsa/rsa_pmeth.c", "crypto/rsa/rsa_lib.c" ], "i": "objectives/impact/ransom/encrypt::go-crypto-rsa", "l": 1 }, { "d": "overflow keyword", "e": [ "random pool overflow", "output would overflow" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "c": 0.30000001192092896, "d": "Sleep for microsecond duration", "e": [ "usleep" ], "i": "micro-behaviors/time/query::usleep-func", "l": 2 }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "UI_get0_output_string", "asn1_output_data", "Failed to open log file '%s' (%d: %s). Falling back to console output", "output would overflow", "Input/output error" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "c": 0.800000011920929, "d": "CRYPTOGAMS OpenSSL support marker", "e": [ "GHASH for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "GHASH for ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA1 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA256 block transform for ARMv4/NEON/ARMv8, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "SHA512 block transform for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "AES for ARMv4, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "Montgomery multiplication for ARMv4/NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e", "Bit-sliced AES for NEON, CRYPTOGAMS by \u003cappro@openssl.org\u003e" ], "i": "micro-behaviors/crypto/library::cryptogams-marker", "l": 2 }, { "c": 0.8500000238418579, "d": "Creates eagerzeroedthick disk", "e": [ "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk; vmkfstools …", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk \u003e /dev/null;…" ], "i": "objectives/impact/ransom/esxi::eagerzeroedthick-disk", "l": 3 }, { "a": "T1082", "c": 0.699999988079071, "d": "Access CPU info via /sys/devices", "e": [ "/sys/devices/system/cpu" ], "i": "micro-behaviors/os/sysinfo/cpu::sys-devices", "l": 3 }, { "c": 0.800000011920929, "d": "Password command-line argument", "e": [ "--password", "--password" ], "i": "micro-behaviors/process/argument/credential::password-required-flag", "l": 1 }, { "c": 0.8500000238418579, "d": "Reference to ESXi VM process list command", "e": [ "esxcli vm process list" ], "i": "micro-behaviors/os/sysinfo/vmware::esxcli-vm-list", "l": 3 }, { "c": 0.949999988079071, "d": "OpenSSL EVP API symbols", "e": [ "EVP_EncryptInit" ], "i": "well-known/lib/openssl::openssl-evp-api", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 3397.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "a": "T1059.004", "c": 0.6499999761581421, "d": "References /bin/sh in binary", "e": [ "/bin/sh" ], "i": "micro-behaviors/process/create/shell/encoded::bin-sh-binary-text", "l": 3, "m": "E1059.004" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "Password is not" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1011", "c": 0.699999988079071, "d": "Raw socket terminology", "e": [ "RAW_SOCKET" ], "i": "micro-behaviors/communications/socket/raw::raw-socket-ref", "l": 1, "m": "C0001" }, { "a": "T1497.001", "d": "VirtualBox string detection", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/emulator-detect::virtualbox-word", "l": 1, "m": "B0009" }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "unlink" ], "i": "micro-behaviors/fs/file/delete::unlink", "l": 3 }, { "c": 0.75, "d": "PBKDF2 key derivation", "e": [ "PBKDF2", "PKCS5_v2_PBKDF2_keyivgen", "pbkdf2 error", "PKCS5_pbkdf2_set", "PBKDF2PARAM", "PBKDF2PARAM_free", "PBKDF2PARAM_it", "PBKDF2PARAM_new", "PBKDF2PARAM_st", "d2i_PBKDF2PARAM", "PBKDF2PARAM_seq_tt", "i2d_PBKDF2PARAM", "PKCS5_PBKDF2_HMAC", "PKCS5_PBKDF2_HMAC_SHA1" ], "i": "micro-behaviors/crypto/kdf::pbkdf2", "l": 3 }, { "a": "T1059", "c": 0.75, "d": "Get terminal attributes", "e": [ "GI_tcgetattr", "tcgetattr", "sym.__GI_tcgetattr" ], "i": "micro-behaviors/process/tty/pty::tcgetattr", "l": 3 }, { "a": "T1059", "c": 0.75, "d": "Set terminal attributes", "e": [ "tcsetattr", "GI_tcsetattr", "sym.tcsetattr" ], "i": "micro-behaviors/process/tty/pty::tcsetattr", "l": 3 }, { "c": 0.949999988079071, "d": "ChaCha20/Salsa20 cipher constant", "e": [ "expand 32-byte k" ], "i": "micro-behaviors/crypto/symmetric/stream::chacha-salsa-constant", "l": 3 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 4806.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 4806.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 12400.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1562", "c": 0.6000000238418579, "d": "Send signal to process", "e": [ "kill" ], "i": "micro-behaviors/process/terminate/signal::kill", "l": 3, "m": "E1562" }, { "a": "T1140", "c": 0.800000011920929, "d": "Large base64 encoded payload", "e": [ "f////0002/////00//////////////////00000/////00//////////////////00000/////00//////////////////00000/////00//////////////////0000" ], "i": "micro-behaviors/data/encode/payload::large-base64-payload", "l": 3, "m": "C0043" }, { "a": "T1106", "c": 0.8999999761581421, "d": "Direct execve program execution", "e": [ "execve" ], "i": "micro-behaviors/process/create/direct::execve-import", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 4806.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.949999988079071, "d": "SHA1 hashing functions", "e": [ "SHA1_Update", "SHA1_Final", "SHA1_Init" ], "i": "micro-behaviors/crypto/hash/digest::sha1", "l": 3 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 3227364.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "cassandra string", "e": [ "cassandra" ], "i": "micro-behaviors/data/db/conn/cassandra::cassandra-string", "l": 3 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "fstat", "stat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 }, { "a": "T1497.001", "c": 0.6000000238418579, "d": "VirtualBox hypervisor vendor string", "e": [ "virtualbox" ], "i": "objectives/anti-analysis/vm-detect::vendor-virtualbox", "l": 1 }, { "c": 0.8999999761581421, "d": "OpenSSL ChaCha20-Poly1305", "e": [ "ChaCha20-Poly1305" ], "i": "objectives/command-and-control/backdoor/binary/stealth::openssl-chacha-poly", "l": 3, "m": "B0030" }, { "c": 0.30000001192092896, "d": "Full daemon behavior (fork + setsid + devnull)", "e": [ "…eroedthick $I/eztDisk \u003e /dev/null; vmkfstools -U $I/eztDi…", "clone", "…fstools -U $I/eztDisk \u003e /dev/null; done", "GI_vfork", "GI_fork", "/dev/null", "sym.__clone", "fork", "vim-cmd vmsvc/snapshot.removeall %llu \u003e /dev/null 2\u003e\u00261", "vfork", "setsid" ], "i": "micro-behaviors/process/daemonize::full-daemon", "l": 2 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "X509_get_default_private_dir", "X509_REQ_INFO_seq_tt", "X509_CINF", "X509_check_ca", "PEM_write_bio_X509_CRL", "i2d_X509_REQ", "X509_OBJECT_get0_X509", "X509_VAL_new", "X509_REQ_delete_attr", "X509_REQ_new", "X509_NAME_ENTRY", "X509_STORE_CTX_new", "X509_add_ext", "PEM_write_bio_X509_REQ", "X509_str_functs", "X509_get_default_cert_file" ], "i": "micro-behaviors/crypto/certificate::certificate-handling", "l": 2 }, { "c": 0.9300000071525574, "d": "ESXi storage pre-encryption prep", "e": [ "vmkfstools", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk; vmkfstools …", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval", "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "…do vmkfstools -c 10M -d eagerzeroedthick $I/eztDisk \u003e /dev/null;…" ], "i": "objectives/impact/ransom/esxi::storage-pre-encryption-prep", "l": 4 }, { "a": "T1486", "c": 0.800000011920929, "d": "ESXi CLI tools for attack", "e": [ "vim-cmd", "esxcfg-advcfg -s 32768 /BufferCache/MaxCapacity", "esxcfg-advcfg -s 20000 /BufferCache/FlushInterval", "for I in $(esxcli storage filesystem list…", "vmkfstools", "esxcli vm process list", "esxcli vm process kill -t force -w %llu" ], "i": "objectives/impact/ransom/esxi::cli-tools", "l": 3, "m": "C0027" }, { "a": "T1005", "c": 0.75, "d": "File content manipulation (read/write/seek)", "e": [ "sym.__GI_fseeko64", "sym.fseeko", "fseeko64", "fwrite", "write", "fseek", "GI_fseek", "GI_fseeko64", "fseeko" ], "i": "micro-behaviors/fs/file/binary::file-manipulation", "l": 3 }, { "c": 0.8500000238418579, "d": "Documented command line program", "e": [ "binary.function_count = 4806.00", "binary.string_count = 12400.00", "Usage:\n\t%s OPTION ...\n\nOPTIONS…" ], "i": "metadata/package/help::documented-cli-binary", "l": 1 }, { "a": "T1543", "c": 0.75, "d": "Unix daemon persistence mechanism", "e": [ "fork", "sym.__clone", "clone", "vfork", "GI_fork", "GI_vfork", "setsid" ], "i": "objectives/persistence/system/daemon/init::unix-daemon-persistence", "l": 1, "m": "F0006" }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 3 }, { "a": "T1497.003", "d": "Timing measurement with delays (sandbox/VM", "e": [ "gettimeofday", "sleep", "nanosleep", "usleep" ], "i": "objectives/anti-analysis/timing/evasion::timing-evasion", "l": 3, "m": "B0003.005" }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 32.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 3 }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 4806.00", "binary.overall_entropy = 4.08", "binary.export_count = 3397.00" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "c": 0.8999999761581421, "d": "Executes shell command and captures", "e": [ "fgets", "popen" ], "i": "micro-behaviors/process/create/shell::capture-command-output", "l": 1 }, { "a": "T1069", "c": 0.699999988079071, "d": "User/group ID gathering", "e": [ "getgid", "getegid", "geteuid" ], "i": "objectives/discovery/host/permissions::uid-gid-gathering", "l": 1 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "elf.class_bits = 32.00", "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::static-linked", "l": 3 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "VM detection via vendor/product strings", "e": [ "virtualbox", "qemu" ], "i": "objectives/anti-analysis/emulator-detect/heuristics::detect-vendors", "l": 4, "m": "B0009" } ], "sha": "55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea", "path": "/data/samples/bad/datasets/malware-souk/corpus/Qilin/samples/55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea.zip!!55ee6bb3deb3385052d7f57e6a48c3c5bba0f558f0d17653908550ffe37e1bea", "type": "elf" } ], "tv": "96b0e" } }