{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.27968338, "class": 0 }, { "m": "az/elf", "prob": 0.15384616, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T05:19:42Z" }, "path": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf", "raw": { "v": "5", "fs": [ { "f": "H₂(Cm₃F)", "x": 8, "ff": { "i": [ [ "", "errno_location" ], [ "", "getaddrinfo" ], [ "", "free" ], [ "", "freeaddrinfo" ], [ "", "gai_strerror" ], [ "", "stderr" ], [ "", "fwrite" ], [ "", "vfprintf_chk" ], [ "", "fputc" ], [ "", "abort" ], [ "", "pthread_mutex_lock" ], [ "", "pthread_cond_wait" ], [ "", "pthread_mutex_unlock" ], [ "", "pthread_key_create" ], [ "", "fprintf_chk" ], [ "", "pthread_setspecific" ], [ "", "pthread_cond_broadcast" ], [ "", "pthread_create" ], [ "", "nanosleep" ], [ "", "pthread_attr_init" ], [ "", "pthread_attr_setdetachstate" ], [ "", "strerror" ], [ "", "malloc" ], [ "", "sigfillset" ], [ "", "pthread_sigmask" ], [ "", "pthread_attr_getstacksize" ], [ "", "mmap" ], [ "", "munmap" ], [ "", "setenv" ], [ "", "unsetenv" ], [ "", "sigemptyset" ], [ "", "sigaddset" ], [ "", "sigaction" ], [ "", "sigismember" ], [ "", "pthread_self" ], [ "", "pthread_getattr_np" ], [ "", "pthread_attr_getstack" ], [ "", "pthread_attr_destroy" ] ], "m": { "elf": { "bits": 64.0, "entry": 4708576.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "has_symtab": 1.0, "note_count": 1.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 42.0, "has_eh_frame": 0.0, "symtab_count": 3656.0, "dynrela_count": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 0.0, "pltreloc_count": 37.0, "dt_versym_count": 42.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "debug_section_count": 8.0, "hidden_symbol_count": 9.0, "fortify_source_count": 2.0, "program_header_count": 9.0, "gnu_stack_section_absent": 0.0, "compressed_sections_count": 7.0, "load_segment_max_file_size": 1223592.0, "stripped_but_symtab_present": 1.0, "load_segment_max_memory_size": 1223592.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 3.0 }, "file": { "size": 3361829.0, "entropy": 6.82, "size_bytes": 3361829.0 }, "binary": { "is_pie": 0.0, "is_stripped": 0.0, "code_entropy": 6.18, "data_entropy": 4.1, "string_count": 19545.0, "entropy_variance": 5.46, "avg_string_length": 12.29, "max_string_length": 41549.0, "code_to_data_ratio": 0.95, "string_length_stddev": 297.36, "largest_section_ratio": 0.29, "sentence_string_count": 938.0, "sentence_string_ratio": 0.05, "high_entropy_string_count": 0.0 }, "exports": { "count": 3.0 }, "imports": { "count": 38.0 }, "sections": { "count": 39.0, "code_size": 980017.0, "entropy_max": 8.0, "entropy_mean": 4.42, "name_entropy": 4.23, "writable_count": 10.0, "executable_count": 2.0, "nonstandard_count": 21.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 1.0 } }, "s": [ [ 3948, "u8", "US6xptbuybSQCXzROoyp/d_NVv6q4W0tKRtClLTCB/N_XOHbItI_vKR83Kl8YG/TprQFVxDlWNNi47qoUkl" ], [ 4068, "u8", "/lib64/ld-linux-x86-64.so.2" ], [ 4228, "u8", "ATUSH" ], [ 5316, "u8", "ATUH" ], [ 9479, "u8", "onuzH" ], [ 13099, "u8", "P98S9" ], [ 13120, "u8", "H9PH" ], [ 13132, "u8", "PPH9SP" ], [ 13163, "u8", "PY8SY" ], [ 14465, "u8", "oO f" ], [ 21097, "u8", "/proc/seH" ], [ 21112, "u8", "roc/selfH" ], [ 21127, "u8", "/cgroup" ], [ 22947, "u8", "9cpu" ], [ 23167, "u8", "/self/moH" ], [ 23182, "u8", "untinfo" ], [ 24483, "u8", "cgrou" ], [ 24499, "u8", "upt9H" ], [ 24595, "u8", "upuNG" ], [ 26278, "u8", "P H9" ], [ 26479, "u8", "V H9" ], [ 54825, "u8", "expafH" ], [ 54870, "u8", "te kfH" ], [ 67987, "u8", "Q8H9Q" ], [ 74357, "u8", "debugCal" ], [ 74472, "u8", "l128" ], [ 74490, "u8", "l256f" ], [ 74514, "u8", "l512" ], [ 74554, "u8", "debugCalH9" ], [ 74570, "u8", "l102u" ], [ 74604, "u8", "l204" ], [ 74656, "u8", "l409u" ], [ 74665, "u8", "6tzH9" ], [ 74681, "u8", "l819um" ], [ 74722, "u8", "l163u" ], [ 74749, "u8", "l327u" ], [ 74776, "u8", "l655u" ], [ 74804, "u8", "runtime." ], [ 77589, "u8", "runtime H" ], [ 83622, "u8", "/dev/nulH" ], [ 84500, "u8", "retZH" ], [ 84784, "u8", "L3H L" ], [ 98447, "u8", "y2f9" ], [ 102241, "u8", "L$(H)" ], [ 107415, "u8", "H9Bpw" ], [ 109464, "u8", "p2f9" ], [ 112896, "u8", "f9q2" ], [ 151093, "u8", "HcPDH" ], [ 173090, "u8", "RXH9" ], [ 174024, "u8", "8ofu" ], [ 179637, "u8", "UUUUUUUUH" ], [ 179687, "u8", "wwwwwwwwH" ], [ 180551, "u8", "vDH95X" ], [ 187182, "u8", "D9BX" ], [ 191793, "u8", "P2H9" ], [ 196907, "u8", "H9Apw" ], [ 223853, "u8", "t$(H)" ], [ 230312, "u8", "tdM9J" ], [ 230476, "u8", "tWH9z" ], [ 252520, "u8", "runtime.H9" ], [ 255732, "u8", "QpM9Qhu" ], [ 260048, "u8", "rFI9x" ], [ 269004, "u8", "reflect.H9" ], [ 270530, "u8", "u9z7f" ], [ 283828, "u8", "/s7H" ], [ 287489, "u8", "Q0H9" ], [ 309967, "u8", "H92t9H9rHt3H" ], [ 310214, "u8", "rhH92w" ], [ 336733, "u8", "x(D)" ], [ 339955, "u8", "L9YPA" ], [ 346079, "u8", "memprofiL9" ], [ 346105, "u8", "teu H" ], [ 347776, "u8", "H9APt" ], [ 351059, "u8", "H9GP" ], [ 354635, "u8", "T$(H)" ], [ 357046, "u8", "09z0w" ], [ 357411, "u8", "tMH9Z" ], [ 357449, "u8", "GH9Z" ], [ 358181, "u8", "AMVS" ], [ 373282, "u8", "HPH9" ], [ 373735, "u8", "ZPH9" ], [ 378353, "u8", "N0H9" ], [ 385573, "u8", "A H9" ], [ 386317, "u8", "C H9" ], [ 392807, "u8", "H9Xhu" ], [ 396323, "u8", "6H9FH" ], [ 398432, "u8", "H9AH" ], [ 400577, "u8", "H9FH" ], [ 413103, "u8", "gopau/f" ], [ 419576, "u8", "gopau" ], [ 419675, "u8", "runtime.H" ], [ 419830, "u8", "runtime.H90@" ], [ 430282, "u8", "H9J8" ], [ 482865, "u8", "8alu" ], [ 482888, "u8", "8weui" ], [ 482908, "u8", "8noneuS1" ], [ 482926, "u8", "8crasuA" ], [ 482953, "u8", "8singu" ], [ 482976, "u8", "8systu" ], [ 497948, "u8", "oxpfD" ], [ 499844, "u8", "Genuu" ], [ 499852, "u8", "ineIu" ], [ 499860, "u8", "ntelu" ], [ 507977, "u8", "D$(H)" ], [ 513503, "u8", "ofpL1" ], [ 521815, "u8", "H18K1" ], [ 521932, "u8", "PXH9SX" ], [ 539736, "u8", "P0H9" ], [ 544010, "u8", "r[H)" ], [ 545819, "u8", "\\$(H)" ], [ 547304, "u8", "JXH9" ], [ 550607, "u8", "80urH" ], [ 588554, "u8", "reflect." ], [ 602433, "u8", "IHH9KH" ], [ 618242, "u8", "[bisect-H" ], [ 627025, "u8", "H H9K" ], [ 647722, "u8", "time.DatH" ], [ 648623, "u8", "time.LocL" ], [ 648723, "u8", "time.LocH" ], [ 648737, "u8", "ocation(H" ], [ 649078, "u8", "time.UTCL" ], [ 667347, "u8", "H9XP" ], [ 674076, "u8", "twLk" ], [ 683588, "u8", ".zipu" ], [ 686820, "u8", "tzdau0" ], [ 689641, "u8", "/etc/locH" ], [ 689662, "u8", "altiuCf" ], [ 690657, "u8", "-07:00:0" ], [ 691045, "u8", "Mondu" ], [ 691459, "u8", "Z070u" ], [ 692930, "u8", "2006t" ], [ 749716, "u8", "(BADINDEI" ], [ 750132, "u8", "(MISSINGI" ], [ 792007, "u8", "7::ff" ], [ 794411, "u8", "tQI9z" ], [ 840963, "u8", "rZwMD" ], [ 843040, "u8", "ptEf" ], [ 847592, "u8", "8cgu" ], [ 848065, "u8", "9gotRH" ], [ 848078, "u8", "9cgu" ], [ 849132, "u8", "8ioupA" ], [ 849160, "u8", "8planuRA" ], [ 849184, "u8", "8andru" ], [ 849209, "u8", "8windf" ], [ 849492, "u8", "8open" ], [ 849639, "u8", "9fileu" ], [ 849716, "u8", "9bindu" ], [ 850683, "u8", "myhostnaL9" ], [ 851658, "u8", "9dnu" ], [ 852113, "u8", "notfoundL9" ], [ 852128, "u8", "tryagainL9\u0026" ], [ 852192, "u8", "9retuu" ], [ 854691, "u8", "ipu3" ], [ 854915, "u8", "9tcu" ], [ 854964, "u8", "9tcp4tY" ], [ 854972, "u8", "9tcp6tQ" ], [ 854982, "u8", "9udp4tG" ], [ 854998, "u8", "9unixt7" ], [ 855016, "u8", "unixgramH9" ], [ 855039, "u8", "unixpackH9" ], [ 855623, "u8", "8unix" ], [ 855648, "u8", "unixgramL9" ], [ 855692, "u8", "unixpackL9" ], [ 855806, "u8", "etueH" ], [ 855987, "u8", "9dial" ], [ 884019, "u8", "CNAM" ], [ 891090, "u8", "8opti" ], [ 891163, "u8", "nameservI9" ], [ 891636, "u8", "8doma" ], [ 891864, "u8", "8lookuYfA" ], [ 891876, "u8", "upuPH" ], [ 891962, "u8", "8sear" ], [ 891975, "u8", "chuoH" ], [ 892755, "u8", "timeout:H98A" ], [ 892967, "u8", "8rotau2f" ], [ 892997, "u8", "single-rL" ], [ 893048, "u8", "equeu" ], [ 893071, "u8", "single-rH" ], [ 893140, "u8", "single-r" ], [ 893213, "u8", "8usevu" ], [ 893337, "u8", "trust-adu'" ], [ 893348, "u8", "8ednsu" ], [ 893439, "u8", "no-reloaL" ], [ 914223, "u8", "ptTf" ], [ 914808, "u8", "ptAf" ], [ 916237, "u8", "ptBf" ], [ 919582, "u8", "8tcu" ], [ 919628, "u8", "8tcp6uXH" ], [ 919671, "u8", "8udp4t" ], [ 924161, "u8", "ptHfA" ], [ 929576, "u8", "ptu5H" ], [ 946135, "u8", "unixpack" ], [ 947801, "u8", "ettZL" ], [ 958169, "u8", "9unixf" ], [ 958197, "u8", "unixgram" ], [ 958802, "u8", "listuUfA" ], [ 961320, "u8", "HcD$ H" ], [ 981177, "u8", "CNXN" ], [ 981317, "u8", "8CNXN" ], [ 982204, "u8", "OPEN" ], [ 983017, "u8", "CLSE" ], [ 1470529, "u8", "crosscall2" ], [ 1470540, "u8", "_cgo_panic" ], [ 1470551, "u8", "_cgo_topofstack" ], [ 1470577, "u8", "__errno_location" ], [ 1470594, "u8", "getaddrinfo" ], [ 1470606, "u8", "free" ], [ 1470611, "u8", "freeaddrinfo" ], [ 1470624, "u8", "gai_strerror" ], [ 1470637, "u8", "stderr" ], [ 1470644, "u8", "fwrite" ], [ 1470651, "u8", "__vfprintf_chk" ], [ 1470672, "u8", "abort" ], [ 1470678, "u8", "pthread_mutex_lock" ], [ 1470697, "u8", "pthread_cond_wait" ], [ 1470715, "u8", "pthread_mutex_unlock" ], [ 1470736, "u8", "pthread_key_create" ], [ 1470755, "u8", "__fprintf_chk" ], [ 1470769, "u8", "pthread_setspecific" ], [ 1470789, "u8", "pthread_cond_broadcast" ], [ 1470812, "u8", "pthread_create" ], [ 1470827, "u8", "nanosleep" ], [ 1470837, "u8", "pthread_attr_init" ], [ 1470855, "u8", "pthread_attr_setdetachstate" ], [ 1470883, "u8", "strerror" ], [ 1470892, "u8", "malloc" ], [ 1470899, "u8", "sigfillset" ], [ 1470910, "u8", "pthread_sigmask" ], [ 1470926, "u8", "pthread_attr_getstacksize" ], [ 1470957, "u8", "munmap" ], [ 1470964, "u8", "setenv" ], [ 1470971, "u8", "unsetenv" ], [ 1470980, "u8", "sigemptyset" ], [ 1470992, "u8", "sigaddset" ], [ 1471002, "u8", "sigaction" ], [ 1471012, "u8", "sigismember" ], [ 1471024, "u8", "pthread_self" ], [ 1471037, "u8", "pthread_getattr_np" ], [ 1471056, "u8", "pthread_attr_getstack" ], [ 1471078, "u8", "pthread_attr_destroy" ], [ 1471109, "u8", "GLIBC_2.34" ], [ 1471120, "u8", "GLIBC_2.32" ], [ 2211841, "u8", "Go buildinf:" ], [ 2211899, "u8", "path\tcommand-line-arguments" ], [ 2211927, "u8", "build\t-buildmode=exe" ], [ 2211948, "u8", "build\t-compiler=gc" ], [ 2211967, "u8", "build\tCGO_ENABLED=1" ], [ 2211987, "u8", "build\tCGO_CFLAGS=" ], [ 2212005, "u8", "build\tCGO_CPPFLAGS=" ], [ 2212025, "u8", "build\tCGO_CXXFLAGS=" ], [ 2212045, "u8", "build\tCGO_LDFLAGS=" ], [ 2212064, "u8", "build\tGOARCH=amd64" ], [ 2212083, "u8", "build\tGOOS=linux" ], [ 2212100, "u8", "build\tGOAMD64=v1" ], [ 2212161, "u8", "Go fipsinfo" ], [ 2213272, "u8", "/dev/urandom" ] ], "v": { "elf.type": "executable", "elf.class": "elf64", "elf.entry": 4708576, "file.stem": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd", "elf.endian": "little", "go.go_root": "/snap/go/11048", "go.version": "go1.25.6", "elf.go.path": "command-line-arguments", "elf.machine": "x86_64", "elf.version": 1, "go.build_id": "US6xptbuybSQCXzROoyp/d_NVv6q4W0tKRtClLTCB/N_XOHbItI_vKR83Kl8YG/TprQFVxDlWNNi47qoUkl", "go.build.cgo": true, "go.main_root": "/root/exploits", "elf.needed[0]": "libc.so.6", "file.basename": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf", "go.build.goos": "linux", "go.build.mode": "exe", "elf.go.version": "go1.25.6", "elf.interpreter": "/lib64/ld-linux-x86-64.so.2", "go.build.goarch": "amd64", "go.build.goamd64": "v1", "binary.fortify[0]": "fprintf", "binary.fortify[1]": "vfprintf", "elf.entry_section": ".text", "go.build.compiler": "gc", "elf.hashes.imphash": "977e62c9eca237083e6ab0864f5b0240", "elf.hashes.symhash": "977e62c9eca237083e6ab0864f5b0240", "elf.hashes.dyn_hash": "3cd5dd33c6e5751a42fbdece4c763267", "elf.segments[0].type": "phdr", "elf.segments[1].type": "interp", "elf.segments[2].type": "note", "elf.segments[3].type": "load", "elf.segments[4].type": "load", "elf.segments[5].type": "load", "elf.segments[6].type": "dynamic", "elf.segments[7].type": "tls", "elf.segments[8].type": "gnu_stack", "elf.segments[0].perms": "r--", "elf.segments[0].vaddr": 4194368, "elf.segments[1].perms": "r--", "elf.segments[1].vaddr": 4198372, "elf.segments[2].perms": "r--", "elf.segments[2].vaddr": 4198236, "elf.segments[3].perms": "r-x", "elf.segments[3].vaddr": 4194304, "elf.segments[4].perms": "r--", "elf.segments[4].vaddr": 5181440, "elf.segments[5].perms": "rw-", "elf.segments[5].vaddr": 6406144, "elf.segments[6].perms": "rw-", "elf.segments[6].vaddr": 6406592, "elf.segments[7].perms": "r--", "elf.segments[8].perms": "rw-", "build.toolchain_family": "go", "elf.hashes.export_hash": "a4436763835753a7c2e049a27027b56f", "elf.needed_versions[0]": "libc.so.6@GLIBC_2.34", "elf.needed_versions[1]": "libc.so.6@GLIBC_2.32", "elf.needed_versions[2]": "libc.so.6@GLIBC_2.3.2", "elf.needed_versions[3]": "libc.so.6@GLIBC_2.3.4", "elf.needed_versions[4]": "libc.so.6@GLIBC_2.2.5", "build.toolchain.version": "1.25.6", "build.toolchain.compiler": "go", "elf.segments[0].file_size": 504, "elf.segments[0].flags_hex": "4", "elf.segments[1].file_size": 28, "elf.segments[1].flags_hex": "4", "elf.segments[2].file_size": 100, "elf.segments[2].flags_hex": "4", "elf.segments[3].file_size": 984128, "elf.segments[3].flags_hex": "5", "elf.segments[4].file_size": 1223592, "elf.segments[4].flags_hex": "4", "elf.segments[5].file_size": 47424, "elf.segments[5].flags_hex": "6", "elf.segments[6].file_size": 304, "elf.segments[6].flags_hex": "6", "elf.segments[7].flags_hex": "4", "elf.segments[8].flags_hex": "6", "elf.go.build_settings.GOOS": "linux", "elf.segments[0].file_offset": 64, "elf.segments[0].memory_size": 504, "elf.segments[1].file_offset": 4068, "elf.segments[1].memory_size": 28, "elf.segments[2].file_offset": 3932, "elf.segments[2].memory_size": 100, "elf.segments[3].memory_size": 984128, "elf.segments[4].file_offset": 987136, "elf.segments[4].memory_size": 1223592, "elf.segments[5].file_offset": 2211840, "elf.segments[5].memory_size": 265888, "elf.segments[6].file_offset": 2212288, "elf.segments[6].memory_size": 304, "elf.segments[7].memory_size": 8, "elf.symbol_kinds.types.file": 1, "elf.symbol_kinds.types.func": 2783, "elf.go.build_settings.GOARCH": "amd64", "elf.go.build_settings.GOAMD64": "v1", "elf.symbol_kinds.types.notype": 40, "elf.symbol_kinds.types.object": 874, "elf.go.build_settings.-compiler": "gc", "elf.symbol_kinds.bindings.local": 156, "elf.go.build_settings.-buildmode": "exe", "elf.symbol_kinds.bindings.global": 3542, "elf.go.build_settings.CGO_ENABLED": "1", "elf.stripped_metadata_sections[0]": ".comment", "elf.stripped_metadata_sections[1]": ".debug_str", "elf.stripped_metadata_sections[2]": ".note.gnu.gold-version", "elf.symbol_kinds.visibility.hidden": 9, "elf.symbol_kinds.visibility.default": 3689, "elf.relocation_kinds.R_X86_64_GLOB_DAT": 1, "elf.relocation_kinds.R_X86_64_JUMP_SLOT": 37 }, "x": [ [ "crosscall2" ], [ "cgo_panic" ], [ "cgo_topofstack" ] ], "id": "elf", "sc": [ [ ".text", 4096, 979409, 0.0, "alloc,executable" ], [ ".plt", 983520, 608, 0.0, "alloc,executable" ], [ ".rodata", 987136, 482036, 0.0, "alloc" ], [ ".rela", 1469176, 24, 0.0, "alloc" ], [ ".rela.plt", 1469200, 888, 0.0, "alloc" ], [ ".gnu.version", 1470112, 84, 0.0, "alloc" ], [ ".gnu.version_r", 1470208, 96, 0.0, "alloc" ], [ ".hash", 1470304, 204, 0.0, "alloc" ], [ ".dynstr", 1470528, 639, 0.0, "alloc" ], [ ".dynsym", 1471168, 1008, 0.0, "alloc" ], [ ".typelink", 1472192, 3300, 0.0, "alloc" ], [ ".itablink", 1475520, 560, 0.0, "alloc" ], [ ".gopclntab", 1476096, 734632, 0.0, "alloc" ], [ ".go.buildinfo", 2211840, 304, 0.0, "write,alloc" ], [ ".go.fipsinfo", 2212160, 120, 0.0, "write,alloc" ], [ ".dynamic", 2212288, 304, 0.0, "write,alloc" ], [ ".got.plt", 2212608, 320, 0.0, "write,alloc" ], [ ".got", 2212928, 8, 0.0, "write,alloc" ], [ ".noptrdata", 2212960, 20386, 0.0, "write,alloc" ], [ ".data", 2233376, 25874, 0.0, "write,alloc" ], [ ".debug_abbrev", 2260992, 352, 0.0, "" ], [ ".debug_line", 2261344, 220571, 0.0, "" ], [ ".debug_frame", 2481915, 44542, 0.0, "" ], [ ".debug_gdb_scripts", 2526457, 43, 0.0, "" ], [ ".debug_info", 2526500, 381806, 0.0, "" ], [ ".debug_loclists", 2908306, 173985, 0.0, "" ], [ ".debug_rnglists", 3082291, 89032, 0.0, "" ], [ ".debug_addr", 3171323, 5655, 0.0, "" ], [ ".interp", 4068, 28, 0.0, "alloc" ], [ ".note.gnu.build-id", 4032, 36, 0.0, "alloc" ], [ ".note.go.buildid", 3932, 100, 0.0, "alloc" ], [ ".shstrtab", 3361396, 433, 0.0, "" ], [ ".symtab", 3176984, 87744, 0.0, "" ], [ ".strtab", 3264728, 96668, 0.0, "" ] ] }, "id": 0, "sz": 3361829, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1, "el": [ "0x52efad" ] }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2, "el": [ "value:elf.interpreter" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking/static::elf-dynsym-section-name", "l": 2, "el": [ "0x334be4" ] }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking/static::elf-interpreter-section-name", "l": 2, "el": [ "0x334bbf" ] }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "/dev/urandom" ], "i": "micro-behaviors/os/random/crypto::urandom", "l": 2, "el": [ "0x21c598" ] }, { "c": 0.800000011920929, "d": "getrandom syscall", "e": [ "runtime.vgetrandomDestroy", "runtime.vgetrandom1", "runtime.vgetrandomInit", "runtime.vgetrandomAlloc", "vgetrandom", "__vdso_getrandom" ], "i": "micro-behaviors/os/random/crypto::getrandom", "l": 2, "el": [ "0x3255e2", "0x3275b9", "0x3255cb", "0x331c13", "0x52ed41", "0x5302a5" ] }, { "c": 0.4000000059604645, "d": "setenv function (set environment variable)", "e": [ "setenv" ], "i": "micro-behaviors/os/env/vars/access::setenv", "l": 2, "el": [ "import" ] }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write/direct::fputc", "l": 2, "el": [ "import" ] }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2, "el": [ "import" ] }, { "a": "T1059.004", "c": 0.800000011920929, "d": "Terminal type linux identifier", "e": [ "linux" ], "i": "objectives/command-and-control/reverse-shell/pty::terminal-type-linux", "l": 1, "m": "B0024", "el": [ "0x52e14a" ] }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1, "el": [ "0x52efd5" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x52f2b6" ] }, { "d": "TCPConn type", "e": [ "TCPConn" ], "i": "micro-behaviors/communications/socket/tcp::tcp-conn", "l": 3, "el": [ "0x32f0aa" ] }, { "d": "Binary exports symbols", "e": [ "exports.count = 3.00" ], "i": "metadata/binary/symbols/exports::has-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "Large ELF with 500+ strings", "e": [ "binary.string_count = 19545.00" ], "i": "metadata/binary/metrics/structural::many-strings-large-elf", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/mdns.allow", "/etc/nsswitch.conf", "/etc/services", "/etc/hosts", "/etc/protocols", "/etc/zoneinfo", "/etc/locH", "/etc/resolv.conf" ], "i": "micro-behaviors/fs/path/config/system::config-etc", "l": 2, "el": [ "0x52fe89", "0x530a3f", "0x52f71f", "0x52ecb5", "0x52fa6d", "0x52f72c", "0xa85e9", "0x5301a5" ] }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "imports.count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1, "el": [ "0x328a86" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 19545.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "bootstrap string", "e": [ "bootstrap" ], "i": "objectives/command-and-control/channel/p2p::bootstrap-str", "l": 1, "el": [ "0x536f4e" ] }, { "c": 0.6600000262260437, "d": "Resolve endpoint with getaddrinfo", "e": [ "getaddrinfo" ], "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "l": 3, "el": [ "import" ] }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2, "el": [ "0xfe4" ] }, { "c": 0.4000000059604645, "d": "unsetenv function (remove environment variable)", "e": [ "unsetenv" ], "i": "micro-behaviors/os/env/vars/access::unsetenv", "l": 2, "el": [ "import" ] }, { "d": "/etc directory reference", "e": [ "/etc" ], "i": "micro-behaviors/fs/path/system::etc-dir", "l": 2, "el": [ "0x52e042" ] }, { "c": 0.6600000262260437, "d": "Read files (Go)", "e": [ "os.(*File).Read" ], "i": "micro-behaviors/fs/file/read::read-go", "l": 2, "el": [ "0x32ad35" ] }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "imports.count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8199999928474426, "d": "ADB CNXN packet marker", "e": [ "CNXN", "8CNXN" ], "i": "micro-behaviors/communications/socket/tcp::cnxn-token", "l": 1, "m": "C0001", "el": [ "0xef8b9", "0xef945" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 0.949999988079071, "d": "ELF carries SHF_COMPRESSED sections (compressed debug info)", "e": [ "elf.compressed_sections_count = 7.00" ], "i": "metadata/binary/anomaly/format::elf-compressed-debug-sections", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "d": "pthread threading library", "e": [ "pthread_create" ], "i": "micro-behaviors/process/threading/concurrency::pthread", "l": 2, "el": [ "import" ] }, { "d": "mmap memory mapping function", "e": [ "mmap" ], "i": "micro-behaviors/mem/alloc/executable::mmap-symbol", "l": 2, "el": [ "import" ] }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "crypto/rsa" ], "i": "objectives/impact/ransom/encrypt/threat-text::go-crypto-rsa", "l": 1, "el": [ "0x52efad" ] }, { "d": "SHELL environment variable", "e": [ "SHELL" ], "i": "micro-behaviors/os/env/vars/system-info::shell-var", "l": 2, "el": [ "0x52fa5f" ] }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "localtime" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2, "el": [ "0x52e904" ] }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2, "el": [ "0x535519", "0x5362ba" ] }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "sections.count = 39.00" ], "i": "metadata/binary/metrics/threshold::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Unmap files from memory", "e": [ "munmap" ], "i": "micro-behaviors/fs/memory/mmap::munmap", "l": 2, "el": [ "import" ] }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "WorkerPool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2, "el": [ "0x3317a9" ] }, { "a": "T1567", "c": 0.8199999928474426, "d": "Go archive zip package reference", "e": [ "archive/zip" ], "i": "objectives/exfiltration/messaging/telegram::go-archive-zip-package", "l": 1, "el": [ "0x52f350" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0x22022" ] }, { "a": "T1071.004", "c": 0.6600000262260437, "d": "Reads DNS resolver configuration", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/communications/dns/lookup/native::lookup-resolv", "l": 3, "m": "C0011", "el": [ "0x5301a5" ] }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libc.so.6]" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2, "el": [ "value:elf.needed" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "cmd", "result", "Result", "command" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x52e420", "0x32fca5", "0x32daf5", "0x21c03b" ] }, { "c": 0.6600000262260437, "d": "Reference to /etc/resolv.conf", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/fs/path/config/system::config-resolv", "l": 3, "el": [ "0x5301a5" ] }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking/static::elf-dynstr-section-name", "l": 2, "el": [ "0x334bec" ] }, { "a": "T1021.004", "c": 0.4000000059604645, "d": "ssh string", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::ssh-string", "l": 2, "el": [ "0x52df62" ] }, { "a": "T1106", "c": 0.949999988079071, "d": "__vdso exported symbol string", "e": [ "__vdso_gettimeofday", "__vdso_getrandom", "__vdso_clock_gettime" ], "i": "objectives/evasion/anti-av/syscall::linux-vdso-symbol", "l": 1, "m": "B0009", "el": [ "0x530f18", "0x5302a5", "0x5313d0" ] }, { "c": 0.6000000238418579, "d": "ELF stripped with .symtab present", "e": [ "elf.stripped_but_symtab_present = 1.00" ], "i": "metadata/build/artifact::elf-stripped-but-symtab-present", "l": 3 }, { "c": 0.20000000298023224, "d": "encrypted-file trailer vocabulary", "e": [ "magic" ], "i": "micro-behaviors/data/text/keywords/lexicon::encrypted-trailer-vocab", "l": 1, "el": [ "0x532e35" ] }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 3.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 0.7200000286102295, "d": "ADB OPEN packet marker", "e": [ "OPEN" ], "i": "micro-behaviors/communications/socket/tcp::open-token", "l": 1, "m": "C0001", "el": [ "0xefcbc" ] }, { "c": 0.30000001192092896, "d": "ICMP service/protocol reference", "e": [ "icmp" ], "i": "micro-behaviors/communications/ip/services::services-icmp", "l": 2, "el": [ "0x52e8ce" ] }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "imports.count = 38.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "a": "T1027.007", "c": 0.699999988079071, "d": "DJB2 hash multiply-by-33 instruction", "e": [ "cd" ], "i": "objectives/anti-static/obfuscation/imports::djb2-multiply-33", "l": 1, "m": "B0032.014", "el": [ "0x2474d" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "input/output error", "output too small" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x530cd9", "0x530575" ] }, { "d": "net/http package import", "e": [ "net/http" ], "i": "objectives/command-and-control/beacon/poll::net-http-import", "l": 1, "el": [ "0x52e892" ] }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082", "el": [ "0x32aeba" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x260d0" ] }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking/static::elf-dynamic-section-name", "l": 2, "el": [ "0x334bdb" ] }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x31e5" ] }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2, "el": [ "0x167285" ] }, { "c": 0.8999999761581421, "d": "Go ELF noptrdata section", "e": [ ".noptrdata" ], "i": "metadata/lang/compiler/systems::go-noptrdata-elf", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x13326" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 19545.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.949999988079071, "d": "Go ELF build info section", "e": [ ".go.buildinfo" ], "i": "metadata/lang/compiler/systems::go-buildinfo-elf", "l": 2 }, { "c": 0.8999999761581421, "d": "Go ELF FIPS info section", "e": [ ".go.fipsinfo" ], "i": "metadata/lang/compiler/systems::go-fipsinfo-elf", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1, "el": [ "0x2a31" ] }, { "c": 0.7200000286102295, "d": "ADB CLSE packet marker", "e": [ "CLSE" ], "i": "micro-behaviors/communications/socket/tcp::clse-token", "l": 1, "m": "C0001", "el": [ "0xeffe9" ] }, { "a": "T1057", "c": 0.6000000238418579, "d": "RedXor process enumeration", "e": [ "/proc/seH" ], "i": "well-known/malware/backdoor/redxor::redxor-check-proc", "l": 1, "m": "B0009", "el": [ "0x5269" ] }, { "d": "overflow keyword", "e": [ "overflow", "markBits overflow", "headTailIndex overflow", "stack overflow", "runqsteal: runq overflow", "runtime: split stack overflow: ", "sysMemStat overflow", "integer overflow", "runtime.overflowError", "runtime.overflowTag", "runtime: thread ID overflow", "progToPointerMask: overflow", "runtime: split stack overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0x52e882", "0x5307b4", "0x531ce5", "0x52fce3", "0x5325c9", "0x534452", "0x531081", "0x530215", "0x333bb2", "0x33153a", "0x5331dc", "0x533062", "0x533b81" ] }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2, "el": [ "import" ] }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2, "el": [ "0x326a7b" ] }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/fips140", "crypto/tls", "crypto/subtle", "crypto/x509", "crypto/rsa" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1, "el": [ "0x52fe41", "0x52efb7", "0x52fa1e", "0x52f345", "0x52efad" ] }, { "c": 0.7200000286102295, "d": "cBPF load ICMP sequence field", "e": [ "28 00 00 00 28 00 00 00" ], "i": "micro-behaviors/os/bpf/program/icmp::cbpf-load-icmp-seq-ethernet", "l": 1, "el": [ "0x13f82c" ] }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/usage::x509-string", "l": 2, "el": [ "0x52f345" ] }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.05" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.30000001192092896, "d": "Sleep for nanosecond duration", "e": [ "nanosleep" ], "i": "micro-behaviors/time/query::nanosleep-func", "l": 2, "el": [ "import" ] }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2, "el": [ "import" ] }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write/direct::write", "l": 2, "el": [ "import" ] }, { "c": 1.0, "d": "/dev/null (legitimate discard device)", "e": [ " closed, unable to open /dev/null, errno=" ], "i": "micro-behaviors/fs/path/device/special::dev-null", "l": 2, "el": [ "0x5366cd" ] }, { "c": 0.8999999761581421, "d": "Go ELF build ID note", "e": [ ".note.go.buildid" ], "i": "metadata/lang/compiler/systems::go-note-buildid-elf", "l": 2 }, { "c": 1.0, "d": "Go 1.22+ internal chacha8rand", "e": [ "type:.eq.internal/chacha8rand.State", "internal/chacha8rand.(*State).Init", "internal/chacha8rand.(*State).Refill", "internal/chacha8rand.block", "internal/chacha8rand.(*State).Reseed" ], "i": "micro-behaviors/crypto/symmetric/stream::go-chacha8rand", "l": 2, "el": [ "0x31ed5b", "0x31ecd3", "0x31ecf6", "0x31ed40", "0x31ed1b" ] }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "path\tcommand-line-arguments", "flag.commandLineUsage" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1, "el": [ "0x21c03b", "0x32b7b3" ] }, { "c": 1.0, "d": "Go-compiled binary (identified by .gopclntab section)", "e": [ ".gopclntab" ], "i": "metadata/lang/compiler/systems::go-binary", "l": 2 }, { "a": "T1059", "c": 0.8500000238418579, "d": "Go binary uses os/exec", "e": [ "os/exec" ], "i": "micro-behaviors/process/create/system::go-os-exec-pclntab", "l": 2, "m": "E1059", "el": [ "0x52e687" ] }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening/missing::elf-dynsym-section-name", "l": 2, "el": [ "0x334be4" ] }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 19545.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection refused error", "e": [ "connection refused" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused", "l": 2, "el": [ "0x530d69" ] }, { "c": 0.6000000238418579, "d": "TCP connection timeout error", "e": [ "connection timed out" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout", "l": 2, "el": [ "0x53163c" ] }, { "c": 1.0, "d": "Toolchain banner stripped, build-id retained", "e": [ "[.comment, .debug_str, .note.gnu.gold-version]" ], "i": "metadata/build/artifact::aggressive-strip", "l": 2, "el": [ "value:elf.stripped_metadata_sections" ] }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening/missing::elf-interpreter-section-name", "l": 2, "el": [ "0x334bbf" ] }, { "c": 0.4000000059604645, "d": "SIGHUP signal ignore pattern (x86_64)", "e": [ "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::sig-ign-sighup-x64", "l": 1, "el": [ "0x42c96" ] }, { "c": 0.6000000238418579, "d": "TCP connection reset error", "e": [ "connection reset by peer" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset", "l": 2, "el": [ "0x5326e9" ] }, { "c": 0.6600000262260437, "d": "Reference to /etc/hosts", "e": [ "/etc/hosts" ], "i": "micro-behaviors/fs/path/config/system::config-hosts", "l": 3, "el": [ "0x52ecb5" ] }, { "a": "T1622", "d": "GDB debugger reference", "e": [ "gdb" ], "i": "objectives/anti-analysis/debugger-detect/check::gdb-ref", "l": 1, "m": "B0001", "el": [ "0x268cfa" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 1.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1497.001", "c": 0.949999988079071, "d": "Regex component marker", "e": [ "binary.string_count = 19545.00" ], "i": "objectives/anti-analysis/vm-detect/vendor::comprehensive-evasion-cond-1--inline-17219", "l": 1 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload/archive::zip-magic", "l": 2, "el": [ "0xa7603" ] }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening/missing::elf-dynstr-section-name", "l": 2, "el": [ "0x334bec" ] }, { "a": "T1106", "c": 0.8999999761581421, "d": "Syscall with immediate number", "e": [ "03 00 00 00", "e7 00 00 00", "ba 00 00 00", "01 01 00 00", "de 00 00 00", "3e 00 00 00", "23 00 00 00", "3c 00 00 00", "01 00 00 00", "ea 00 00 00", "00 00 00 00", "27 00 00 00" ], "i": "objectives/evasion/anti-av/syscall::syscall-with-number", "l": 1, "m": "B0009", "el": [ "0x7da04", "0x7d984", "0x7daa0", "0x7d9d3", "0x7db6e", "0x7db0d", "0x7da90", "0x7d9b0", "0x7da2e", "0x7dada", "0x7da4d", "0x7dac0" ] }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening/missing::elf-dynamic-section-name", "l": 2, "el": [ "0x334bdb" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.8799999952316284, "d": "ADB protocol packet marker cluster", "e": [ "CLSE", "8CNXN", "CNXN" ], "i": "micro-behaviors/communications/socket/tcp::adb-protocol-packet-cluster", "l": 3, "m": "C0001", "el": [ "0xeffe9", "0xef945", "0xef8b9" ] }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in Go binary", "e": [ "Hostname", ".gopclntab" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string", "l": 2, "m": "E1082", "el": [ "0x32aeba", "" ] }, { "c": 0.9399999976158142, "d": "Go ELF retains rich runtime metadata", "e": [ ".go.buildinfo", ".noptrdata", ".go.fipsinfo", ".note.go.buildid" ], "i": "metadata/lang/compiler/systems::go-elf-rich-runtime-metadata", "l": 1 } ], "sha": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd", "path": "0e6816b722a51f7c76e39ad175adcae7dc410b9a35969fba4e12dc1c5d6d41bd.elf", "type": "elf" } ], "tv": "52045" } }