{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8344548940658569, "class": 0 } ], "prob": 0.8344549, "class": 0, "models": [ { "m": "az", "prob": 0.8344549, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/elf", "prob": 0.032098766, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T02:44:42Z" }, "path": "senddata", "raw": { "v": "4", "fs": [ { "f": "H(Cm)Md(He)", "k": { "elf.relro": "partial", "elf.abi.os": "linux", "elf.comment": "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005", "build.distro": "ubuntu", "elf.rpath[0]": "/home/kod/bbn/libssh-0.7.4/build/src", "elf.needed[0]": "libssh.so.4", "elf.needed[1]": "libc.so.6", "build.username": "kod", "debug.build_id": "d1bfab8c955669270bb95cdbd168e87d78964635", "build.toolchain": "gcc 6.2.0", "build.user_home": "/home/kod", "elf.interpreter": "/lib64/ld-linux-x86-64.so.2", "build.build_root": "/home/kod/bbn/libssh-0.7.4/build", "elf.dt_flags.now": true, "elf.dt_flags.pie": true, "build.target_arch": "x86_64", "elf.entry_section": ".text", "elf.abi.min_kernel": "2.6.32", "elf.dt_flags.raw_1": 134217729, "elf.dt_flags_1.now": true, "elf.dt_flags_1.pie": true, "build.username_from": "byte_scan", "build.source_paths[0]": "/home/kod/bbn/libssh-0.7.4/build/src", "elf.segments[0].perms": "r-x", "elf.segments[1].perms": "r--", "elf.segments[2].perms": "r-x", "elf.segments[3].perms": "rw-", "elf.segments[4].perms": "rw-", "elf.segments[5].perms": "r--", "elf.segments[6].perms": "r--", "elf.segments[7].perms": "rw-", "elf.segments[8].perms": "r--", "build.toolchain_family": "gcc", "elf.comment_entries[0]": "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005", "elf.fini_array[0].addr": "0x1730", "elf.gnu_abi_min_kernel": "2.6.32", "elf.init_array[0].addr": "0x1770", "elf.segments[0].p_type": "PT_PHDR", "elf.segments[1].p_type": "PT_INTERP", "elf.segments[2].p_type": "PT_LOAD", "elf.segments[3].p_type": "PT_LOAD", "elf.segments[4].p_type": "PT_DYNAMIC", "elf.segments[5].p_type": "PT_NOTE", "elf.segments[6].p_type": "PT_GNU_EH_FRAME", "elf.segments[7].p_type": "PT_GNU_STACK", "elf.segments[8].p_type": "PT_GNU_RELRO", "elf.segments[0].p_memsz": 504, "elf.segments[0].p_vaddr": 64, "elf.segments[1].p_memsz": 28, "elf.segments[1].p_vaddr": 568, "elf.segments[2].p_memsz": 11164, "elf.segments[3].p_memsz": 1000, "elf.segments[3].p_vaddr": 2108464, "elf.segments[4].p_memsz": 480, "elf.segments[4].p_vaddr": 2108488, "elf.segments[5].p_memsz": 68, "elf.segments[5].p_vaddr": 596, "elf.segments[6].p_memsz": 92, "elf.segments[6].p_vaddr": 10668, "elf.segments[8].p_memsz": 976, "elf.segments[8].p_vaddr": 2108464, "elf.dynsym_funcs[0].kind": "func", "elf.dynsym_funcs[0].name": "__cxa_finalize", "elf.dynsym_funcs[1].kind": "func", "elf.dynsym_funcs[1].name": "__errno_location", "elf.dynsym_funcs[2].kind": "func", "elf.dynsym_funcs[2].name": "__libc_start_main", "elf.dynsym_funcs[3].kind": "func", "elf.dynsym_funcs[3].name": "__stack_chk_fail", "elf.dynsym_funcs[4].kind": "func", "elf.dynsym_funcs[4].name": "fgets", "elf.dynsym_funcs[5].kind": "func", "elf.dynsym_funcs[5].name": "fprintf", "elf.dynsym_funcs[6].kind": "func", "elf.dynsym_funcs[6].name": "fputs", "elf.dynsym_funcs[7].kind": "func", "elf.dynsym_funcs[7].name": "fwrite", "elf.dynsym_funcs[8].kind": "func", "elf.dynsym_funcs[8].name": "memset", "elf.dynsym_funcs[9].kind": "func", "elf.dynsym_funcs[9].name": "printf", "elf.segments[0].p_filesz": 504, "elf.segments[0].p_offset": 64, "elf.segments[1].p_filesz": 28, "elf.segments[1].p_offset": 568, "elf.segments[2].p_filesz": 11164, "elf.segments[3].p_filesz": 992, "elf.segments[3].p_offset": 11312, "elf.segments[4].p_filesz": 480, "elf.segments[4].p_offset": 11336, "elf.segments[5].p_filesz": 68, "elf.segments[5].p_offset": 596, "elf.segments[6].p_filesz": 92, "elf.segments[6].p_offset": 10668, "elf.segments[8].p_filesz": 976, "elf.segments[8].p_offset": 11312, "elf.dynsym_funcs[10].kind": "func", "elf.dynsym_funcs[10].name": "puts", "elf.dynsym_funcs[11].kind": "func", "elf.dynsym_funcs[11].name": "ssh_channel_close", "elf.dynsym_funcs[12].kind": "func", "elf.dynsym_funcs[12].name": "ssh_channel_new", "elf.dynsym_funcs[13].kind": "func", "elf.dynsym_funcs[13].name": "ssh_channel_open_session", "elf.dynsym_funcs[14].kind": "func", "elf.dynsym_funcs[14].name": "ssh_channel_request_exec", "elf.dynsym_funcs[15].kind": "func", "elf.dynsym_funcs[15].name": "ssh_channel_send_eof", "elf.dynsym_funcs[16].kind": "func", "elf.dynsym_funcs[16].name": "ssh_channel_write", "elf.dynsym_funcs[17].kind": "func", "elf.dynsym_funcs[17].name": "ssh_clean_pubkey_hash", "elf.dynsym_funcs[18].kind": "func", "elf.dynsym_funcs[18].name": "ssh_connect", "elf.dynsym_funcs[19].kind": "func", "elf.dynsym_funcs[19].name": "ssh_disconnect", "elf.dynsym_funcs[20].kind": "func", "elf.dynsym_funcs[20].name": "ssh_free", "elf.dynsym_funcs[21].kind": "func", "elf.dynsym_funcs[21].name": "ssh_get_error", "elf.dynsym_funcs[22].kind": "func", "elf.dynsym_funcs[22].name": "ssh_get_hexa", "elf.dynsym_funcs[23].kind": "func", "elf.dynsym_funcs[23].name": "ssh_get_issue_banner", "elf.dynsym_funcs[24].kind": "func", "elf.dynsym_funcs[24].name": "ssh_get_publickey", "elf.dynsym_funcs[25].kind": "func", "elf.dynsym_funcs[25].name": "ssh_get_publickey_hash", "elf.dynsym_funcs[26].kind": "func", "elf.dynsym_funcs[26].name": "ssh_getpass", "elf.dynsym_funcs[27].kind": "func", "elf.dynsym_funcs[27].name": "ssh_is_server_known", "elf.dynsym_funcs[28].kind": "func", "elf.dynsym_funcs[28].name": "ssh_key_free", "elf.dynsym_funcs[29].kind": "func", "elf.dynsym_funcs[29].name": "ssh_new", "elf.dynsym_funcs[30].kind": "func", "elf.dynsym_funcs[30].name": "ssh_options_set", "elf.dynsym_funcs[31].kind": "func", "elf.dynsym_funcs[31].name": "ssh_print_hexa", "elf.dynsym_funcs[32].kind": "func", "elf.dynsym_funcs[32].name": "ssh_string_free_char", "elf.dynsym_funcs[33].kind": "func", "elf.dynsym_funcs[33].name": "ssh_userauth_gssapi", "elf.dynsym_funcs[34].kind": "func", "elf.dynsym_funcs[34].name": "ssh_userauth_kbdint", "elf.dynsym_funcs[35].kind": "func", "elf.dynsym_funcs[35].name": "ssh_userauth_kbdint_getinstruction", "elf.dynsym_funcs[36].kind": "func", "elf.dynsym_funcs[36].name": "ssh_userauth_kbdint_getname", "elf.dynsym_funcs[37].kind": "func", "elf.dynsym_funcs[37].name": "ssh_userauth_kbdint_getnprompts", "elf.dynsym_funcs[38].kind": "func", "elf.dynsym_funcs[38].name": "ssh_userauth_kbdint_getprompt", "elf.dynsym_funcs[39].kind": "func", "elf.dynsym_funcs[39].name": "ssh_userauth_kbdint_setanswer", "elf.dynsym_funcs[40].kind": "func", "elf.dynsym_funcs[40].name": "ssh_userauth_list", "elf.dynsym_funcs[41].kind": "func", "elf.dynsym_funcs[41].name": "ssh_userauth_none", "elf.dynsym_funcs[42].kind": "func", "elf.dynsym_funcs[42].name": "ssh_userauth_password", "elf.dynsym_funcs[43].kind": "func", "elf.dynsym_funcs[43].name": "ssh_userauth_publickey_auto", "elf.dynsym_funcs[44].kind": "func", "elf.dynsym_funcs[44].name": "ssh_write_knownhost", "elf.dynsym_funcs[45].kind": "func", "elf.dynsym_funcs[45].name": "strchr", "elf.dynsym_funcs[46].kind": "func", "elf.dynsym_funcs[46].name": "strerror", "elf.dynsym_funcs[47].kind": "func", "elf.dynsym_funcs[47].name": "strlen", "elf.dynsym_funcs[48].kind": "func", "elf.dynsym_funcs[48].name": "strncasecmp", "elf.dynsym_funcs[49].kind": "func", "elf.dynsym_funcs[49].name": "strstr", "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "4", "elf.segments[2].flags_hex": "5", "elf.segments[3].flags_hex": "6", "elf.segments[4].flags_hex": "6", "elf.segments[5].flags_hex": "4", "elf.segments[6].flags_hex": "4", "elf.segments[7].flags_hex": "6", "elf.segments[8].flags_hex": "4", "elf.needed_versions[0].lib": "libc.so.6", "elf.dynsym_funcs[0].binding": "weak", "elf.stripped_metadata_sections[0]": ".note.GNU-stack", "elf.stripped_metadata_sections[1]": ".note.gnu.property", "elf.needed_versions[0].versions[0]": "GLIBC_2.2.5", "elf.needed_versions[0].versions[1]": "GLIBC_2.4" }, "x": 5, "id": 0, "is": [ "", "ssh_connect", "ssh_get_issue_banner", "printf", "ssh_userauth_gssapi", "ssh_userauth_publickey_auto", "memset", "ssh_clean_pubkey_hash", "gmon_start__", "Jv_RegisterClasses", "puts", "ssh_userauth_kbdint", "ssh_userauth_list", "ssh_get_publickey", "libc_start_main", "ssh_options_set", "ssh_userauth_kbdint_getprompt", "ssh_string_free_char", "ssh_write_knownhost", "fgets", "ITM_deregisterTMCloneTable", "ssh_channel_request_exec", "ssh_userauth_kbdint_getnprompts", "strlen", "ssh_getpass", "ITM_registerTMCloneTable", "ssh_print_hexa", "cxa_finalize", "ssh_channel_send_eof", "stdin", "ssh_disconnect", "ssh_channel_open_session", "ssh_is_server_known", "ssh_userauth_password", "strerror", "strstr", "fputs", "ssh_channel_close", "ssh_userauth_kbdint_setanswer", "ssh_get_error", "strchr", "ssh_free", "errno_location", "ssh_userauth_none", "strncasecmp", "stack_chk_fail", "ssh_key_free", "ssh_channel_new", "ssh_get_publickey_hash", "ssh_new", "ssh_userauth_kbdint_getinstruction", "stderr", "fwrite", "ssh_get_hexa", "ssh_channel_write", "ssh_userauth_kbdint_getname", "fprintf" ], "ms": { "elf": { "entry": 5744.0, "relro": "partial", "e_type": 3.0, "needed": [ "libssh.so.4", "libc.so.6" ], "rpaths": [ "/home/kod/bbn/libssh-0.7.4/build/src" ], "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "has_rpath": true, "relacount": 3.0, "class_bits": 64.0, "dt_flags_1": 134217729.0, "note_count": 2.0, "nx_enabled": true, "needed_libs": 2.0, "rpath_count": 1.0, "dynsym_count": 73.0, "has_build_id": true, "has_eh_frame": true, "has_gnu_hash": true, "stack_canary": true, "symtab_count": 123.0, "dynrela_count": 59.0, "entry_section": ".text", "little_endian": true, "section_count": 29.0, "build_id_length": 20.0, "dt_versym_count": 73.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "gnu_abi_min_kernel": "2.6.32", "comment_entry_count": 1.0, "program_header_count": 9.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": true, "load_segment_max_p_memsz": 11164.0, "load_segment_max_p_filesz": 11164.0, "stripped_but_symtab_present": true, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 2.0 }, "file": { "size": 19056.0 }, "binary": { "code_size": 4458.0, "func_count": 64.0, "has_overlay": true, "code_entropy": 3.69, "data_entropy": 2.82, "export_count": 69.0, "func_density": 14.7, "import_count": 57.0, "overlay_size": 1860.0, "string_count": 169.0, "avg_func_size": 66.92, "overlay_ratio": 0.1, "section_count": 28.0, "avg_complexity": 2.38, "import_density": 13.09, "max_complexity": 24.0, "string_density": 38.82, "aliased_exports": 61.0, "overall_entropy": 2.86, "overlay_entropy": 1.46, "avg_basic_blocks": 3.27, "avg_section_size": 587.68, "dependency_count": 2.0, "entropy_variance": 1.59, "avg_string_length": 18.34, "complexity_per_kb": 0.55, "dynsym_func_count": 60.0, "has_provenance_id": true, "max_string_length": 171.0, "avg_string_entropy": 3.21, "code_to_data_ratio": 0.37, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.21, "total_basic_blocks": 209.0, "func_analysis_depth": 2.0, "internal_func_count": 4.0, "provenance_id_length": 20.0, "string_length_stddev": 16.64, "largest_section_ratio": 0.21, "sentence_string_count": 25.0, "sentence_string_ratio": 0.15, "behavioral_import_ratio": 0.02, "runtime_search_path_count": 1.0 } }, "ss": [ [ 0, "printf" ], [ 568, "/lib64/ld-linux-x86-64.so.2" ], [ 630, "xor", "Puvlic#keyg\u00264s" ], [ 665, "xor", "PubUic iey oash" ], [ 2143, "xor", "PGfliq fel" ], [ 2529, "libssh.so.4" ], [ 2541, "__gmon_start__" ], [ 2556, "_Jv_RegisterClasses" ], [ 2576, "_ITM_deregisterTMCloneTable" ], [ 2604, "_ITM_registerTMCloneTable" ], [ 2630, "ssh_channel_close" ], [ 2648, "ssh_get_publickey" ], [ 2666, "ssh_disconnect" ], [ 2681, "ssh_get_issue_banner" ], [ 2702, "ssh_userauth_password" ], [ 2724, "ssh_print_hexa" ], [ 2739, "ssh_userauth_kbdint_getnprompts" ], [ 2771, "ssh_new" ], [ 2779, "ssh_get_error" ], [ 2793, "ssh_get_publickey_hash" ], [ 2816, "ssh_channel_write" ], [ 2834, "ssh_connect" ], [ 2846, "ssh_userauth_list" ], [ 2864, "ssh_userauth_kbdint_getname" ], [ 2892, "ssh_userauth_publickey_auto" ], [ 2920, "ssh_options_set" ], [ 2936, "ssh_channel_open_session" ], [ 2961, "ssh_userauth_kbdint_getprompt" ], [ 2991, "ssh_is_server_known" ], [ 3011, "ssh_key_free" ], [ 3024, "ssh_channel_request_exec" ], [ 3049, "ssh_clean_pubkey_hash" ], [ 3071, "ssh_channel_new" ], [ 3087, "ssh_free" ], [ 3096, "ssh_string_free_char" ], [ 3117, "ssh_userauth_kbdint_setanswer" ], [ 3147, "ssh_write_knownhost" ], [ 3167, "ssh_getpass" ], [ 3179, "ssh_userauth_kbdint_getinstruction" ], [ 3214, "ssh_userauth_none" ], [ 3232, "ssh_userauth_kbdint" ], [ 3252, "ssh_channel_send_eof" ], [ 3273, "ssh_get_hexa" ], [ 3286, "ssh_userauth_gssapi" ], [ 3316, "__stack_chk_fail" ], [ 3345, "strlen" ], [ 3352, "memset" ], [ 3366, "__errno_location" ], [ 3389, "stderr" ], [ 3396, "strncasecmp" ], [ 3408, "fwrite" ], [ 3422, "fprintf" ], [ 3430, "__cxa_finalize" ], [ 3445, "strerror" ], [ 3454, "__libc_start_main" ], [ 3472, "_edata" ], [ 3479, "__bss_start" ], [ 3496, "/home/kod/bbn/libssh-0.7.4/build/src" ], [ 3533, "__libc_csu_fini" ], [ 3549, "authenticate_kbdint" ], [ 3569, "connect_ssh" ], [ 3581, "authenticate_console" ], [ 3602, "verify_knownhost" ], [ 3619, "_IO_stdin_used" ], [ 3634, "__data_start" ], [ 3647, "__libc_csu_init" ], [ 3797, "xor", "Pwbmib jex i" ], [ 3809, "xor", "Ptbmib jex i" ], [ 3821, "xor", "Ptbmib jex i" ], [ 5282, "xor", "PuZlic key has әj$" ], [ 5744, "_start" ], [ 9780, "localhost" ], [ 9790, "cat \u003e /dev/null" ], [ 9806, "written %llx" ], [ 9845, "Authentication failed: %s" ], [ 9888, "Host key for server changed : server's one is now :" ], [ 9941, "Public key hash" ], [ 9960, "For security reason, connection will be stopped" ], [ 10016, "The host key for this server was not found but an other type of key exists." ], [ 10096, "An attacker might change the default server key to confuse your clientinto thinking the key does not exist\nWe advise you to reru" ], [ 10203, "We advise you to rerun the client with -d or -r for more safety." ], [ 10272, "Could not find known host file. If you accept the host key here," ], [ 10344, "the file will be automatically created." ], [ 10392, "The server is unknown. Do you trust the host key ?" ], [ 10444, "Public key hash: %s" ], [ 10472, "This new key will be written on disk for further usage. do you agree ?" ], [ 10544, "error %s" ], [ 10584, "Connection failed : %s" ], [ 10608, "Authentication failed" ], [ 10632, "Error while authenticating : %s" ], [ 10667, "xor", "PtyoR; kes haW" ], [ 10844, "xor", "@ublim0-kajgj" ], [ 10862, "xor", "JNH_MA key\u003chas,PubL" ], [ 10893, "xor", "R6ojj4\"gbq tash4ubl5" ], [ 10925, "xor", "R6ojjK#gbq tash" ], [ 10961, "xor", "'yedic wey " ], [ 11060, "xor", "\\rjl-c kax h" ], [ 12294, "xor", "Puj\\Ic keyg+\"IHx " ], [ 12304, "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005" ], [ 12342, "xor", "aCS\\YV key h" ], [ 13481, "xor", "Qubmit cUY h" ], [ 13553, "xor", "Qubmiv #IY h" ], [ 14847, "xor", "PEglis sei" ], [ 15305, "crtstuff.c" ], [ 15316, "__JCR_LIST__" ], [ 15329, "deregister_tm_clones" ], [ 15350, "__do_global_dtors_aux" ], [ 15372, "completed.7558" ], [ 15387, "__do_global_dtors_aux_fini_array_entry" ], [ 15426, "frame_dummy" ], [ 15438, "__frame_dummy_init_array_entry" ], [ 15469, "senddata.c" ], [ 15480, "authentication.c" ], [ 15497, "knownhosts.c" ], [ 15510, "connect_ssh.c" ], [ 15524, "__FRAME_END__" ], [ 15538, "__JCR_END__" ], [ 15550, "__GNU_EH_FRAME_HDR" ], [ 15569, "_GLOBAL_OFFSET_TABLE_" ], [ 15591, "__TMC_END__" ], [ 15603, "__dso_handle" ], [ 15616, "__init_array_end" ], [ 15633, "__init_array_start" ], [ 15652, "_DYNAMIC" ], [ 15742, "memset@@GLIBC_2.2.5" ], [ 15923, "__libc_start_main@@GLIBC_2.2.5" ], [ 16062, "fgets@@GLIBC_2.2.5" ], [ 16198, "strlen@@GLIBC_2.2.5" ], [ 16284, "__cxa_finalize@@GLIBC_2.2.5" ], [ 16333, "stdin@@GLIBC_2.2.5" ], [ 16434, "strerror@@GLIBC_2.2.5" ], [ 16456, "strstr@@GLIBC_2.2.5" ], [ 16476, "fputs@@GLIBC_2.2.5" ], [ 16573, "strchr@@GLIBC_2.2.5" ], [ 16602, "__errno_location@@GLIBC_2.2.5" ], [ 16662, "strncasecmp@@GLIBC_2.2.5" ], [ 16687, "__stack_chk_fail@@GLIBC_2.4" ], [ 16810, "stderr@@GLIBC_2.2.5" ], [ 16830, "fwrite@@GLIBC_2.2.5" ], [ 16916, "fprintf@@GLIBC_2.2.5" ], [ 16937, "main" ], [ 16943, ".symtab" ], [ 16951, ".strtab" ], [ 16959, ".shstrtab" ], [ 16969, ".interp" ], [ 16977, ".note.ABI-tag" ], [ 16991, ".note.gnu.build-id" ], [ 17010, ".gnu.hash" ], [ 17020, ".dynsym" ], [ 17028, ".dynstr" ], [ 17036, ".gnu.version" ], [ 17049, ".gnu.version_r" ], [ 17064, ".rela.dyn" ], [ 17074, ".init" ], [ 17080, ".plt" ], [ 17085, ".plt.got" ], [ 17094, ".text" ], [ 17100, ".fini" ], [ 17106, ".rodata" ], [ 17114, ".eh_frame_hdr" ], [ 17128, ".eh_frame" ], [ 17138, ".init_array" ], [ 17150, ".fini_array" ], [ 17162, ".jcr" ], [ 17167, ".dynamic" ], [ 17176, ".data" ], [ 17182, ".bss" ], [ 17187, ".comment" ], [ 2109440, "data_start" ] ], "sz": 19056, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-under-12-lines", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/file/text/metrics::file-one-liner", "l": 1 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e /dev/null" ], "i": "micro-behaviors/process/daemonize/detach::redirect-dev-null", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 200.00" ], "i": "metadata/binary/metrics/text-density::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x263e" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/symbols/exports::has-exports", "l": 1 }, { "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".so" ], "i": "objectives/evasion/kernel-hide/userspace::runtime-shared-object-compile--rx-1", "l": 1 }, { "a": "T1021.004", "d": "SSH authentication failed message", "e": [ "Authentication failed: %s", "Authentication failed" ], "i": "micro-behaviors/communications/ssh/client::auth-failed", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 28.00" ], "i": "metadata/binary/metrics/threshold::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 57.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "XOR-encoded strings in Rust binary", "e": [ "PGfliq fel", "JNH_MA key\u003chas,PubL", "\\rjl-c kax h", "Puj\\Ic keyg+\"IHx ", "R6ojj4\"gbq tash4ubl5", "PubUic iey oash", "@ublim0-kajgj", "Puvlic#keyg\u00264s", "'yedic wey ", "R6ojjK#gbq tash", "aCS\\YV key h", "Ptbmib jex i", "Pwbmib jex i", "PtyoR; kes haW", "PuZlic key has әj$" ], "i": "objectives/anti-static/obfuscation/string/encoding::rust-xor-encoded-strings", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.21" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "ELF built with only partial RELRO", "e": [ "partial" ], "i": "metadata/binary/anomaly/provenance::partial-relro", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 57.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking/static::elf-dynamic-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 2.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 1.0, "d": "ELF GNU build-id metadata", "e": [ "d1bfab8c955669270bb95cdbd168e87d78964635" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/layout::binary-format-checked", "l": 2 }, { "c": 0.699999988079071, "d": "RPATH/RUNPATH set (library injection vector)", "e": [ "elf.has_rpath = 1.00" ], "i": "metadata/hardening/mitigation::rpath-set", "l": 3 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 64.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.6000000238418579, "d": "ELF stripped with .symtab present", "e": [ "elf.stripped_but_symtab_present = 1.00" ], "i": "metadata/build/artifact::elf-stripped-but-symtab-present", "l": 3 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "senddata" ], "i": "metadata/binary/metrics/structural::small-elf-binary", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics/structural::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 69.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "sym.imp.__stack_chk_fail", "stack_chk_fail@@GLIBC_2.4", "stack_chk_fail" ], "i": "metadata/hardening/build::stack-chk-fail", "l": 2 }, { "c": 0.699999988079071, "d": "ELF .note.GNU-stack section absent", "e": [ "elf.gnu_stack_section_absent = 1.00" ], "i": "metadata/binary/anomaly/format::elf-gnu-stack-section-absent", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.38" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "ELF has program interpreter", "e": [ "elf.has_interpreter = 1.00" ], "i": "metadata/binary/layout::has-interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 64.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.949999988079071, "d": "ELF declares DT_RELACOUNT (relative relocations)", "e": [ "elf.relacount = 3.00" ], "i": "metadata/binary/anomaly/format::elf-relacount-present", "l": 2 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "libssh library reference", "e": [ "/home/kod/bbn/libssh-0.7.4/build/src", "libssh.so.4" ], "i": "micro-behaviors/communications/ssh/client::libssh", "l": 3 }, { "d": "password keyword", "e": [ "ssh_userauth_password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write/direct::write", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 57.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking/static::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "senddata" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking/static::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking/static::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "ELF RPATH metadata", "e": [ "[/home/kod/bbn/libssh-0.7.4/build/src]" ], "i": "metadata/binary/linking/runtime::elf-rpath", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.86" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 57.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 64.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "c": 1.0, "d": "/dev/null (legitimate discard device)", "e": [ "cat \u003e /dev/null" ], "i": "micro-behaviors/fs/path/device/special::dev-null", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Public key hash", "ssh_get_publickey", "ssh_get_publickey_hash", "Public key hash: %s", "ssh_userauth_publickey_auto" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "a": "T1027", "c": 0.8799999952316284, "d": "XOR-base64 encoded strings in Rust binary", "e": [ "Pwbmib jex i", "\\rjl-c kax h", "PGfliq fel", "JNH_MA key\u003chas,PubL", "Puj\\Ic keyg+\"IHx ", "@ublim0-kajgj", "PubUic iey oash", "PtyoR; kes haW", "R6ojjK#gbq tash", "PuZlic key has әj$", "Ptbmib jex i", "R6ojj4\"gbq tash4ubl5", "'yedic wey ", "Puvlic#keyg\u00264s", "aCS\\YV key h" ], "i": "objectives/anti-static/obfuscation/string/encoding::rust-xor-base64-encoded", "l": 1, "m": "B0032" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account ubuntu", "e": [ "ubuntu" ], "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu", "l": 1, "m": "E1110" }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libssh.so.4, libc.so.6]" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 57.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening/missing::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening/missing::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening/missing::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening/missing::elf-interpreter-section-name", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.38" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 19056 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "SSH publickey auth method", "e": [ "ssh_get_publickey_hash", "ssh_userauth_publickey_auto", "ssh_get_publickey" ], "i": "micro-behaviors/communications/ssh/client::publickey-auth", "l": 3 }, { "a": "T1021.004", "c": 0.75, "d": "SSH client/auth library", "e": [ "ssh_userauth_publickey_auto", "ssh_get_publickey_hash", "libssh.so.4", "ssh_get_publickey", "/home/kod/bbn/libssh-0.7.4/build/src" ], "i": "micro-behaviors/communications/ssh/client::library-comp", "l": 3 }, { "a": "T1021.004", "c": 0.8500000238418579, "d": "SSH authentication implementation", "e": [ "ssh_userauth_publickey_auto", "libssh.so.4", "Authentication failed", "ssh_get_publickey", "Authentication failed: %s", "ssh_get_publickey_hash", "/home/kod/bbn/libssh-0.7.4/build/src" ], "i": "micro-behaviors/communications/ssh/client::full-implementation", "l": 3 } ], "sha": "2315201331a963521f2559efbf46b1399268c6032adb33c14087579727d00dff", "path": "/data/samples/bad/datasets/iot-malware/busybotnet/libssh-0.7.4/build/examples/senddata", "type": "elf" } ], "tv": "6a383" } }