{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0007124841, "rte": "az", "prob": 0.0007124841 }, { "cls": 0, "raw": 0.00017473102, "rte": "az/source", "prob": 0.00017473102 }, { "cls": 0, "raw": 0.00034597516, "rte": "az/go", "prob": 0.00034597516 } ], "prob": 0.0007124841, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.0007124841213226318 } ], "version": "v18.18", "analyzed_at": "2026-06-13T13:55:55Z" }, "path": "potatos1233.go", "raw": { "v": "7", "tv": "40f6c", "files": [ { "id": 0, "ctx": [ { "a": 3576, "b": "2)?!?BAzFyiXJdbe]$PjA:@=nD0$x8z.tKrz7^7:", "l": 71 }, { "a": 3609, "b": "2)?!?BAzFyiXJdgCxUVHx\u003c\u0026Sbz*0^FzE^s6e[/uzy:7z", "l": 72 }, { "a": 3645, "b": "2)?!?BAzFyiXJdfyC6anz7/\u003cGz!rZ1wId}nA6E=NBz\u003cq^ec", "l": 73, "n": [ { "c": 3, "d": "URL targets .php with query", "i": "micro-behaviors/communications/http/url/php-endpoint::url-php-query-script", "o": 3647, "z": 27 } ] }, { "a": 3683, "b": "2)?!?BAzFyiXJdgCxUVZB76fewmo:ov@DiqB7F^2v}WJowPJ0gBAoV^jT8A", "l": 74 }, { "a": 3731, "b": "2)?!?BAzFyiXJd1wO=rrvQS$YBUmfxz7/%wvrb\u003c\u003eqE%](y\u0026?)SwQeGrA+6kOa$J", "l": 75 }, { "a": 4079, "b": "w{503aAy[dwn=r-BAh8kxddOczFa68azC.ndiJXNA+PA7aBs", "l": 89 }, { "a": 4118, "b": "31t2rjS[PIyH[[#u1e83wH[%uwO#d5xEJ", "l": 90 }, { "a": 4145, "b": "31!9@azz@VjS[=NzF9J6vJZ0", "l": 91, "n": [ { "c": 2, "d": "English language detection", "i": "micro-behaviors/data/text/language::lang-english", "o": 4146, "z": 3 } ] }, { "a": 4165, "b": "2)\u003e6Bx\u003cz\u0026AayO.?wlT7.zE+v\u003ezGG+Ay?mGjvpA.SdjFK", "l": 92 }, { "a": 4201, "b": "34h", "l": 93 }, { "a": 6296, "b": "2)*]KwNPaXAV=\u003e}ar\u003c]tmSir\u003evrb)\u0026wgZn?AYLr!as!NQBAg(fzGWT7Bz\u003eOoA:-\u0026@e\u003eG@5zyvm$hyQ6$d\u003cc2*a%nxUB98Cjz/f.JnPX(Vc#@:lwg*C\u003eBz-GZh8V)jas!MUe*qz*aAITBv@Dmde\u003eHe6vjle8zE+v\u003ezGG+AgbQ%sdiHb-a$+5Zd\u003ce[PA:%39B$Mvdz^+5mvqYQdnP5S/c]9UrdjDw\u0026ar\u003e6htY7.", "l": 146 }, { "a": 6480, "b": "2)(25wO=B0aBs", "l": 147 }, { "a": 6491, "b": "2)*]Ix!gxrA=Jo-jS[V:e(cB$zyx1qB98tqmRMWIdf", "l": 148, "n": [ { "c": 2, "d": "Open file via os.Open", "i": "micro-behaviors/fs/file/open::os-open", "o": 6505, "z": 7 } ] }, { "a": 6525, "b": "2)*]Lw/$V9AV=I*az$[faBs", "l": 149 }, { "a": 6544, "b": "2)*[Aw]hSxp\u0026Zn/By({BmriA!AYLr?B6JPbefFIAAWZ", "l": 150 }, { "a": 7661, "b": "329#]B-Ra\u003cA=lhpwPF$vclNbozyxEAz*k#cB15j}ats{+", "l": 193 }, { "a": 7698, "b": "2)\u003eM\u003ez*lKIiZ1Q8A=lhpwPI6@vqYQdnP5S/c#rEjc#:iBCXH-gdjFK", "l": 194 }, { "a": 7742, "b": "2)\u003e9WzF?0FwPz/liZ1Q6wPPK)x\u003c\u003e*ab6msla$K\u003cQA=lhFdf", "l": 195, "n": [ { "c": 3, "d": "Go net.Dial call", "i": "micro-behaviors/communications/socket/connect::dial", "o": 7757, "z": 8 } ] }, { "a": 7780, "b": "2)\u003erTaz2Olar-(\u003czFr]fDJ", "l": 196 }, { "a": 7798, "b": "2)*]UwPS6nzxJ?hyY", "l": 197 }, { "a": 7955, "b": "329#]AbP=sau.\u003ega#zbja%qj", "l": 206 }, { "a": 7975, "b": "2)\u003e9Nxcok#asqhDB1P*#zF0P}DJ", "l": 207 }, { "a": 7997, "b": "2)*]fzGxx0B-I4(yIv-*wPzG%C@^6\u0026A=\u003e}A", "l": 208, "n": [ { "c": 3, "d": "InsecureSkipVerify (Go)", "i": "micro-behaviors/communications/socket/ssl::insecure-skip-verify", "o": 8000, "z": 24 } ] }, { "a": 8026, "b": "2)*]pwPz%9A.Z4WwJy}RarR^HarR!uz/Z1K", "l": 209 }, { "a": 8055, "b": "2)*]9y?WD#Bw(:(B7]MglT:FrwJy@Qy\u0026.j7wP{*CrypOpwO#P*wPI{bz/d{Jv}YB4f!$Zqec", "l": 210 }, { "a": 9896, "b": "329#]y?mGjz/WJ%A+xCxau.\u003eghZ0C", "l": 308 }, { "a": 9920, "b": "2)\u003eM\u003ez*lK%x(4u6iZ1Q7B1P+0xldont(", "l": 309 }, { "a": 9946, "b": "2)\u003ecJByuZywPz/liZ1Q7B1Qv4vpR\u0026wy?k2lA=lhFmRMWIdf", "l": 310, "n": [ { "c": 3, "d": "Read file contents via os.ReadFile", "i": "micro-behaviors/fs/file/read::os-readfile", "o": 9961, "z": 11 } ] }, { "a": 9984, "b": "2)\u003erTaz2Olau.\u003egzFr]fDJ", "l": 311 }, { "a": 10002, "b": "2)*]SA=lhpwPF$SaAITBx(mN8e(M.9x(\u003e+ABAh8kxddq0ByuQHar\u003e6da$i", "l": 312 }, { "a": 10590, "b": "", "l": 335 }, { "a": 10591, "b": "31!3@e(lO5zGGFsb1ux!z!6#0v@#BdwGUP6AV=VsaAIa7z/f9be?O+YzxZROy?W:2Bsv", "l": 336 }, { "a": 10646, "b": "33o(#wIc[$wO2*eBzkP6e\u003c%\u00265vruj4zyxsnze18vasXHQx(dAlq!oDSzE+f", "l": 337, "n": [ { "c": 2, "d": "Go time.Sleep delay call", "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "o": 10647, "z": 10 } ] }, { "a": 10694, "b": "31!3@e(lO5zGGYjc)zb%z/oeev@Dj6y?mZ1e*q.", "l": 338 }, { "a": 10726, "b": "Ee", "l": 339 } ], "mol": "H₂(Cm₃F)", "sha": "273748461c863df96589455c1b31b25bbfe1fbc8d5f9015561300c64055c6032", "fact": { "id": "go", "imp": [ [ "", "make" ], [ "", "rand.Seed" ], [ "", "time.Now.UnixNano" ], [ "", "time.Now" ], [ "", "make" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "string" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "rand.Intn" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "getuseragent" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "randomString" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "strconv.Itoa" ], [ "", "rand.Intn" ], [ "", "os.Open" ], [ "", "fmt.Printf" ], [ "", "fi.Close" ], [ "", "bufio.NewReader" ], [ "", "br.ReadLine" ], [ "", "string" ], [ "", "randomString" ], [ "", "rand.Intn" ], [ "", "os.Open" ], [ "", "fmt.Printf" ], [ "", "fi.Close" ], [ "", "bufio.NewReader" ], [ "", "br.ReadLine" ], [ "", "string" ], [ "", "strconv.Itoa" ], [ "", "len" ], [ "", "getuseragent" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "rand.Intn" ], [ "", "len" ], [ "", "randomString" ], [ "", "len" ], [ "", "len" ], [ "", "net.Dial" ], [ "", "fmt.Fprintf" ], [ "", "make" ], [ "", "conn.Read" ], [ "", "tls.NewLRUClientSessionCache" ], [ "", "tls.Dial" ], [ "", "net.Dial" ], [ "", "tcpConn.SetNoDelay" ], [ "", "dialTarget" ], [ "", "randomString" ], [ "", "randomString" ], [ "", "conn.Write" ], [ "", "conn.Close" ], [ "", "fmt.Println" ], [ "", "len" ], [ "", "len" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "fmt.Println" ], [ "", "os.Exit" ], [ "", "url.Parse" ], [ "", "fmt.Println" ], [ "", "os.Exit" ], [ "", "strings.Split" ], [ "", "u.Port" ], [ "", "fmt.Println" ], [ "", "os.Exit" ], [ "", "strconv.Atoi" ], [ "", "strconv.Atoi" ], [ "", "strings.Contains" ], [ "", "len" ], [ "", "os.ReadFile" ], [ "", "strings.Split" ], [ "", "string" ], [ "", "fmt.Printf" ], [ "", "len" ], [ "", "buildHeader" ], [ "", "syscall.Getrlimit" ], [ "", "syscall.Setrlimit" ], [ "", "floodWorker" ], [ "", "fmt.Printf" ], [ "", "fmt.Println" ], [ "", "bufio.NewReader.ReadString" ], [ "", "bufio.NewReader" ], [ "", "close" ], [ "", "fmt.Printf" ], [ "", "time.Sleep" ], [ "", "time.Duration" ], [ "", "fmt.Println" ], [ "", "bufio" ], [ "", "crypto/tls" ], [ "", "fmt" ], [ "", "io" ], [ "", "math/rand" ], [ "", "net" ], [ "", "net/url" ], [ "", "os" ], [ "", "strconv" ], [ "", "strings" ], [ "", "syscall" ], [ "", "time" ] ], "mbr": [ "br.ReadLine", "bufio.NewReader", "bufio.NewReader().ReadString", "conn.Close", "conn.Read", "conn.Write", "fi.Close", "fmt.Fprintf", "fmt.Printf", "fmt.Println", "io.EOF", "net.Dial", "os.Args", "os.Exit", "os.Open", "os.ReadFile", "os.Stdin", "rand.Intn", "rand.Seed", "rlimit.Cur", "rlimit.Max", "strconv.Atoi", "strconv.Itoa", "strings.Contains", "strings.Split", "syscall.Getrlimit", "syscall.RLIMIT_NOFILE", "syscall.Setrlimit", "tcpConn.SetNoDelay", "time.Duration", "time.Now", "time.Now().UnixNano", "time.Second", "time.Sleep", "tls.Dial", "tls.NewLRUClientSessionCache", "u.Host", "u.Path", "u.Port", "u.Scheme", "url.Parse" ], "met": { "ast": { "op.eq": 14.0, "op.gt": 1.0, "op.lt": 1.0, "op.ne": 12.0, "op.add": 110.0, "op.mul": 1.0, "op.sub": 2.0, "op.band": 3.0, "op.land": 3.0, "max_depth": 24.0, "call_count": 141.0, "node_count": 3850.0, "member_count": 41.0, "op_density.eq": 0.0, "op_density.gt": 0.0, "op_density.lt": 0.0, "op_density.ne": 0.0, "op_density.add": 0.03, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.band": 0.0, "op_density.land": 0.0, "identifier_count": 124.0, "member_depth_max": 3.0, "string_literal_count": 203.0, "array_literal_max_length": 2.0, "string_concat_chain_max_length": 9.0 }, "file": { "size": 10728.0, "entropy": 5.44, "size_bytes": 10728.0 }, "text": { "tab_count": 532.0, "digit_ratio": 0.06, "space_count": 940.0, "total_lines": 339.0, "char_entropy": 5.44, "mixed_indent": 1.0, "unique_chars": 97.0, "lines_over_200": 4.0, "string_density": 0.6, "avg_line_length": 30.65, "high_byte_ratio": 0.0, "max_line_length": 262.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.1, "last_line_length": 1.0, "whitespace_ratio": 0.17, "most_common_ratio": 0.05, "identifier_density": 1.69, "line_length_stddev": 39.22, "normalized_string_count": 11.03, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 9.0, "trailing_whitespace_lines": 1.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 14.75 }, "calls": { "count": 141.0 }, "binary": { "overall_entropy": 5.44 }, "source": { "function_count": 7.0 }, "imports": { "count": 12.0, "stdlib_count": 12.0, "stdlib_ratio": 1.0, "unique_modules": 12.0 }, "members": { "count": 41.0 }, "strings": { "total": 203.0, "url_count": 17.0, "avg_length": 21.69, "max_length": 244.0, "avg_entropy": 2.73, "empty_count": 8.0, "total_bytes": 4403.0, "entropy_stddev": 1.39, "high_entropy_count": 4.0 }, "functions": { "count": 7.0, "avg_params": 1.0, "max_params": 3.0, "length_stddev": 25.3, "avg_name_length": 9.14, "no_params_count": 3.0, "avg_length_lines": 35.57, "max_length_lines": 82.0, "min_length_lines": 3.0, "avg_param_name_length": 5.14, "density_per_100_lines": 2.06, "code_in_functions_ratio": 0.73 }, "identifiers": { "count": 124.0, "total": 574.0, "avg_length": 5.73, "max_length": 24.0, "min_length": 1.0, "avg_entropy": 2.1, "reuse_ratio": 0.22, "unique_count": 124.0, "length_stddev": 3.46, "has_digit_ratio": 0.04, "sequential_names": 5.0, "single_char_count": 6.0, "single_char_ratio": 0.05, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.52, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 5.0, "underscore_prefix_count": 1.0 } }, "str": [ [ 24, "u8", "bufio" ], [ 25, "u8", "bufio" ], [ 33, "u8", "crypto/tls" ], [ 34, "u8", "crypto/tls" ], [ 47, "u8", "fmt" ], [ 48, "u8", "fmt" ], [ 54, "u8", "io" ], [ 55, "u8", "io" ], [ 60, "u8", "math/rand" ], [ 61, "u8", "math/rand" ], [ 73, "u8", "net" ], [ 74, "u8", "net" ], [ 80, "u8", "net/url" ], [ 81, "u8", "net/url" ], [ 91, "u8", "os" ], [ 92, "u8", "os" ], [ 97, "u8", "strconv" ], [ 98, "u8", "strconv" ], [ 108, "u8", "strings" ], [ 109, "u8", "strings" ], [ 119, "u8", "syscall" ], [ 120, "u8", "syscall" ], [ 130, "u8", "time" ], [ 131, "u8", "time" ], [ 177, "u8", "80" ], [ 178, "u8", "80" ], [ 230, "u8", "asdfghjklqwertyuiopzxcvbnmASDFGHJKLQWERTYUIOPZXCVBNM0123456789" ], [ 231, "u8", "asdfghjklqwertyuiopzxcvbnmASDFGHJKLQWERTYUIOPZXCVBNM0123456789" ], [ 411, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: g" ], [ 412, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" ], [ 487, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 522, "u8", "Accept-Encoding: gzip, deflate" ], [ 561, "u8", "Accept-Encoding: gzip, deflate, br\\r\\n" ], [ 562, "u8", "Accept-Encoding: gzip, deflate, br" ], [ 605, "u8", "Accept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\n" ], [ 606, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 641, "u8", "Accept-Encoding: gzip, deflate" ], [ 680, "u8", "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Charset:" ], [ 681, "u8", "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8" ], [ 759, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 794, "u8", "Accept-Charset: iso-8859-1" ], [ 824, "u8", "Accept-Encoding: gzip" ], [ 854, "u8", "Accept: application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5\\r\\nAccept-Charset: iso-8859-" ], [ 855, "u8", "Accept: application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5" ], [ 958, "u8", "Accept-Charset: iso-8859-1" ], [ 993, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\\r\\nAcc" ], [ 994, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" ], [ 1069, "u8", "Accept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1" ], [ 1119, "u8", "Accept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1" ], [ 1172, "u8", "Accept-Charset: utf-8, iso-8859-1;q=0.5" ], [ 1220, "u8", "Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, applicati" ], [ 1221, "u8", "Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, applicati" ], [ 1398, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 1438, "u8", "Accept: text/html, application/xhtml+xml, image/jxr, */*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Charset: utf-8, iso-8859-1;q=0.5\\r\\n" ], [ 1439, "u8", "Accept: text/html, application/xhtml+xml, image/jxr, */*" ], [ 1499, "u8", "Accept-Encoding: gzip" ], [ 1524, "u8", "Accept-Charset: utf-8, iso-8859-1;q=0.5" ], [ 1567, "u8", "Accept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1" ], [ 1625, "u8", "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, " ], [ 1626, "u8", "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, " ], [ 1767, "u8", "Accept-Encoding: gzip" ], [ 1792, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 1827, "u8", "Accept-Charset: utf-8, iso-8859-1;q=0.5" ], [ 1875, "u8", "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\n" ], [ 1876, "u8", "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8" ], [ 1954, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 1994, "u8", "Accept-Charset: utf-8, iso-8859-1;q=0.5\\r\\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\\r\\n" ], [ 1995, "u8", "Accept-Charset: utf-8, iso-8859-1;q=0.5" ], [ 2038, "u8", "Accept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1" ], [ 2096, "u8", "Accept: text/html, application/xhtml+xml\\r\\n" ], [ 2097, "u8", "Accept: text/html, application/xhtml+xml" ], [ 2146, "u8", "Accept-Language: en-US,en;q=0.5\\r\\n" ], [ 2147, "u8", "Accept-Language: en-US,en;q=0.5" ], [ 2187, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\\r\\n" ], [ 2188, "u8", "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8" ], [ 2263, "u8", "Accept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1" ], [ 2318, "u8", "Accept: text/plain;q=0.8,image/png,*/*;q=0.5\\r\\nAccept-Charset: iso-8859-1\\r\\n" ], [ 2319, "u8", "Accept: text/plain;q=0.8,image/png,*/*;q=0.5" ], [ 2367, "u8", "Accept-Charset: iso-8859-1" ], [ 2424, "u8", "Macintosh" ], [ 2425, "u8", "Macintosh" ], [ 2437, "u8", "Windows" ], [ 2438, "u8", "Windows" ], [ 2448, "u8", "X11" ], [ 2449, "u8", "X11" ], [ 2455, "u8", "Android" ], [ 2456, "u8", "Android" ], [ 2466, "u8", "iPhone" ], [ 2467, "u8", "iPhone" ], [ 2496, "u8", "68K" ], [ 2497, "u8", "68K" ], [ 2503, "u8", "PPC" ], [ 2504, "u8", "PPC" ], [ 2510, "u8", "Intel Mac OS X" ], [ 2511, "u8", "Intel Mac OS X" ], [ 2548, "u8", "Win3.11" ], [ 2549, "u8", "Win3.11" ], [ 2559, "u8", "WinNT3.51" ], [ 2560, "u8", "WinNT3.51" ], [ 2572, "u8", "WinNT4.0" ], [ 2573, "u8", "WinNT4.0" ], [ 2584, "u8", "Windows NT 5.0" ], [ 2585, "u8", "Windows NT 5.0" ], [ 2602, "u8", "Windows NT 5.1" ], [ 2603, "u8", "Windows NT 5.1" ], [ 2620, "u8", "Windows NT 5.2" ], [ 2621, "u8", "Windows NT 5.2" ], [ 2638, "u8", "Windows NT 6.0" ], [ 2639, "u8", "Windows NT 6.0" ], [ 2656, "u8", "Windows NT 6.1" ], [ 2657, "u8", "Windows NT 6.1" ], [ 2674, "u8", "Windows NT 6.2" ], [ 2675, "u8", "Windows NT 6.2" ], [ 2692, "u8", "Win 9x 4.90" ], [ 2693, "u8", "Win 9x 4.90" ], [ 2707, "u8", "WindowsCE" ], [ 2708, "u8", "WindowsCE" ], [ 2720, "u8", "Windows XP" ], [ 2721, "u8", "Windows XP" ], [ 2734, "u8", "Windows 7" ], [ 2735, "u8", "Windows 7" ], [ 2747, "u8", "Windows 8" ], [ 2748, "u8", "Windows 8" ], [ 2760, "u8", "Windows NT 10.0; Win64; x64" ], [ 2761, "u8", "Windows NT 10.0; Win64; x64" ], [ 2811, "u8", "Linux i686" ], [ 2812, "u8", "Linux i686" ], [ 2825, "u8", "Linux x86_64" ], [ 2826, "u8", "Linux x86_64" ], [ 2841, "u8", "Linux armv7l" ], [ 2842, "u8", "Linux armv7l" ], [ 2857, "u8", "Linux aarch64" ], [ 2858, "u8", "Linux aarch64" ], [ 2894, "u8", "chrome" ], [ 2895, "u8", "chrome" ], [ 2904, "u8", "spider" ], [ 2905, "u8", "spider" ], [ 2914, "u8", "ie" ], [ 2915, "u8", "ie" ], [ 2920, "u8", "firefox" ], [ 2921, "u8", "firefox" ], [ 2931, "u8", "safari" ], [ 2932, "u8", "safari" ], [ 2961, "u8", ".NET CLR" ], [ 2962, "u8", ".NET CLR" ], [ 2973, "u8", "SV1" ], [ 2974, "u8", "SV1" ], [ 2980, "u8", "Tablet PC" ], [ 2981, "u8", "Tablet PC" ], [ 2993, "u8", "Win64; IA64" ], [ 2994, "u8", "Win64; IA64" ], [ 3008, "u8", "Win64; x64" ], [ 3009, "u8", "Win64; x64" ], [ 3022, "u8", "WOW64" ], [ 3023, "u8", "WOW64" ], [ 3054, "u8", "AdsBot-Google ( http://www.google.com/adsbot.html)" ], [ 3055, "u8", "AdsBot-Google ( http://www.google.com/adsbot.html)" ], [ 3110, "u8", "Baiduspider ( http://www.baidu.com/search/spider.htm)" ], [ 3111, "u8", "Baiduspider ( http://www.baidu.com/search/spider.htm)" ], [ 3169, "u8", "FeedFetcher-Google; ( http://www.google.com/feedfetcher.html)" ], [ 3170, "u8", "FeedFetcher-Google; ( http://www.google.com/feedfetcher.html)" ], [ 3236, "u8", "Googlebot/2.1 ( http://www.googlebot.com/bot.html)" ], [ 3237, "u8", "Googlebot/2.1 ( http://www.googlebot.com/bot.html)" ], [ 3292, "u8", "Googlebot-Image/1.0" ], [ 3293, "u8", "Googlebot-Image/1.0" ], [ 3317, "u8", "Googlebot-News" ], [ 3318, "u8", "Googlebot-News" ], [ 3337, "u8", "Googlebot-Video/1.0" ], [ 3338, "u8", "Googlebot-Video/1.0" ], [ 3388, "u8", "https://www.google.com/search?q=" ], [ 3389, "u8", "https://www.google.com/search?q=" ], [ 3426, "u8", "https://check-host.net/" ], [ 3427, "u8", "https://check-host.net/" ], [ 3455, "u8", "https://www.facebook.com/" ], [ 3456, "u8", "https://www.facebook.com/" ], [ 3486, "u8", "https://www.youtube.com/" ], [ 3487, "u8", "https://www.youtube.com/" ], [ 3516, "u8", "https://www.fbi.com/" ], [ 3517, "u8", "https://www.fbi.com/" ], [ 3542, "u8", "https://www.bing.com/search?q=" ], [ 3543, "u8", "https://www.bing.com/search?q=" ], [ 3578, "u8", "https://r.search.yahoo.com/" ], [ 3579, "u8", "https://r.search.yahoo.com/" ], [ 3611, "u8", "https://www.cia.gov/index.html" ], [ 3612, "u8", "https://www.cia.gov/index.html" ], [ 3647, "u8", "https://vk.com/profile.php?auto=" ], [ 3648, "u8", "https://vk.com/profile.php?auto=" ], [ 3685, "u8", "https://www.usatoday.com/search/results?q=" ], [ 3686, "u8", "https://www.usatoday.com/search/results?q=" ], [ 3733, "u8", "https://help.baidu.com/searchResult?keywords=" ], [ 3734, "u8", "https://help.baidu.com/searchResult?keywords=" ], [ 3784, "u8", "https://steamcommunity.com/market/search?q=" ], [ 3785, "u8", "https://steamcommunity.com/market/search?q=" ], [ 3833, "u8", "https://www.ted.com/search?q=" ], [ 3834, "u8", "https://www.ted.com/search?q=" ], [ 3868, "u8", "https://play.google.com/store/search?q=" ], [ 3869, "u8", "https://play.google.com/store/search?q=" ], [ 3913, "u8", "https://www.reddit.com/search/?q=" ], [ 3914, "u8", "https://www.reddit.com/search/?q=" ], [ 3952, "u8", "https://www.twitter.com/search?q=" ], [ 3953, "u8", "https://www.twitter.com/search?q=" ], [ 3991, "u8", "https://www.amazon.com/s?k=" ], [ 3992, "u8", "https://www.amazon.com/s?k=" ], [ 4338, "u8", "Macintosh" ], [ 4339, "u8", "Macintosh" ], [ 4397, "u8", "Windows" ], [ 4398, "u8", "Windows" ], [ 4454, "u8", "X11" ], [ 4455, "u8", "X11" ], [ 4507, "u8", "Android" ], [ 4508, "u8", "Android" ], [ 4525, "u8", "Linux; Android " ], [ 4526, "u8", "Linux; Android " ], [ 4568, "10", "14" ], [ 4572, "10", "4" ], [ 4577, "u8", "; Mobile" ], [ 4578, "u8", "; Mobile" ], [ 4594, "u8", "iPhone" ], [ 4595, "u8", "iPhone" ], [ 4611, "u8", "iPhone; CPU iPhone OS " ], [ 4612, "u8", "iPhone; CPU iPhone OS " ], [ 4661, "10", "6" ], [ 4664, "10", "12" ], [ 4670, "u8", "_" ], [ 4671, "u8", "_" ], [ 4699, "10", "4" ], [ 4705, "u8", " like Mac OS X" ], [ 4706, "u8", " like Mac OS X" ], [ 4795, "u8", "chrome" ], [ 4796, "u8", "chrome" ], [ 4840, "10", "599" ], [ 4844, "10", "500" ], [ 4851, "10", "500" ], [ 4888, "10", "99" ], [ 4895, "u8", ".0" ], [ 4896, "u8", ".0" ], [ 4925, "10", "9999" ], [ 4934, "u8", "." ], [ 4935, "u8", "." ], [ 4963, "10", "999" ], [ 4978, "u8", "Mozilla/5.0 (" ], [ 4979, "u8", "Mozilla/5.0 (" ], [ 5001, "u8", ") AppleWebKit/" ], [ 5002, "u8", ") AppleWebKit/" ], [ 5029, "u8", ".0 (KHTML, like Gecko) Chrome/" ], [ 5030, "u8", ".0 (KHTML, like Gecko) Chrome/" ], [ 5070, "u8", " Safari/" ], [ 5071, "u8", " Safari/" ], [ 5096, "u8", "firefox" ], [ 5097, "u8", "firefox" ], [ 5139, "10", "99" ], [ 5146, "u8", ".0" ], [ 5147, "u8", ".0" ], [ 5160, "u8", "Mozilla/5.0 (" ], [ 5161, "u8", "Mozilla/5.0 (" ], [ 5183, "u8", "; rv:" ] ], "tgt": [ "br.ReadLine", "bufio.NewReader", "bufio.NewReader().ReadString", "buildHeader", "close", "conn.Close", "conn.Read", "conn.Write", "dialTarget", "fi.Close", "floodWorker", "fmt.Fprintf", "fmt.Printf", "fmt.Println", "getuseragent", "len", "make", "net.Dial", "os.Exit", "os.Open", "os.ReadFile", "rand.Intn", "rand.Seed", "randomString", "strconv.Atoi", "strconv.Itoa", "string", "strings.Contains", "strings.Split", "syscall.Getrlimit", "syscall.Setrlimit", "tcpConn.SetNoDelay", "time.Duration", "time.Now", "time.Now().UnixNano", "time.Sleep", "tls.Dial", "tls.NewLRUClientSessionCache", "u.Port", "url.Parse" ], "val": { "file.stem": "potatos1233", "file.basename": "potatos1233.go", "source.language": "go", "source.imports[0]": "br.ReadLine", "source.imports[1]": "bufio", "source.imports[2]": "bufio.NewReader", "source.imports[3]": "bufio.NewReader.ReadString", "source.imports[4]": "buildHeader", "source.imports[5]": "close", "source.imports[6]": "conn.Close", "source.imports[7]": "conn.Read", "source.imports[8]": "conn.Write", "source.imports[9]": "crypto/tls", "source.strings[0]": "\n HTTP Flooder - potatos1233\n\t°ᜊ° \n\t", "source.strings[1]": " (KHTML, like Gecko) Version/", "source.strings[2]": " HTTP/1.1", "source.strings[3]": " HTTP/1.1\\r\\nHost: ", "source.strings[4]": " Safari/", "source.strings[5]": " like Mac OS X", "source.strings[6]": ") AppleWebKit/", "source.strings[7]": ") Gecko/20100101 Firefox/", "source.strings[8]": ".0 (KHTML, like Gecko) Chrome/", "source.strings[9]": ".0 Safari/", "source.has_imports": true, "source.imports[10]": "dialTarget", "source.imports[11]": "fi.Close", "source.imports[12]": "floodWorker", "source.imports[13]": "fmt", "source.imports[14]": "fmt.Fprintf", "source.imports[15]": "fmt.Printf", "source.imports[16]": "fmt.Println", "source.imports[17]": "getuseragent", "source.imports[18]": "io", "source.imports[19]": "len", "source.imports[20]": "make", "source.imports[21]": "math/rand", "source.imports[22]": "net", "source.imports[23]": "net.Dial", "source.imports[24]": "net/url", "source.imports[25]": "os", "source.imports[26]": "os.Exit", "source.imports[27]": "os.Open", "source.imports[28]": "os.ReadFile", "source.imports[29]": "rand.Intn", "source.imports[30]": "rand.Seed", "source.imports[31]": "randomString", "source.imports[32]": "strconv", "source.imports[33]": "strconv.Atoi", "source.imports[34]": "strconv.Itoa", "source.imports[35]": "string", "source.imports[36]": "strings", "source.imports[37]": "strings.Contains", "source.imports[38]": "strings.Split", "source.imports[39]": "syscall", "source.imports[40]": "syscall.Getrlimit", "source.imports[41]": "syscall.Setrlimit", "source.imports[42]": "tcpConn.SetNoDelay", "source.imports[43]": "time", "source.imports[44]": "time.Duration", "source.imports[45]": "time.Now", "source.imports[46]": "time.Now.UnixNano", "source.imports[47]": "time.Sleep", "source.imports[48]": "tls.Dial", "source.imports[49]": "tls.NewLRUClientSessionCache", "source.imports[50]": "u.Port", "source.imports[51]": "url.Parse", "source.strings[10]": ".NET CLR", "source.strings[11]": "; Mobile", "source.strings[12]": "Accept-Charset: iso-8859-1", "source.strings[13]": "Accept-Charset: utf-8, iso-8859-1;q=0.5", "source.strings[14]": "Accept-Charset: utf-8, iso-8859-1;q=0.5\\r\\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\\r\\n", "source.strings[15]": "Accept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1", "source.strings[16]": "Accept-Encoding: gzip", "source.strings[17]": "Accept-Encoding: gzip, deflate", "source.strings[18]": "Accept-Encoding: gzip, deflate, br", "source.strings[19]": "Accept-Encoding: gzip, deflate, br\\r\\n", "source.strings[20]": "Accept-Language: en-US,en;q=0.5", "source.strings[21]": "Accept-Language: en-US,en;q=0.5\\r\\n", "source.strings[22]": "Accept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\n", "source.strings[23]": "Accept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1", "source.strings[24]": "Accept: application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5", "source.strings[25]": "Accept: application/xml,application/xhtml+xml,text/html;q=0.9, text/plain;q=0.8,image/png,*/*;q=0.5\\r\\nAccept-Charset: iso-8859-1\\r\\n", "source.strings[26]": "Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/msword, */*", "source.strings[27]": "Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, application/x-shockwave-flash, application/msword, */*\\r\\nAccept-Language: en-US,en;q=0.5\\r\\n", "source.strings[28]": "Accept: text/html, application/xhtml+xml", "source.strings[29]": "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8", "source.strings[30]": "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\n", "source.strings[31]": "Accept: text/html, application/xhtml+xml, application/xml;q=0.9, */*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Charset: iso-8859-1\\r\\nAccept-Encoding: gzip\\r\\n", "source.strings[32]": "Accept: text/html, application/xhtml+xml, image/jxr, */*", "source.strings[33]": "Accept: text/html, application/xhtml+xml, image/jxr, */*\\r\\nAccept-Encoding: gzip\\r\\nAccept-Charset: utf-8, iso-8859-1;q=0.5\\r\\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\\r\\n", "source.strings[34]": "Accept: text/html, application/xhtml+xml\\r\\n", "source.strings[35]": "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1", "source.strings[36]": "Accept: text/html, application/xml;q=0.9, application/xhtml+xml, image/png, image/webp, image/jpeg, image/gif, image/x-xbitmap, */*;q=0.1\\r\\nAccept-Encoding: gzip\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Charset: utf-8, iso-8859-1;q=0.5\\r\\n", "source.strings[37]": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "source.strings[38]": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\\r\\n", "source.strings[39]": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Encoding: br;q=1.0, gzip;q=0.8, *;q=0.1\\r\\nAccept-Language: utf-8, iso-8859-1;q=0.5, *;q=0.1\\r\\nAccept-Charset: utf-8, iso-8859-1;q=0.5\\r\\n", "source.strings[40]": "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\\r\\nAccept-Language: en-US,en;q=0.5\\r\\nAccept-Encoding: gzip, deflate\\r\\n", "source.strings[41]": "Accept: text/plain;q=0.8,image/png,*/*;q=0.5", "source.strings[42]": "Accept: text/plain;q=0.8,image/png,*/*;q=0.5\\r\\nAccept-Charset: iso-8859-1\\r\\n", "source.strings[43]": "AdsBot-Google ( http://www.google.com/adsbot.html)", "source.strings[44]": "Android", "source.strings[45]": "Baiduspider ( http://www.baidu.com/search/spider.htm)", "source.strings[46]": "CONNECT %s HTTP/1.1", "source.strings[47]": "CONNECT %s HTTP/1.1\\r\\nHost: %s\\r\\n\\r\\n", "source.strings[48]": "Cache-Control: max-age=0", "source.strings[49]": "Connection: Keep-Alive", "source.strings[50]": "Connection: Keep-Alive\\r\\nCache-Control: max-age=0\\r\\n", "source.strings[51]": "Connection: Keep-Alive\\r\\nContent-Type: application/x-www-form-urlencoded\\r\\nContent-Length: ", "source.strings[52]": "Content-Length: ", "source.strings[53]": "Content-Type: application/x-www-form-urlencoded", "source.strings[54]": "Error: %s", "source.strings[55]": "Error: %s\\n", "source.strings[56]": "Example with proxies: go run ratline.go site.com 1000 get 120 nil proxies.txt", "source.strings[57]": "Example: go run ratline.go site.com 1000 get 60 nil", "source.strings[58]": "FeedFetcher-Google; ( http://www.google.com/feedfetcher.html)", "source.strings[59]": "Flood active for %d seconds...", "source.strings[60]": "Flood active for %d seconds...\\n", "source.strings[61]": "Flood complete.", "source.strings[62]": "Googlebot-Image/1.0", "source.strings[63]": "Googlebot-News", "source.strings[64]": "Googlebot-Video/1.0", "source.strings[65]": "Googlebot/2.1 ( http://www.googlebot.com/bot.html)", "source.strings[66]": "Host: ", "source.strings[67]": "Host: %s", "source.strings[68]": "Intel Mac OS X", "source.strings[69]": "Invalid URL", "source.strings[70]": "Linux aarch64", "source.strings[71]": "Linux armv7l", "source.strings[72]": "Linux i686", "source.strings[73]": "Linux x86_64", "source.strings[74]": "Linux; Android ", "source.strings[75]": "Loaded %d proxies", "source.strings[76]": "Loaded %d proxies\\n", "source.strings[77]": "Macintosh", "source.strings[78]": "Mode must be 'get' or 'post", "source.strings[79]": "Mozilla/5.0 (", "source.strings[80]": "Mozilla/5.0 (compatible; MSIE ", "source.strings[81]": "Press ENTER", "source.strings[82]": "Referer: ", "source.strings[83]": "Tablet PC", "source.strings[84]": "Target: %s | Threads: %d | Duration: %ds", "source.strings[85]": "Target: %s | Threads: %d | Duration: %ds\\n", "source.strings[86]": "Trident/", "source.strings[87]": "Usage: go run ratline.go \u003curl\u003e \u003cthreads\u003e \u003cget/post\u003e \u003cseconds\u003e \u003cheader.txt/nil\u003e [proxy.txt]", "source.strings[88]": "User-Agent: ", "source.strings[89]": "Win 9x 4.90", "source.strings[90]": "Win3.11", "source.strings[91]": "Win64; IA64", "source.strings[92]": "Win64; x64", "source.strings[93]": "WinNT3.51", "source.strings[94]": "WinNT4.0", "source.strings[95]": "Windows", "source.strings[96]": "Windows 7", "source.strings[97]": "Windows 8", "source.strings[98]": "Windows NT 10.0; Win64; x64", "source.strings[99]": "Windows NT 5.0", "source.functions[0]": "buildHeader", "source.functions[1]": "dialTarget", "source.functions[2]": "floodWorker", "source.functions[3]": "getuseragent", "source.functions[4]": "init", "source.functions[5]": "main", "source.functions[6]": "randomString", "source.strings[100]": "Windows NT 5.1", "source.strings[101]": "Windows NT 5.2", "source.strings[102]": "Windows NT 6.0", "source.strings[103]": "Windows NT 6.1", "source.strings[104]": "Windows NT 6.2", "source.strings[105]": "Windows XP", "source.strings[106]": "WindowsCE", "source.strings[107]": "X-Forwarded-For: ", "source.strings[108]": "asdfghjklqwertyuiopzxcvbnmASDFGHJKLQWERTYUIOPZXCVBNM0123456789", "source.strings[109]": "chrome", "source.strings[110]": "crypto/tls", "source.strings[111]": "firefox", "source.strings[112]": "https://check-host.net/", "source.strings[113]": "https://help.baidu.com/searchResult?keywords=", "source.strings[114]": "https://play.google.com/store/search?q=", "source.strings[115]": "https://r.search.yahoo.com/", "source.strings[116]": "https://steamcommunity.com/market/search?q=", "source.strings[117]": "https://vk.com/profile.php?auto=", "source.strings[118]": "https://www.amazon.com/s?k=", "source.strings[119]": "https://www.bing.com/search?q=", "source.strings[120]": "https://www.cia.gov/index.html", "source.strings[121]": "https://www.facebook.com/", "source.strings[122]": "https://www.fbi.com/", "source.strings[123]": "https://www.google.com/search?q=", "source.strings[124]": "https://www.reddit.com/search/?q=", "source.strings[125]": "https://www.ted.com/search?q=", "source.strings[126]": "https://www.twitter.com/search?q=", "source.strings[127]": "https://www.usatoday.com/search/results?q=", "source.strings[128]": "https://www.youtube.com/", "source.strings[129]": "iPhone", "source.strings[130]": "iPhone; CPU iPhone OS ", "source.strings[131]": "math/rand", "source.strings[132]": "net/url", "source.strings[133]": "safari", "source.strings[134]": "spider", "source.strings[135]": "strconv", "source.strings[136]": "strings", "source.strings[137]": "syscall" } }, "find": [ { "id": "objectives/impact/wipe/disk/overwrite::go-math-rand-pkg", "atk": "T1485", "conf": 1.0, "crit": 1, "desc": "Go math/rand import" }, { "id": "micro-behaviors/data/text/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection" }, { "id": "micro-behaviors/crypto/symmetric/aes/library::go-hardcoded-random-aes-key--rx-3", "mbc": "C0021.001", "conf": 0.9200000166893005, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-endpoint-script", "atk": "T1071.001", "mbc": "C0002", "conf": 0.800000011920929, "crit": 3, "desc": "URL targets .php endpoint" }, { "id": "micro-behaviors/fs/file/write/direct::go-write-method-call", "atk": "T1041", "conf": 1.0, "crit": 1, "desc": "Go Write/WriteAt method call" }, { "id": "metadata/file/text/format::vocab-string", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary string" }, { "id": "micro-behaviors/communications/http/url/php-endpoint::url-php-query-script", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8500000238418579, "crit": 3, "desc": "URL targets .php with query" }, { "id": "metadata/file/text/format::vocab-invalid", "conf": 0.9700000286102295, "crit": 1, "desc": "Validation vocabulary invalid" }, { "id": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "conf": 0.20000000298023224, "crit": 1, "desc": "crypto keyword (word match)" }, { "id": "micro-behaviors/fs/file/open::os-open", "conf": 0.8999999761581421, "crit": 2, "desc": "Open file via os.Open" }, { "id": "micro-behaviors/communications/socket/ssl::insecure-skip-verify", "conf": 0.800000011920929, "crit": 3, "desc": "InsecureSkipVerify (Go)" }, { "id": "micro-behaviors/data/text/keywords/credential::credential-field", "conf": 0.8399999737739563, "crit": 1, "desc": "password/token/api_key field keyword" }, { "id": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "conf": 0.20000000298023224, "crit": 1, "desc": "crypto keyword (substr, catches imports)" }, { "id": "micro-behaviors/data/text/keywords/lexicon::token", "conf": 0.30000001192092896, "crit": 1, "desc": "token keyword" }, { "id": "micro-behaviors/fs/file/read::os-readfile", "conf": 0.8999999761581421, "crit": 3, "desc": "Read file contents via os.ReadFile" }, { "id": "objectives/command-and-control/remote-command/shell::go-command-output-socket-write--rx-1", "atk": "T1059", "conf": 0.8799999952316284, "crit": 1, "desc": "fmt writes command output to socket" }, { "id": "micro-behaviors/communications/socket/connect::dial", "atk": "T1071", "mbc": "C0001", "conf": 0.8500000238418579, "crit": 3, "desc": "Go net.Dial call" }, { "id": "micro-behaviors/data/text/format::webp-token", "conf": 0.699999988079071, "crit": 1, "desc": "WebP image format token" }, { "id": "micro-behaviors/data/text/keywords/lexicon::tmp", "conf": 0.20000000298023224, "crit": 1, "desc": "tmp keyword" }, { "id": "micro-behaviors/time/sleep/interval::go-time-sleep", "conf": 0.75, "crit": 2, "desc": "Go time.Sleep delay call" }, { "id": "objectives/evasion/indicator-removal/audit::go-audit-redirect-clear", "atk": "T1070.002", "conf": 0.8799999952316284, "crit": 1, "desc": "Go audit log redirect clear" } ], "path": "potatos1233.go", "risk": 3, "size": 10728, "type": "go" } ] } }