{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9141377806663513, "class": 0 } ], "prob": 0.9141378, "class": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T18:41:22Z" }, "path": "x86__64__lsb__unix-system-v__llvm-obfuscator-3.4.0__O1__mllvmsub__unstripped__util-linux-2.33__umount", "raw": { "v": "4", "fs": [ { "f": "O₃(ErCI₂)H₃(F₂HfPo)Md₂(HeBi₂)", "x": 7, "id": 0, "is": [ "", "mnt_table_set_parser_errcb", "mnt_context_is_restricted", "free", "mnt_unref_table", "mnt_context_next_umount", "errno_location", "mnt_context_helper_executed", "strncmp", "ITM_deregisterTMCloneTable", "exit", "secure_getenv", "fpending", "mnt_context_enable_fake", "warn", "ferror", "mnt_context_switch_ns", "mnt_table_next_fs", "textdomain", "mnt_new_iter", "mnt_context_get_cache", "mnt_context_disable_swapmatch", "fclose", "mnt_context_find_umount_fs", "bindtextdomain", "dcgettext", "strlen", "mnt_get_library_features", "getuid", "getopt_long", "errx", "strchr", "printf", "warnx", "mnt_context_umount", "snprintf", "strrchr", "mnt_new_table", "fputs", "memset", "mnt_context_disable_helpers", "geteuid", "getcwd", "mnt_context_set_tables_errcb", "mnt_new_context", "fputc", "strdup", "memchr", "libc_start_main", "environ", "fgets", "mnt_fs_get_target", "mnt_context_switch_target_ns", "fprintf", "gmon_start__", "environ", "mnt_fs_get_srcpath", "realpath", "memcpy", "mnt_context_enable_loopdel", "prctl", "getgid", "xstat", "mnt_init_debug", "mnt_context_syscall_called", "err", "mnt_context_set_target", "malloc", "mnt_context_get_target", "mnt_context_get_excode", "mnt_free_iter", "mnt_context_is_verbose", "mnt_context_set_target_ns", "getegid", "mnt_table_set_cache", "mnt_context_enable_lazy", "mnt_table_find_target", "setlocale", "mnt_context_enable_force", "mnt_fs_get_devno", "mnt_context_get_source", "mnt_get_library_version", "mnt_reset_context", "access", "mnt_context_enable_rdonly_umount", "fopen", "Jv_RegisterClasses", "mnt_context_set_options_pattern", "mnt_free_context", "mnt_context_disable_canonicalize", "strtoul", "mnt_context_set_fstype_pattern", "cxa_atexit", "environ", "exit", "fwrite", "mnt_context_enable_verbose", "mnt_table_next_child_fs", "ITM_registerTMCloneTable", "mnt_context_disable_mtab", "mnt_table_parse_file", "mnt_tag_is_valid", "setegid", "ctype_b_loc", "mnt_context_get_status", "seteuid", "mnt_context_get_syscall_errno" ], "ms": { "elf": { "e_type": 2.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "rpath_set": true, "class_bits": 64.0, "note_count": 1.0, "nx_enabled": true, "entry_point": 4205040.0, "needed_libs": 5.0, "rpath_count": 1.0, "dynsym_count": 113.0, "has_eh_frame": true, "symtab_count": 212.0, "dynrela_count": 7.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 99.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "program_header_count": 8.0, "section_header_count": 31.0, "load_segment_max_p_memsz": 24004.0, "load_segment_max_p_filesz": 24004.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 9243.0, "file_size": 37520.0, "entry_point": 4205040.0, "has_overlay": true, "code_entropy": 3.97, "data_entropy": 2.09, "export_count": 117.0, "import_count": 107.0, "overlay_size": 1985.0, "string_count": 404.0, "overlay_ratio": 0.05, "section_count": 30.0, "avg_complexity": 2.67, "function_count": 142.0, "import_density": 11.85, "max_complexity": 65.0, "string_density": 44.76, "aliased_exports": 98.0, "overall_entropy": 2.78, "overlay_entropy": 1.54, "avg_basic_blocks": 3.27, "avg_section_size": 1148.73, "dependency_count": 5.0, "entropy_variance": 1.63, "function_density": 15.73, "avg_function_size": 55.64, "avg_string_length": 20.14, "complexity_per_kb": 0.3, "max_string_length": 96.0, "avg_string_entropy": 3.31, "code_to_data_ratio": 0.37, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.2, "total_basic_blocks": 465.0, "string_length_stddev": 14.27, "largest_section_ratio": 0.2, "sentence_string_count": 42.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.02, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0, "runtime_search_path_count": 1.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 0, "textdomain" ], [ 512, "/lib64/ld-linux-x86-64.so.2" ], [ 4137, "libmount.so.1" ], [ 4151, "mnt_unref_table" ], [ 4167, "_ITM_deregisterTMCloneTable" ], [ 4195, "mnt_context_get_cache" ], [ 4217, "mnt_context_get_source" ], [ 4240, "mnt_context_set_target" ], [ 4263, "mnt_table_next_fs" ], [ 4281, "mnt_context_enable_loopdel" ], [ 4308, "mnt_table_set_parser_errcb" ], [ 4335, "mnt_init_debug" ], [ 4350, "mnt_context_get_target" ], [ 4373, "mnt_new_table" ], [ 4387, "mnt_free_iter" ], [ 4401, "mnt_get_library_features" ], [ 4426, "mnt_context_is_verbose" ], [ 4449, "mnt_context_find_umount_fs" ], [ 4476, "mnt_context_get_excode" ], [ 4499, "mnt_fs_get_srcpath" ], [ 4518, "mnt_new_context" ], [ 4534, "mnt_context_set_tables_errcb" ], [ 4563, "mnt_context_set_target_ns" ], [ 4589, "mnt_new_iter" ], [ 4602, "mnt_table_find_target" ], [ 4624, "mnt_context_set_fstype_pattern" ], [ 4655, "mnt_context_is_restricted" ], [ 4681, "mnt_context_enable_fake" ], [ 4705, "mnt_context_get_status" ], [ 4728, "__gmon_start__" ], [ 4743, "mnt_table_next_child_fs" ], [ 4767, "mnt_free_context" ], [ 4784, "mnt_context_helper_executed" ], [ 4812, "mnt_context_disable_mtab" ], [ 4837, "mnt_get_library_version" ], [ 4861, "mnt_context_disable_swapmatch" ], [ 4891, "mnt_context_enable_verbose" ], [ 4918, "mnt_context_syscall_called" ], [ 4945, "mnt_tag_is_valid" ], [ 4962, "mnt_context_switch_ns" ], [ 4984, "mnt_context_enable_rdonly_umount" ], [ 5017, "mnt_fs_get_target" ], [ 5035, "mnt_table_set_cache" ], [ 5055, "_Jv_RegisterClasses" ], [ 5075, "mnt_context_next_umount" ], [ 5099, "mnt_context_umount" ], [ 5118, "mnt_reset_context" ], [ 5136, "mnt_context_enable_force" ], [ 5161, "_ITM_registerTMCloneTable" ], [ 5187, "mnt_context_disable_helpers" ], [ 5215, "mnt_context_switch_target_ns" ], [ 5244, "mnt_fs_get_devno" ], [ 5261, "mnt_context_set_options_pattern" ], [ 5293, "mnt_context_disable_canonicalize" ], [ 5326, "mnt_context_get_syscall_errno" ], [ 5356, "mnt_context_enable_lazy" ], [ 5380, "mnt_table_parse_file" ], [ 5401, "libblkid.so.1" ], [ 5415, "libuuid.so.1" ], [ 5428, "librt.so.1" ], [ 5449, "setlocale" ], [ 5459, "fopen" ], [ 5465, "strncmp" ], [ 5473, "optind" ], [ 5480, "strrchr" ], [ 5488, "__strdup" ], [ 5497, "dcgettext" ], [ 5519, "memchr" ], [ 5532, "strlen" ], [ 5545, "memset" ], [ 5557, "__errno_location" ], [ 5574, "stdout" ], [ 5593, "memcpy" ], [ 5600, "fclose" ], [ 5607, "strtoul" ], [ 5615, "malloc" ], [ 5622, "realpath" ], [ 5631, "setegid" ], [ 5639, "getgid" ], [ 5646, "__ctype_b_loc" ], [ 5660, "optarg" ], [ 5667, "stderr" ], [ 5674, "seteuid" ], [ 5682, "getuid" ], [ 5689, "getegid" ], [ 5697, "getopt_long" ], [ 5709, "getcwd" ], [ 5716, "fwrite" ], [ 5723, "geteuid" ], [ 5731, "__fpending" ], [ 5749, "secure_getenv" ], [ 5763, "fprintf" ], [ 5771, "program_invocation_short_name" ], [ 5806, "bindtextdomain" ], [ 5821, "access" ], [ 5828, "__libc_start_main" ], [ 5846, "ferror" ], [ 5853, "snprintf" ], [ 5862, "free" ], [ 5867, "__progname" ], [ 5878, "__environ" ], [ 5888, "__cxa_atexit" ], [ 5901, "__xstat" ], [ 5909, "/tmp/util-linux/_out/lib" ], [ 5934, "GLIBC_2.14" ], [ 5955, "GLIBC_2.17" ], [ 5978, "MOUNT_2.25" ], [ 5989, "MOUNT_2.30" ], [ 6000, "MOUNT_2.20" ], [ 6011, "MOUNT_2.23" ], [ 6022, "MOUNT_2.22" ], [ 6033, "MOUNT_2.33" ], [ 6044, "MOUNT_2.21" ], [ 6055, "MOUNT_2.24" ], [ 6066, "MOUNT_2.19" ], [ 10992, "UAWAVAUATSH" ], [ 11857, "ffffff." ], [ 12338, "fffff." ], [ 12544, "UAVSI" ], [ 12800, "AWAVS1" ], [ 13152, "AVSPH" ], [ 14080, "AVSPI" ], [ 15056, "UAWAVSPI" ], [ 15296, "USPH" ], [ 15424, "UAVSH" ], [ 15792, "AWAVSI" ], [ 16000, "UAWAVAUATSPI" ], [ 16528, "AWAVSH" ], [ 17296, "UAWAVATSH" ], [ 17472, "UAWAVAUATSPH" ], [ 18144, "AWAVA" ], [ 18151, "AUATL" ], [ 19556, "all-targets" ], [ 19568, "detach-loop" ], [ 19580, "fake" ], [ 19585, "force" ], [ 19591, "internal-only" ], [ 19610, "no-canonicalize" ], [ 19626, "no-mtab" ], [ 19634, "quiet" ], [ 19640, "read-only" ], [ 19650, "recursive" ], [ 19660, "test-opts" ], [ 19676, "verbose" ], [ 19684, "util-linux" ], [ 19695, "/tmp/util-linux/_out/share/locale" ], [ 19729, "libmount context allocation failed" ], [ 19764, "aAcdfhilnRrO:t:vVN:" ], [ 19784, "hdilqVv" ], [ 19792, "failed to set options pattern" ], [ 19838, "failed to set target namespace to %s" ], [ 19875, "Try '%s --help' for more information." ], [ 19914, "noproc,nodevfs,nodevpts,nosysfs,norpc_pipefs,nonfsd,noselinuxfs" ], [ 19978, "bad usage" ], [ 19988, "failed to set umount target" ], [ 20016, "%s (%s) unmounted" ], [ 20034, "%s unmounted" ], [ 20059, "%s: not mounted" ], [ 20075, "%s: not found" ], [ 20089, "libmount iterator allocation failed" ], [ 20125, "failed to get child fs of %s" ], [ 20154, "failed to switch namespace" ], [ 20181, "libmount table allocation failed" ], [ 20214, "/proc/self/mountinfo" ], [ 20235, "failed to parse %s" ], [ 20254, "%s: failed to determine source (--all-targets is unsupported on systems with regular mtab file)." ], [ 20351, "failed to initialize libmount iterator" ], [ 20390, "%-25s: ignored" ], [ 20406, "%-25s: successfully unmounted" ], [ 20437, "%s from %s (libmount %s" ], [ 20461, "util-linux 2.33" ], [ 20523, "%1$s [options] \u003csource\u003e | \u003cdirectory\u003e" ], [ 20563, "Unmount filesystems." ], [ 20646, "-A, --all-targets unmount all mountpoints for the given device in the" ], [ 20723, "current namespace" ], [ 20769, "-c, --no-canonicalize don't canonicalize paths" ], [ 20820, "-d, --detach-loop if mounted loop device, also free this loop device" ], [ 20959, "-f, --force force unmount (in case of an unreachable NFS system)" ], [ 21038, "-i, --internal-only don't call the umount.\u003ctype\u003e helpers" ], [ 21101, "-n, --no-mtab don't write to /etc/mtab" ], [ 21152, "-l, --lazy detach the filesystem now, clean up things later" ], [ 21227, "-O, --test-opts \u003clist\u003e limit the set of filesystems (use with -a)" ], [ 21296, "-R, --recursive recursively unmount a target with all its children" ], [ 21373, "-r, --read-only in case unmounting fails, try to remount read-only" ], [ 21450, "-t, --types \u003clist\u003e limit the set of filesystem types" ], [ 21559, "-q, --quiet suppress 'not mounted' error messages" ], [ 21623, "-N, --namespace \u003cns\u003e perform umount in another namespace" ], [ 21685, "%-25s%s" ], [ 21714, "display this help" ], [ 21732, "-V, --version" ], [ 21747, "display version" ], [ 21763, "For more details see %s." ], [ 21790, "umount(8)" ], [ 21800, "%s: mutually exclusive arguments:" ], [ 21845, "!(opts == NULL)" ], [ 21861, "./include/optutils.h" ], [ 21882, "const char *option_to_longopt(int, const struct option *)" ], [ 21940, "only root can use \"--%s\" option (effective UID is %u)" ], [ 21994, "only root can do that (effective UID is %u)" ], [ 22038, "only root can use \"--%s\" option" ], [ 22070, "only root can do that" ], [ 22092, "%s: parse error at line %d -- ignored" ], [ 22130, "write error" ], [ 22142, "%s/sys/block/%s/dm/name" ], [ 22169, "/dev/mapper/%s" ], [ 22192, "LANG=" ], [ 22212, "BASH_ENV=" ], [ 22222, "HOME=" ], [ 22233, "KRB_CONF=" ], [ 22256, "MAIL=" ], [ 22271, "SHELL=" ], [ 22278, "SHLIB_PATH=" ], [ 26144, "GCC: (Ubuntu 5.5.0-12ubuntu1~16.04) 5.5.0 20171010" ], [ 26195, "Obfuscator-clang version 3.4 (tags/RELEASE_34/final) (based on LLVM 3.4svn)" ], [ 31361, "crtstuff.c" ], [ 31372, "__JCR_LIST__" ], [ 31385, "deregister_tm_clones" ], [ 31406, "__do_global_dtors_aux" ], [ 31428, "completed.7596" ], [ 31443, "__do_global_dtors_aux_fini_array_entry" ], [ 31482, "frame_dummy" ], [ 31494, "__frame_dummy_init_array_entry" ], [ 31525, "sys-utils/umount.c" ], [ 31544, "c_isgraph" ], [ 31554, "close_stdout" ], [ 31567, "close_stream" ], [ 31580, "err_exclusive_options" ], [ 31602, "exit_non_root" ], [ 31616, "main.excl" ], [ 31626, "main.longopts" ], [ 31640, "mk_exit_code" ], [ 31653, "new_mountinfo" ], [ 31667, "option_to_longopt" ], [ 31685, "parse_pid" ], [ 31695, "print_version" ], [ 31715, "sanitize_path" ], [ 31729, "success_message" ], [ 31745, "table_parser_errcb" ], [ 31764, "umount_all" ], [ 31775, "umount_alltargets" ], [ 31793, "umount_do_recurse" ], [ 31811, "umount_one" ], [ 31822, "umount_one_if_mounted" ], [ 31844, "umount_recursive" ], [ 31867, "lib/canonicalize.c" ], [ 31886, "is_dm_devname" ], [ 31900, "is_relative_path" ], [ 31917, "startswith" ], [ 31928, "lib/env.c" ], [ 31938, "forbid" ], [ 31945, "noslash" ], [ 31953, "__FRAME_END__" ], [ 31967, "__JCR_END__" ], [ 31979, "__init_array_end" ], [ 31996, "_DYNAMIC" ], [ 32005, "__init_array_start" ] ], "sz": 37520, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libmount.so.1", "libblkid.so.1", "libuuid.so.1", "librt.so.1", "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF RPATH entry", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking::elf-rpath", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 142.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1036.005", "c": 0.8999999761581421, "d": "prctl system call symbol", "e": [ "prctl" ], "i": "objectives/evasion/masquerade/identity::prctl-symbol", "l": 3, "m": "F0004" }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "bf e0 f7 ff ff", "bf 95 f7 ff ff", "be 8a f2 ff ff", "be 44 f2 ff ff", "bf a5 ec ff ff", "bf 34 eb ff ff", "bf f7 e8 ff ff", "bf 0b e8 ff ff", "ba 23 e1 ff ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "c": 0.6000000238418579, "d": "/etc/mtab mount table file", "e": [ "-n, --no-mtab don't write to /etc/mtab" ], "i": "micro-behaviors/fs/volume/fstab::etc-mtab", "l": 2 }, { "d": ".so extension reference", "e": [ ".so", ".so", ".so", ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "loop if" ], "i": "micro-behaviors/crypto/symmetric/xor::asm-loop-control-transfer", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 117.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.800000011920929, "d": "Drop privileges (setuid after getuid)", "e": [ "setegid", "seteuid" ], "i": "micro-behaviors/process/identity/setuid::drop-privs", "l": 2 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "x86__64__lsb__unix-system-v__llvm-obfuscator-3.4.0__O1__mllvmsub__unstripped__util-linux-2.33__umount" ], "i": "metadata/binary/metrics::small-elf-binary", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.6600000262260437, "d": "Resolve symbolic links to canonical", "e": [ "realpath", "realpath@@GLIBC_2.3", "sym.imp.realpath" ], "i": "micro-behaviors/fs/link/symlink::symlink-resolve", "l": 2 }, { "d": "Get effective user ID", "e": [ "geteuid" ], "i": "micro-behaviors/os/privilege/query::geteuid", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.67" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.31" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "-n, --no-mtab don't write to /etc/mtab" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "d": "Get effective group ID", "e": [ "getegid" ], "i": "micro-behaviors/os/privilege/query::getegid", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 37520.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.78" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "CLI help or usage text", "e": [ "Try '%s --help' for more information." ], "i": "metadata/binary/metrics::help-usage-string", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 117.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "d": "Get user ID", "e": [ "getuid" ], "i": "micro-behaviors/os/privilege/query::getuid", "l": 2 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC", "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/util", "/tmp/util" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "RPATH/RUNPATH set (library injection vector)", "e": [ "elf.rpath_set = 1.00" ], "i": "metadata/hardening::rpath-set", "l": 3 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "d": "Get group ID", "e": [ "getgid" ], "i": "micro-behaviors/os/privilege/query::getgid", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 117.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Version information string", "e": [ "--version" ], "i": "metadata/package/help::version-text", "l": 2 }, { "c": 0.800000011920929, "d": "Compiler/project context token", "e": [ "clang version" ], "i": "micro-behaviors/dylib/library::llvm-project-ref-b", "l": 2 }, { "a": "T1082", "d": "/sys/block/ path", "e": [ "%s/sys/block/%s/dm/name" ], "i": "micro-behaviors/fs/disk/paths::sys-block", "l": 2, "m": "E1082" }, { "c": 0.699999988079071, "d": "Uses device mapper framework", "e": [ "/dev/mapper/%s" ], "i": "micro-behaviors/hardware/block/device::dev-mapper", "l": 3 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 117.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 117.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "c": 1.0, "d": "find target pattern", "e": [ "find_target", "find_target" ], "i": "objectives/impact/infect/marker::find-target-pattern", "l": 1 }, { "c": 0.6600000262260437, "d": "Write single bytes to file", "e": [ "fputc" ], "i": "micro-behaviors/fs/file/write::fputc", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 142.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.4000000059604645, "d": "Terminate process immediately without cleanup", "e": [ "exit", "exit" ], "i": "micro-behaviors/process/terminate/signal::_exit", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "stat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 142.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "d": "Characteristic system library export __cxa_atexit", "e": [ "cxa_atexit" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-atexit", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 107.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 30.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 0.6000000238418579, "d": "Set user ID (capability)", "e": [ "seteuid" ], "i": "micro-behaviors/process/identity/setuid::setuid-dup", "l": 3 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 3 }, { "c": 0.6000000238418579, "d": "Set group ID (capability)", "e": [ "setegid" ], "i": "micro-behaviors/process/identity/setuid::setgid", "l": 3 }, { "c": 0.6600000262260437, "d": "Read mount info from /proc/self/mountinfo", "e": [ "/proc/self/mountinfo" ], "i": "micro-behaviors/fs/proc/mounts::mounts-mountinfo", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libmount.so.1", "libblkid.so.1", "libuuid.so.1", "librt.so.1", "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.4000000059604645, "d": "SIGHUP signal ignore pattern (x86_64)", "e": [ "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::sig-ign-sighup-x64", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "stat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.67" ], "i": "metadata/binary/metrics::low-average-complexity", "l": 2 }, { "c": 1.0, "d": "ELF RPATH metadata", "e": [ "/tmp/util-linux/_out/lib" ], "i": "metadata/binary/linking/runtime::elf-rpath", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/tmp/util-linux/_out/lib", "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/share/locale", "/tmp/util-linux/_out/lib" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 } ], "sha": "32118da60cd9226e76e7a61ba856c0d8af77087edfb72343c82376912556697d", "path": "x86__64__lsb__unix-system-v__llvm-obfuscator-3.4.0__O1__mllvmsub__unstripped__util-linux-2.33__umount", "type": "elf" } ], "tv": "feb13" } }