{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8383554220199585, "class": 0 } ], "prob": 0.8383554, "class": 0, "models": [ { "m": "az", "prob": 0.8383554, "class": 0 }, { "m": "az/source", "prob": 0.24252604, "class": 0 }, { "m": "az/c", "prob": 0.39269912, "class": 0 } ], "version": "v17.17", "thresholds": [ 0.999503, 0.9998882 ], "analyzed_at": "2026-05-25T19:19:51Z" }, "path": "main.c", "raw": { "v": "5", "fs": [ { "f": "O(Er)H(F)", "x": 32, "ff": { "i": [ [ "", "srand" ], [ "", "time" ], [ "", "getPayloadEncoder" ], [ "", "evasionOnce" ], [ "", "printf" ], [ "", "sec" ], [ "", "isDebuggerPresent" ], [ "", "checkHypervisorFlag" ], [ "", "checkDmiID" ], [ "", "evadeHoneypot" ], [ "", "checkVMFiles" ], [ "", "checkContainer" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "strncmp" ], [ "", "atoi" ], [ "", "fclose" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "fileHas" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "splitStr" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "joinPath" ], [ "", "joinPath" ], [ "", "joinPath" ], [ "", "fileHas" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "free" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "decodeMacro" ], [ "", "verifyDir" ], [ "", "FreeGoMem" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "splitStr" ], [ "", "access" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "free" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "splitStr" ], [ "", "fileHas" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "free" ], [ "", "srand" ], [ "", "time" ], [ "", "getPayloadEncoder" ], [ "", "getProtocol" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "strcmp" ], [ "", "strcmp" ], [ "", "strcmp" ], [ "", "strcmp" ], [ "", "strcmp" ], [ "", "decodeMacro" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "decodeMacro" ], [ "", "parseInt" ], [ "", "decodeMacro" ], [ "", "parseInt" ], [ "", "decodeMacro" ], [ "", "unsetenv" ], [ "", "sleepBeacon" ], [ "", "beacon" ], [ "", "FreeGoMem" ], [ "", "snprintf" ], [ "", "CreateEncoder" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "decodeMacro" ], [ "", "snprintf" ], [ "", "decodeMacro" ], [ "", "CreateProtocol" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "FreeGoMem" ], [ "", "InitArcane" ], [ "", "memset" ], [ "", "get_cpuid" ], [ "", "get_cpuid_max" ], [ "", "cpuid_count" ], [ "", "cpuid_count" ], [ "", "cpuid_count" ], [ "", "decodeMacro" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "strstr" ], [ "", "sscanf" ], [ "", "fclose" ], [ "", "strcpy" ], [ "", "strcpy" ], [ "", "FreeGoMem" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "sscanf" ], [ "", "fclose" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "sscanf" ], [ "", "sscanf" ], [ "", "fclose" ], [ "", "sysconf" ], [ "", "malloc" ], [ "", "getlogin_r" ], [ "", "malloc" ], [ "", "strlen" ], [ "", "strcpy" ], [ "", "free" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "sscanf" ], [ "", "strcpy" ], [ "", "strcpy" ], [ "", "strcpy" ], [ "", "strcpy" ], [ "", "strcpy" ], [ "", "FreeGoMem" ], [ "", "rand" ], [ "", "time" ], [ "", "time" ], [ "", "time" ], [ "", "select" ], [ "", "parseInt" ], [ "", "parseInt" ], [ "", "jitterIT" ], [ "", "whileSleep" ], [ "", "whileSleep" ], [ "", "whileSleep" ], [ "", "pow" ], [ "", "whileSleep" ], [ "", "parseInt" ], [ "", "jitterIT" ], [ "", "pow" ], [ "", "whileSleep" ], [ "", "strcmp" ], [ "", "sleepFunc" ], [ "", "getConnection" ], [ "", "retry" ], [ "", "Receive" ], [ "", "pipe" ], [ "", "fork" ], [ "", "Send" ], [ "", "strlen" ], [ "", "dup2" ], [ "", "dup2" ], [ "", "close" ], [ "", "close" ], [ "", "execvp" ], [ "", "exit" ], [ "", "close" ], [ "", "parseExecOutput" ], [ "", "close" ], [ "", "waitpid" ], [ "", "Send" ], [ "", "strlen" ], [ "", "free" ], [ "", "fetchTargetInfo" ], [ "", "SPrintScroll" ], [ "", "Send" ], [ "", "SetScroll" ], [ "", "memcpy" ], [ "", "be64toh" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "memcmp" ], [ "", "command" ], [ "", "beacon_connHandler" ], [ "", "beacon_receiveHandler" ], [ "", "beacon_commandHandler" ], [ "", "Close" ], [ "", "strtol" ], [ "", "b64_d" ], [ "", "DestroyEncoder" ], [ "", "getPayloadEncoder" ], [ "", "Decode" ], [ "", "strlen" ], [ "", "strncmp" ], [ "", "malloc" ], [ "", "memcpy" ], [ "", "realloc" ], [ "", "free" ], [ "", "strlen" ], [ "", "malloc" ], [ "", "memcpy" ], [ "", "realloc" ], [ "", "free" ], [ "", "malloc" ], [ "", "read" ], [ "", "realloc" ], [ "", "free" ], [ "", "memcpy" ], [ "", "access" ], [ "", "stat" ], [ "", "S_ISDIR" ], [ "", "fopen" ], [ "", "fgets" ], [ "", "strstr" ], [ "", "fclose" ], [ "", "strlen" ], [ "", "strlen" ], [ "", "snprintf" ], [ "", "strstr" ], [ "", "strstr" ], [ "", "malloc" ], [ "", "strcpy" ] ], "m": { "ast": { "max_depth": 19.0, "bind_count": 32.0, "call_count": 274.0, "node_count": 7878.0, "target_count": 83.0, "member_depth_max": 3.0, "string_bind_count": 1.0, "string_literal_count": 31.0, "array_literal_max_length": 5.0, "string_concat_chain_max_length": 3.0 }, "file": { "size": 29333.0, "entropy": 4.94, "size_bytes": 29333.0 }, "text": { "digit_ratio": 0.02, "space_count": 6371.0, "total_lines": 1130.0, "char_entropy": 4.94, "unique_chars": 91.0, "escape_density": 0.02, "lines_over_200": 1.0, "string_density": 0.03, "avg_line_length": 24.96, "max_line_length": 235.0, "empty_line_ratio": 0.29, "last_line_length": 2.0, "whitespace_ratio": 0.26, "most_common_ratio": 0.06, "identifier_density": 1.21, "line_length_stddev": 27.92, "octal_escape_count": 6.0, "normalized_string_count": 0.92, "repeated_char_sequences": 93.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 36.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 32.04 }, "source": { "class_count": 2.0, "function_count": 34.0 }, "imports": { "count": 22.0, "unique_modules": 22.0, "third_party_count": 22.0, "third_party_ratio": 1.0 }, "strings": { "total": 31.0, "avg_length": 7.1, "max_length": 77.0, "path_count": 2.0, "avg_entropy": 1.69, "empty_count": 5.0, "total_bytes": 220.0, "entropy_stddev": 1.38 }, "comments": { "chars": 2023.0, "lines": 86.0, "total": 51.0, "todo_count": 1.0, "to_code_ratio": 0.08 }, "functions": { "count": 36.0 }, "identifiers": { "total": 1364.0, "avg_length": 10.55, "max_length": 33.0, "min_length": 1.0, "avg_entropy": 2.76, "reuse_ratio": 0.24, "unique_count": 325.0, "length_stddev": 6.14, "has_digit_ratio": 0.03, "sequential_names": 3.0, "base64_like_names": 4.0, "single_char_count": 3.0, "single_char_ratio": 0.01, "high_entropy_count": 39.0, "high_entropy_ratio": 0.12, "all_lowercase_ratio": 0.33, "all_uppercase_ratio": 0.15, "numeric_suffix_count": 6.0, "underscore_prefix_count": 61.0 } }, "s": [ [ 84, "u8", "\u003cbits/posix1_lim.h\u003e" ], [ 113, "u8", "\u003cendian.h\u003e" ], [ 133, "u8", "\u003cstdint.h\u003e" ], [ 153, "u8", "\u003cstdlib.h\u003e" ], [ 173, "u8", "\u003cstdio.h\u003e" ], [ 192, "u8", "\u003csys/stat.h\u003e" ], [ 214, "u8", "\u003cstring.h\u003e" ], [ 234, "u8", "\u003csys/time.h\u003e" ], [ 256, "u8", "\u003csys/select.h\u003e" ], [ 280, "u8", "\u003csignal.h\u003e" ], [ 300, "u8", "\u003climits.h\u003e" ], [ 320, "u8", "\u003csys/types.h\u003e" ], [ 343, "u8", "\u003csys/wait.h\u003e" ], [ 365, "u8", "\u003ctime.h\u003e" ], [ 383, "u8", "\u003cmath.h\u003e" ], [ 401, "u8", "\u003cunistd.h\u003e" ], [ 421, "u8", "\u003ccpuid.h\u003e" ], [ 440, "u8", "\u003cstdarg.h\u003e" ], [ 460, "u8", "\u003csys/ptrace.h\u003e" ], [ 484, "u8", "\u003cerrno.h\u003e" ], [ 503, "u8", "libwrapper.h" ], [ 504, "u8", "libwrapper.h" ], [ 527, "u8", "macros.h" ], [ 528, "u8", "macros.h" ], [ 2211, "u8", "Evasion returned 1\\n" ], [ 2212, "u8", "Evasion returned 1" ], [ 3065, "u8", "r" ], [ 3066, "u8", "r" ], [ 9570, "u8", "{\\\"KEY\\\": \\\"%s\\\"}" ], [ 9571, "u8", "{" ], [ 9574, "u8", "KEY" ], [ 9579, "u8", " " ], [ 9583, "u8", "%s" ], [ 9587, "u8", "}" ], [ 10487, "u8", "{\\\"LHOST\\\": \\\"%s\\\", \\\"LPORT\\\": \\\"%s\\\", \\\"FIDELIUS\\\": \\\"%s\\\", \\\"KEY\\\": \\\"%s\\\"}" ], [ 10488, "u8", "{" ], [ 10491, "u8", "LHOST" ], [ 10498, "u8", " " ], [ 10502, "u8", "%s" ], [ 10506, "u8", ", " ], [ 10510, "u8", "LPORT" ], [ 10517, "u8", " " ], [ 10521, "u8", "%s" ], [ 10525, "u8", ", " ], [ 10529, "u8", "FIDELIUS" ], [ 10539, "u8", " " ], [ 10543, "u8", "%s" ], [ 10547, "u8", ", " ], [ 10551, "u8", "KEY" ], [ 10556, "u8", " " ], [ 10560, "u8", "%s" ], [ 10564, "u8", "}" ], [ 13025, "u8", "r" ], [ 13026, "u8", "r" ], [ 13149, "u8", "cpu MHz" ], [ 13150, "u8", "cpu MHz" ], [ 13200, "u8", "cpu MHz: %lf" ], [ 13201, "u8", "cpu MHz: %lf" ], [ 13516, "u8", "x86_64" ], [ 13517, "u8", "x86_64" ], [ 13811, "u8", "r" ], [ 13812, "u8", "r" ], [ 13963, "u8", "%s" ], [ 13964, "u8", "%s" ], [ 14177, "u8", "r" ], [ 14178, "u8", "r" ], [ 14345, "u8", "NAME=\\\"%s\\" ], [ 14346, "u8", "NAME=" ], [ 14353, "u8", "%s" ], [ 14405, "u8", "VERSION=\\\"%s\\" ], [ 14406, "u8", "VERSION=" ], [ 14416, "u8", "%s" ], [ 15050, "u8", "r" ], [ 15051, "u8", "r" ], [ 15198, "u8", "%lf" ], [ 15199, "u8", "%lf" ], [ 15344, "u8", "x86" ], [ 15345, "u8", "x86" ], [ 21046, "u8", "-c" ], [ 21047, "u8", "-c" ], [ 28389, "u8", "r" ], [ 28390, "u8", "r" ], [ 29110, "u8", " " ], [ 29111, "u8", " " ], [ 29117, "u8", "/\\\"%s\\" ], [ 29118, "u8", "/" ], [ 29121, "u8", "%s" ], [ 29129, "u8", "/%s" ], [ 29130, "u8", "/%s" ], [ 29149, "u8", " " ], [ 29150, "u8", " " ], [ 29156, "u8", "\\\"%s\\" ], [ 29159, "u8", "%s" ], [ 29167, "u8", "%s" ], [ 29168, "u8", "%s" ], [ 4, "xor", "STR7?=gXeTdATA" ], [ 2116, "xor", "NIRSYYShOTdATA" ], [ 2188, "xor", "RIRSYYShOTdATA" ], [ 2689, "xor", "STRCYYShOTdATA" ], [ 2974, "xor", "01 39=w4.8hA" ], [ 3089, "xor", "=!\u003e/YYShOTdATA" ], [ 3198, "xor", "NIRSYYShOTdATA" ], [ 3248, "xor", "BD/JKs\"BOTdATA" ], [ 3374, "xor", "STRCPY\"BOTdATA" ], [ 3407, "xor", "SUOC@B\"hOTdATA" ], [ 3421, "xor", "STRCPYUheTdATA" ], [ 4810, "xor", "SIRSKYABSTwZT" ], [ 4845, "xor", "NIRRYYShOTdATA" ], [ 4875, "xor", "STRCPYUheTdATA" ], [ 4985, "xor", "RIRSYYShOTdATA" ], [ 5047, "xor", "STRCPYUheTdATA" ], [ 5296, "xor", "SIRSKYABSTwZT" ], [ 6029, "xor", "SIRSKYABST\u0026" ], [ 6075, "xor", "RIRSYYShOTdATA" ], [ 6105, "xor", "STRCPYUheTdATA" ], [ 6150, "xor", "NIRSYYShOTdATA" ], [ 6172, "xor", "SIRRKs\"BOTdATA" ], [ 6848, "xor", "SIRSKYABST\u0026" ], [ 6901, "xor", "RIRSYYShOTdATA" ], [ 6931, "xor", "STRCPYUheTdATA" ], [ 6982, "xor", "RIRSYYShOTdATA" ], [ 7011, "xor", "SIRRKs\"BOTdATA" ], [ 7356, "xor", "NIRSYYShOTdATA" ], [ 7461, "xor", "NIRSYYShOTdATA" ], [ 8086, "xor", "NTBCV_\"BOTdATA" ], [ 8145, "xor", "NTBCV_\"BOTdATA" ], [ 8206, "xor", "SDREVY\"BOTdATA" ], [ 8272, "xor", "SDREVY\"BOTdATA" ], [ 8352, "xor", "STRCYYShOTdATA" ], [ 9314, "xor", "SIRARB\"BOTd" ], [ 9349, "xor", "SIR31 d-.0" ], [ 9401, "xor", "SIR31 d-.0" ], [ 9466, "xor", "SIRARB\"BOTd" ], [ 9904, "xor", "NIRSYYShOTdATA" ], [ 10098, "xor", "SIRARB\"BOTd" ], [ 11028, "xor", "NIRSYYShOTdATA" ], [ 11386, "xor", "NIRSYYShOTdATA" ], [ 11571, "xor", "STRC_S\"BOTdATA" ], [ 11586, "xor", "=;\u0026\u0026#C\"BOTdATA" ], [ 11953, "xor", "CDBQKYABSIdI" ], [ 12116, "xor", "YTCUYB\"BOTdATA" ], [ 12190, "xor", "STRCPYUheTdAT" ], [ 12301, "xor", "MIRWYYShOTdATA" ], [ 12395, "xor", "ZTYCAB\"hOTdATA" ], [ 12489, "xor", "524JKs\"BOTdATA" ], [ 12632, "xor", "SD\nR6B\"BOTdATA" ], [ 12821, "xor", "SEBQDB\"BOTdATA" ], [ 12863, "xor", "STRCP\u0026AIDONkTA" ], [ 12877, "xor", "STRCPYUheTdAT" ], [ 13051, "xor", "=!\u003e/YYShOTdATA" ], [ 13258, "xor", "STRCPYUheTdATA" ], [ 13659, "xor", "SIRARB\"BOTd" ], [ 13867, "xor", "=!\u003e/YYShOTdATA" ], [ 14004, "xor", "STRCPYUheTdATA" ], [ 14237, "xor", "=!\u003e/YYShOTdATA" ], [ 14301, "xor", "=!\u003e/YYShOTdATA" ], [ 14406, "xor", "%1 096f_3Va" ], [ 14441, "xor", "STRCPY\"BOTdATA" ], [ 14525, "xor", ",377 .w00'" ], [ 14575, "xor", "SEBQDB\"hOTdA" ], [ 14684, "xor", "NIRSYYShOTdATA" ], [ 14748, "xor", "S_RRYB\"BOTdATA" ], [ 14785, "xor", "=!\u003e/YYShOTdATA" ], [ 14883, "xor", "STRCPY\"BOTdATA" ], [ 14910, "xor", "STRCPY\"BOTdATA" ], [ 15102, "xor", "=!\u003e/YYShOTdATA" ], [ 15158, "xor", "=!\u003e/YYShOTdATA" ], [ 15220, "xor", "STRCPYUheTdAT" ], [ 16070, "xor", "=!\u003e/YB\"BOTdATA" ], [ 16168, "xor", "CTHCAB\"BOTdATA" ], [ 16193, "xor", "SIRSKs\"BOTdATA" ], [ 18650, "xor", "NIRSYYShOTdATA" ], [ 18737, "xor", "STRCPYUheTdAT" ], [ 18835, "xor", "NIRSYYShOTdATA" ], [ 19339, "xor", "NIRSYYShOTdATA" ], [ 19487, "xor", "NIRSYYShOTdATA" ], [ 19555, "xor", "STRCPYUheTdATA" ], [ 19666, "xor", "STRCPYUheTdATA" ], [ 19897, "xor", "STRC_S\"BOTdATA" ], [ 20028, "xor", "STRCPY\"BOTdATA" ], [ 20082, "xor", "STRCPY\"BOTdATA" ], [ 20140, "xor", "STRCPY\"BOTdATA" ], [ 20637, "xor", "NT_RYYShOTdATA" ], [ 20785, "xor", "SHRSYYShOTdATA" ], [ 21006, "xor", "NIRSYYShOTdATA" ], [ 21606, "xor", "?XRSYB\"hOTdATA" ], [ 21778, "xor", "RIRRYYShOTdATA" ], [ 21818, "xor", "STRCPYUhOTdATA" ], [ 22740, "xor", "=!\u003e/YYShOTdATA" ], [ 23322, "xor", "SIRARB\"BOTdkTA" ], [ 23430, "xor", "SIRSKYABST'" ], [ 23542, "xor", "NIRSYYShOTdATA" ], [ 23634, "xor", "STRCPYUheTdAT" ], [ 23669, "xor", "=!\u003e/YYShOTdATA" ], [ 23909, "xor", "NIRSYYShOTdATA" ], [ 24407, "xor", "NIRSYYShOTdATA" ], [ 24543, "xor", "=!\u003e/YYShOTdATA" ], [ 25157, "xor", "=!\u003e/YYShOTdATA" ], [ 25320, "xor", "SIR-%5dYeTdAT" ], [ 25811, "xor", "SIR-%5dYeTdAT" ], [ 25991, "xor", "NIRSYYShOTdATA" ], [ 26146, "xor", "=!\u003e/YYShOTdATA" ], [ 26177, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 26204, "xor", "STRCPY\"BOTdATA" ], [ 26282, "xor", "SS.SWB\"hOTdATA" ], [ 26359, "xor", "XTCJYB\"BOTdATA" ], [ 26392, "xor", "=!\u003e/YYShOTdATA" ], [ 26452, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 26605, "xor", "STRCPY\"BOTdATA" ], [ 26810, "xor", "STRCPY\"BOTdATA" ], [ 26902, "xor", "=!\u003e/YYShOTdATA" ], [ 26928, "xor", "S:'/\u003cB\"BOTdATA" ], [ 26946, "xor", "STRCPYUheTdATA" ], [ 27018, "xor", "SS.SWB\"hOTdATA" ], [ 27091, "xor", "XTCJYB\"BOTdATA" ], [ 27120, "xor", "=!\u003e/YYShOTdATA" ], [ 27172, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 27457, "xor", "=!\u003e/YYShOTdATA" ], [ 27508, "xor", "GDKU-B\"BOTd" ], [ 27583, "xor", "SJRSYYShOTdATA" ], [ 27663, "xor", "S^OCBB\"BOTdATA" ], [ 27681, "xor", "STRCPYUhOTdATA" ], [ 27777, "xor", "=!\u003e/YYShOTdATA" ], [ 27830, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 28069, "xor", "NT_RYYShOTdATA" ], [ 28168, "xor", "STRCPY\"BOTdATA" ], [ 28200, "xor", "STRCPYUheTdATA" ], [ 28412, "xor", "=!\u003e/YYShOTdATA" ], [ 28578, "xor", "STRCPYUheTdATA" ], [ 28776, "xor", "GDKU-B\"BOTd" ], [ 28901, "xor", "SFGPYYShOTdATA" ], [ 28928, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 29017, "xor", "=!\u003e/Ks\"BOTdATA" ], [ 29249, "xor", "=!\u003e/YYShOTdATA" ] ], "v": { "source.language": "c", "source.imports[0]": "Close", "source.imports[1]": "CreateEncoder", "source.imports[2]": "CreateProtocol", "source.imports[3]": "Decode", "source.imports[4]": "DestroyEncoder", "source.imports[5]": "FreeGoMem", "source.imports[6]": "InitArcane", "source.imports[7]": "Receive", "source.imports[8]": "SPrintScroll", "source.imports[9]": "S_ISDIR", "source.strings[0]": "%1 096f_3Va", "source.strings[1]": ",377 .w00'", "source.strings[2]": "/\\\"%s\\", "source.strings[3]": "01 39=w4.8hA", "source.strings[4]": "524JKs\"BOTdATA", "source.strings[5]": "\u003cbits/posix1_lim.h\u003e", "source.strings[6]": "\u003ccpuid.h\u003e", "source.strings[7]": "\u003cendian.h\u003e", "source.strings[8]": "\u003cerrno.h\u003e", "source.strings[9]": "\u003climits.h\u003e", "source.has_imports": true, "source.imports[10]": "Send", "source.imports[11]": "SetScroll", "source.imports[12]": "access", "source.imports[13]": "atoi", "source.imports[14]": "b64_d", "source.imports[15]": "be64toh", "source.imports[16]": "beacon", "source.imports[17]": "beacon_commandHandler", "source.imports[18]": "beacon_connHandler", "source.imports[19]": "beacon_receiveHandler", "source.imports[20]": "checkContainer", "source.imports[21]": "checkDmiID", "source.imports[22]": "checkHypervisorFlag", "source.imports[23]": "checkVMFiles", "source.imports[24]": "close", "source.imports[25]": "command", "source.imports[26]": "cpuid_count", "source.imports[27]": "decodeMacro", "source.imports[28]": "dup2", "source.imports[29]": "evadeHoneypot", "source.imports[30]": "evasionOnce", "source.imports[31]": "execvp", "source.imports[32]": "exit", "source.imports[33]": "fclose", "source.imports[34]": "fetchTargetInfo", "source.imports[35]": "fgets", "source.imports[36]": "fileHas", "source.imports[37]": "fopen", "source.imports[38]": "fork", "source.imports[39]": "free", "source.imports[40]": "getConnection", "source.imports[41]": "getPayloadEncoder", "source.imports[42]": "getProtocol", "source.imports[43]": "get_cpuid", "source.imports[44]": "get_cpuid_max", "source.imports[45]": "getlogin_r", "source.imports[46]": "isDebuggerPresent", "source.imports[47]": "jitterIT", "source.imports[48]": "joinPath", "source.imports[49]": "malloc", "source.imports[50]": "memcmp", "source.imports[51]": "memcpy", "source.imports[52]": "memset", "source.imports[53]": "parseExecOutput", "source.imports[54]": "parseInt", "source.imports[55]": "pipe", "source.imports[56]": "pow", "source.imports[57]": "printf", "source.imports[58]": "rand", "source.imports[59]": "read", "source.imports[60]": "realloc", "source.imports[61]": "retry", "source.imports[62]": "sec", "source.imports[63]": "select", "source.imports[64]": "sleepBeacon", "source.imports[65]": "sleepFunc", "source.imports[66]": "snprintf", "source.imports[67]": "splitStr", "source.imports[68]": "srand", "source.imports[69]": "sscanf", "source.imports[70]": "stat", "source.imports[71]": "strcmp", "source.imports[72]": "strcpy", "source.imports[73]": "strlen", "source.imports[74]": "strncmp", "source.imports[75]": "strstr", "source.imports[76]": "strtol", "source.imports[77]": "sysconf", "source.imports[78]": "time", "source.imports[79]": "unsetenv", "source.imports[80]": "verifyDir", "source.imports[81]": "waitpid", "source.imports[82]": "whileSleep", "source.strings[10]": "\u003cmath.h\u003e", "source.strings[11]": "\u003csignal.h\u003e", "source.strings[12]": "\u003cstdarg.h\u003e", "source.strings[13]": "\u003cstdint.h\u003e", "source.strings[14]": "\u003cstdio.h\u003e", "source.strings[15]": "\u003cstdlib.h\u003e", "source.strings[16]": "\u003cstring.h\u003e", "source.strings[17]": "\u003csys/ptrace.h\u003e", "source.strings[18]": "\u003csys/select.h\u003e", "source.strings[19]": "\u003csys/stat.h\u003e", "source.strings[20]": "\u003csys/time.h\u003e", "source.strings[21]": "\u003csys/types.h\u003e", "source.strings[22]": "\u003csys/wait.h\u003e", "source.strings[23]": "\u003ctime.h\u003e", "source.strings[24]": "\u003cunistd.h\u003e", "source.strings[25]": "=!\u003e/Ks\"BOTdATA", "source.strings[26]": "=!\u003e/YB\"BOTdATA", "source.strings[27]": "=!\u003e/YYShOTdATA", "source.strings[28]": "=;\u0026\u0026#C\"BOTdATA", "source.strings[29]": "?XRSYB\"hOTdATA", "source.strings[30]": "BD/JKs\"BOTdATA", "source.strings[31]": "CDBQKYABSIdI", "source.strings[32]": "CTHCAB\"BOTdATA", "source.strings[33]": "Evasion returned 1", "source.strings[34]": "Evasion returned 1\\n", "source.strings[35]": "FIDELIUS", "source.strings[36]": "GDKU-B\"BOTd", "source.strings[37]": "MIRWYYShOTdATA", "source.strings[38]": "NAME=\\\"%s\\", "source.strings[39]": "NIRRYYShOTdATA", "source.strings[40]": "NIRSYYShOTdATA", "source.strings[41]": "NTBCV_\"BOTdATA", "source.strings[42]": "NT_RYYShOTdATA", "source.strings[43]": "RIRRYYShOTdATA", "source.strings[44]": "RIRSYYShOTdATA", "source.strings[45]": "S:'/\u003cB\"BOTdATA", "source.strings[46]": "SD\nR6B\"BOTdATA", "source.strings[47]": "SDREVY\"BOTdATA", "source.strings[48]": "SEBQDB\"BOTdATA", "source.strings[49]": "SEBQDB\"hOTdA", "source.strings[50]": "SFGPYYShOTdATA", "source.strings[51]": "SHRSYYShOTdATA", "source.strings[52]": "SIR-%5dYeTdAT", "source.strings[53]": "SIR31 d-.0", "source.strings[54]": "SIRARB\"BOTd", "source.strings[55]": "SIRARB\"BOTdkTA", "source.strings[56]": "SIRRKs\"BOTdATA", "source.strings[57]": "SIRSKYABST\u0026", "source.strings[58]": "SIRSKYABST'", "source.strings[59]": "SIRSKYABSTwZT", "source.strings[60]": "SIRSKs\"BOTdATA", "source.strings[61]": "SJRSYYShOTdATA", "source.strings[62]": "SS.SWB\"hOTdATA", "source.strings[63]": "STR7?=gXeTdATA", "source.strings[64]": "STRCP\u0026AIDONkTA", "source.strings[65]": "STRCPY\"BOTdATA", "source.strings[66]": "STRCPYUhOTdATA", "source.strings[67]": "STRCPYUheTdAT", "source.strings[68]": "STRCPYUheTdATA", "source.strings[69]": "STRCYYShOTdATA", "source.strings[70]": "STRC_S\"BOTdATA", "source.strings[71]": "SUOC@B\"hOTdATA", "source.strings[72]": "S^OCBB\"BOTdATA", "source.strings[73]": "S_RRYB\"BOTdATA", "source.strings[74]": "VERSION=", "source.strings[75]": "VERSION=\\\"%s\\", "source.strings[76]": "XTCJYB\"BOTdATA", "source.strings[77]": "YTCUYB\"BOTdATA", "source.strings[78]": "ZTYCAB\"hOTdATA", "source.strings[79]": "cpu MHz", "source.strings[80]": "cpu MHz: %lf", "source.strings[81]": "libwrapper.h", "source.strings[82]": "macros.h", "source.strings[83]": "x86_64", "source.strings[84]": "{\\\"KEY\\\": \\\"%s\\\"}", "source.strings[85]": "{\\\"LHOST\\\": \\\"%s\\\", \\\"LPORT\\\": \\\"%s\\\", \\\"FIDELIUS\\\": \\\"%s\\\", \\\"KEY\\\": \\\"%s\\\"}", "source.functions[0]": "* _beacon_receiveHandler(int connID)", "source.functions[1]": "* decodeMacro(char* macroEncoded, int *payloadEncoderID)", "source.functions[2]": "* parseExecOutput(int pipeInt)", "source.functions[3]": "** splitStr(char *str, char *delim, int *count)", "source.functions[4]": "*joinPath(char *args[])", "source.functions[5]": "_beacon_commandHandler(char *data, int connID, int *payloadEncoderID)", "source.functions[6]": "_beacon_commands_exec(char *data, int connID, int *payloadEncoderID)", "source.functions[7]": "_beacon_commands_getBotData(char *data, int connID, int *payloadEncoderID)", "source.functions[8]": "_beacon_connHandler(int protocolID, int retryBaseDelay, int maxAttemptsCap, char *retryMethod, int *payloadEncoderID)", "source.functions[9]": "_retryMethod_exponential(int currentAttempt, int baseDelay)", "source.functions[10]": "_retryMethod_exponentialJitter(int currentAttempt, int baseDelay)", "source.functions[11]": "_retryMethod_fixed(int currentAttempt, int baseDelay)", "source.functions[12]": "_retryMethod_linear(int currentAttempt, int baseDelay)", "source.functions[13]": "_retryMethod_none(int currentAttempt, int baseDelay)", "source.functions[14]": "beacon(int protocolID, int retryBaseDelay, int maxAttemptsCap, char *retryMethod, int *payloadEncoderID)", "source.functions[15]": "checkContainer(int *payloadEncoderID)", "source.functions[16]": "checkDmiID(int *payloadEncoderID)", "source.functions[17]": "checkHypervisorFlag(int *payloadEncoderID)", "source.functions[18]": "checkVMFiles(int *payloadEncoderID)", "source.functions[19]": "evadeHoneypot(int *payloadEncoderID)", "source.functions[20]": "evasionOnce(int *payloadEncoderID)", "source.functions[21]": "fetchTargetInfo(int *payloadEncoderID)", "source.functions[22]": "fileHas(char *filePath, char *content)", "source.functions[23]": "getConnection(int protocolID)", "source.functions[24]": "getPayloadEncoder()", "source.functions[25]": "getProtocol(int *payloadEncoderID)", "source.functions[26]": "isDebuggerPresent(int *payloadEncoderID)", "source.functions[27]": "jitterIT(double baseVal, double jitter)", "source.functions[28]": "main()", "source.functions[29]": "parseInt(char* string, int fallback)", "source.functions[30]": "retry(int baseDelay, char* method, int currentAttempt, int maxAttemptsCap, int *payloadEncoderID)", "source.functions[31]": "sec()", "source.functions[32]": "sleepBeacon()", "source.functions[33]": "verifyDir(char *dirPath)", "source.functions[34]": "whileSleep(long sleepTime)" }, "ca": [ [ "fopen", "r" ], [ "printf", "Evasion returned 1\\n" ], [ "snprintf", "%s" ], [ "snprintf", "/%s" ], [ "snprintf", "/\\\"%s\\\"" ], [ "snprintf", "\\\"%s\\\"" ], [ "snprintf", "{\\\"KEY\\\": \\\"%s\\\"}" ], [ "snprintf", "{\\\"LHOST\\\": \\\"%s\\\", \\\"LPORT\\\": \\\"%s\\\", \\\"FIDELIUS\\\": \\\"%s\\\", \\\"KEY\\\": \\\"%s\\\"}" ], [ "sscanf", "%lf" ], [ "sscanf", "%s" ], [ "sscanf", "NAME=\\\"%s\\\"" ], [ "sscanf", "VERSION=\\\"%s\\\"" ], [ "sscanf", "cpu MHz: %lf" ], [ "strcpy", "x86" ], [ "strcpy", "x86_64" ], [ "strstr", " " ], [ "strstr", "cpu MHz" ] ], "ct": [ "Close", "CreateEncoder", "CreateProtocol", "Decode", "DestroyEncoder", "FreeGoMem", "InitArcane", "Receive", "SPrintScroll", "S_ISDIR", "Send", "SetScroll", "__cpuid_count", "__get_cpuid", "__get_cpuid_max", "_b64_d", "_beacon_commandHandler", "_beacon_connHandler", "_beacon_receiveHandler", "_exit", "access", "atoi", "be64toh", "beacon", "checkContainer", "checkDmiID", "checkHypervisorFlag", "checkVMFiles", "close", "command", "decodeMacro", "dup2", "evadeHoneypot", "evasionOnce", "execvp", "fclose", "fetchTargetInfo", "fgets", "fileHas", "fopen", "fork", "free", "getConnection", "getPayloadEncoder", "getProtocol", "getlogin_r", "isDebuggerPresent", "jitterIT", "joinPath", "malloc", "memcmp", "memcpy", "memset", "parseExecOutput", "parseInt", "pipe", "pow", "printf", "rand", "read", "realloc", "retry", "sec", "select", "sleepBeacon", "sleepFunc", "snprintf", "splitStr", "srand", "sscanf", "stat", "strcmp", "strcpy", "strlen", "strncmp", "strstr", "strtol", "sysconf", "time", "unsetenv", "verifyDir", "waitpid", "whileSleep" ], "id": "c", "mc": [ "botData.CPU", "botData.CPU.Arch", "botData.CPU.Cache", "botData.CPU.Clock", "botData.CPU.Cores", "botData.CPU.Name", "botData.CPU.Threads", "botData.OS", "botData.OS.Arch", "botData.OS.Hostname", "botData.OS.Name", "botData.OS.Uptime", "botData.OS.Username", "botData.OS.Version", "macroDecodedB64.data", "macroDecodedB64.len", "st.st_mode", "tv.tv_sec", "tv.tv_usec" ] }, "id": 0, "sz": 29333, "ts": [ { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "STDOUT_FILENO" ], "i": "objectives/command-and-control/reverse-shell/dup::dup2-stdio-source--rx-2", "l": 1 }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1 }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1 }, { "c": 0.30000001192092896, "d": "Random number generation (rand)", "e": [ "rand" ], "i": "micro-behaviors/os/random/crypto::rand-symbol", "l": 2 }, { "a": "T1497.001", "c": 0.8999999761581421, "d": "__cpuid source call", "e": [ "__cpuid" ], "i": "objectives/anti-analysis/vm-detect/instruction::cpuid-source-call", "l": 1, "m": "B0009" }, { "c": 0.699999988079071, "d": "Memory comparison (file prefix matching", "e": [ "memcmp(AvaliableCommands[i].commandName, commandFromC2, commandLen)" ], "i": "objectives/evasion/kernel-hide/lkm/hiding::memcmp-dirent-context", "l": 4 }, { "a": "T1082", "c": 0.4000000059604645, "d": "Query system configuration information", "e": [ "sysconf" ], "i": "micro-behaviors/os/sysinfo/config::sysconf", "l": 2, "m": "E1082" }, { "d": "select() I/O multiplexing", "e": [ "select" ], "i": "micro-behaviors/communications/socket/multiplex::select-multiplex", "l": 3 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "dup2" ], "i": "objectives/command-and-control/reverse-shell/dup::dup2-stdio-source--rx-4", "l": 1 }, { "d": "Duplicate file descriptor (I/O redirection)", "e": [ "dup2" ], "i": "micro-behaviors/process/fd/dup::dup2", "l": 2 }, { "d": "overflow keyword", "e": [ "overflow" ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1 }, { "a": "T1071", "c": 0.800000011920929, "d": "Random number generation function call", "e": [ "rand()" ], "i": "micro-behaviors/communications/ip/spoof::bitwise-ip-rand-source", "l": 2, "m": "C0001" }, { "c": 0.6200000047683716, "d": "fopen API string", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen-text", "l": 2 }, { "a": "T1082", "d": "/sys/class/dmi/id/ path", "e": [ "/sys/class/dmi/id/" ], "i": "micro-behaviors/os/sysinfo/hardware::dmi-class-path", "l": 2, "m": "E1082" }, { "c": 0.6600000262260437, "d": "Look up file permissions", "e": [ "stat" ], "i": "micro-behaviors/fs/chmod/get::get-dup", "l": 2 }, { "c": 0.75, "d": "snprintf formatting function", "e": [ "snprintf" ], "i": "micro-behaviors/data/format/string::snprintf-format", "l": 2 }, { "c": 0.4000000059604645, "d": "Random seed initialization (srand)", "e": [ "srand" ], "i": "micro-behaviors/os/random/crypto::srand-symbol", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "a": "T1033", "d": "Get login name", "e": [ "getlogin_r" ], "i": "micro-behaviors/process/user/query::getlogin", "l": 3, "m": "E1033" }, { "c": 0.6600000262260437, "d": "Wait for child process state", "e": [ "waitpid" ], "i": "micro-behaviors/process/control/wait::waitpid", "l": 2 }, { "c": 0.8399999737739563, "d": "password/token/api_key field keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/credential::credential-field", "l": 1 }, { "c": 0.8999999761581421, "d": "Regex component marker", "e": [ "STDERR_FILENO" ], "i": "objectives/command-and-control/reverse-shell/dup::dup2-stdio-source--rx-1", "l": 1 }, { "c": 0.800000011920929, "d": "C fork child process", "e": [ "fork()" ], "i": "micro-behaviors/process/fork/clone::c-fork-call", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "c": 0.4000000059604645, "d": "unsetenv function (remove environment variable)", "e": [ "unsetenv" ], "i": "micro-behaviors/os/env/vars/access::unsetenv", "l": 2 }, { "a": "T1082", "c": 0.30000001192092896, "d": "x86_64 architecture string", "e": [ "x86_64" ], "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "l": 2, "m": "E1082" }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 1.0, "d": "Infinite loop structure (e.g. for(;;) or while(1))", "e": [ "while (1)" ], "i": "micro-behaviors/data/control-flow/loop::infinite-loop-header", "l": 2 }, { "c": 0.800000011920929, "d": "Read file status and metadata (core)", "e": [ "stat" ], "i": "micro-behaviors/fs/file/stat::stat-core", "l": 3 }, { "d": "Seeded random number generation", "e": [ "srand", "rand" ], "i": "micro-behaviors/os/random/crypto::seeded-random", "l": 2 }, { "c": 0.8999999761581421, "d": "dup2 redirects standard streams", "e": [ "dup2", "STDOUT_FILENO", "STDERR_FILENO" ], "i": "objectives/command-and-control/reverse-shell/dup::dup2-stdio-source", "l": 1 } ], "sha": "56013f78c051456aa9d37fee2f2a2eb3b7ccc36ec651f29bc97f2221d6b0c232", "path": "main.c", "type": "c" } ], "tv": "cf883" } }