{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.00006755193, "rte": "az", "prob": 0.00006755193 }, { "cls": 0, "raw": 0.000008225441, "rte": "az/scripts", "prob": 0.000008225441 }, { "cls": 0, "raw": 0.011651357, "rte": "az/shell", "prob": 0.011651357 } ], "prob": 0.00006755193, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00006755193317076191, "type": "shell" } ], "version": "v18.18", "analyzed_at": "2026-06-15T10:01:07Z" }, "path": "p3.txt", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 0, "b": "boXZHx(kOkvrl8", "l": 1, "n": [ { "c": 2, "d": "shell code embedded in string", "i": "metadata/lang/embedded::shell", "o": 0, "z": 1649 } ] }, { "a": 12, "b": "bo[ATbo[ATbo[ATbo[sKyIv-gx(n0lvqG:5c#Z%\u003e", "l": 2 }, { "a": 45, "b": "", "l": 3 }, { "a": 192, "b": "", "l": 7 }, { "a": 193, "b": "", "l": 8 }, { "a": 194, "b": "z/X6Hv{%E4f)3#zAaS*2wPGIyB1RMVByk", "l": 9, "n": [ { "c": 3, "d": "Shell command execution capability detected", "i": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "o": 197, "z": 23 } ] }, { "a": 221, "b": "A+^*Cv{%E4f)3#zAaS*2wPGIByC6ZNByk", "l": 10 }, { "a": 248, "b": "B7]e@uUj1*wPIi?x(VvAv{%E4f)3#zAaS*2wPGICx\u003eg^Zw[=6)B6\u0026D(AXqDUByk", "l": 11 }, { "a": 316, "b": "", "l": 16 }, { "a": 317, "b": "wN/y(at4dEb3V/TgG#K{gCS!\u0026tpS#4tRE@\u0026tqf]0fF+H?fL}}yz*c8nz^^f\u003czF78jyIv-iar@1wA+e*1", "l": 17 }, { "a": 382, "b": "A+#{JA+lCnx\u003eg^Zw[=6)B1RMEDh", "l": 18, "n": [ { "c": 3, "d": "curl command", "i": "micro-behaviors/communications/http/download/curl::curl-cmd", "o": 403, "z": 6 }, { "c": 2, "d": "Shell deletion operation", "i": "micro-behaviors/fs/directory/traverse::delete-shell", "o": 382, "z": 6 } ] }, { "a": 404, "b": "v%8*dat2f:A=kPhwPI]AvQTp1eL^H5BAzE.fe3%RAb]Jbx)1nBzeTuhe[n*pfd[\u003effjx0Bz.DfCwmYaWx(4v4e{7-L", "l": 19, "n": [ { "c": 3, "d": "curl silent flags", "i": "micro-behaviors/communications/http/download/curl::curl-silent", "o": 404, "z": 15 } ] }, { "a": 477, "b": "x\u003ewF(ar.\u003cVw/#eewmYaWx(4v4e{7-Layc9KaARpdzxJI2xM21BwGSg4fF+H?fGR6Bz6i4mt{9xagC-k?zcO+JgG#LIazbt7wGU\u00267B8#5kxcn=Gwn=Wfy\u0026r-)azb4@y?mcfayO.$A==2kxcFDWaz24@zY?a:wQ4{hauHYTx-", "l": 20 }, { "a": 611, "b": "", "l": 21 }, { "a": 829, "b": "Byxhjzf*CsaAImcwNx4-y?mVuBz2[xj0nMXat4RCaAImcwNx4-y?mVuBz2[xj0n3Lat3FlB7]e@uUj1*wPF$EwPRAnAbY\u003c", "l": 25 }, { "a": 905, "b": "A+/xdwnc6Ea$)IHv\u003eR!uB1.PGwmYaWx(4v4a]", "l": 26 }, { "a": 935, "b": "v}lYcA+/xdwnc6bj0n/WB0b-JD($3{x(n0lvqG:5bY^WgwNx4-y?mV{wnc6bf*m=Dzddc@wnc6qf)3#zAaS*2wPGIvz!yXyyIv-ggcN(Ezddc@wnc6qf)3#zAaS*2wPGIvz!yXyyIv.", "l": 27, "n": [ { "c": 3, "d": "Executes a file from current directory", "i": "micro-behaviors/process/create/local-exec::local-execution", "o": 955, "z": 11 } ] }, { "a": 1047, "b": "zF%5%uVp47v}x.5uUK4lbQ^RCwn=65tx1a+y\u0026%/jeIHDV", "l": 28 }, { "a": 1084, "b": "x\u003ewF(toCIzas7\u0026ywmYa!A=kD0B8$Y5wfte-j0nSUwO}", "l": 29 } ], "mol": "H₂(CmPo₂)", "sha": "5b017a6f705bec77ced09dc53dac07ca5099a0dafb6f15a2a2a684e90f237942", "fact": { "id": "shell", "imp": [ [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "cat" ], [ "", "pwd" ], [ "", "pwd" ], [ "", "echo" ], [ "", "echo" ], [ "", "rm" ], [ "", "rm" ], [ "", "curl" ], [ "", "curl" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "rm" ], [ "", "rm" ], [ "", "tar" ], [ "", "tar" ], [ "", "rm" ], [ "", "rm" ], [ "", "cp" ], [ "", "cp" ], [ "", "cd" ], [ "", "cd" ], [ "", "yes" ], [ "", "yes" ], [ "", "./install" ], [ "", "./install" ], [ "", "pidof" ], [ "", "pidof" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "cd" ], [ "", "cd" ], [ "", "rm" ], [ "", "rm" ], [ "", "./dep-safe.arhivez" ], [ "", "./dep-safe.arhivez" ], [ "", "rm" ], [ "", "rm" ] ], "met": { "ast": { "op.lnot": 1.0, "max_depth": 7.0, "bind_count": 7.0, "call_count": 36.0, "node_count": 324.0, "op_density.lnot": 0.0, "identifier_count": 41.0, "string_literal_count": 9.0 }, "file": { "size": 1686.0, "entropy": 5.05, "size_bytes": 1686.0 }, "text": { "digit_ratio": 0.14, "space_count": 201.0, "total_lines": 46.0, "char_entropy": 5.05, "unique_chars": 59.0, "escape_density": 1.78, "string_density": 0.2, "avg_line_length": 35.65, "max_line_length": 160.0, "empty_line_ratio": 0.26, "last_line_length": 15.0, "whitespace_ratio": 0.15, "most_common_ratio": 0.07, "identifier_density": 2.76, "line_length_stddev": 39.21, "octal_escape_count": 30.0, "normalized_string_count": 1.33, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 105.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 7.42 }, "binds": { "count": 7.0 }, "calls": { "count": 36.0 }, "binary": { "overall_entropy": 5.05 }, "strings": { "total": 9.0, "avg_length": 60.33, "max_length": 142.0, "path_count": 2.0, "avg_entropy": 4.04, "total_bytes": 543.0, "entropy_stddev": 0.6 }, "comments": { "chars": 235.0, "lines": 10.0, "total": 10.0, "xxx_count": 1.0, "to_code_ratio": 0.28 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.script_as_text": 1.0 }, "identifiers": { "count": 41.0, "total": 127.0, "avg_length": 8.51, "max_length": 49.0, "min_length": 1.0, "avg_entropy": 2.15, "reuse_ratio": 0.32, "unique_count": 41.0, "length_stddev": 9.18, "has_digit_ratio": 0.12, "sequential_names": 1.0, "single_char_count": 3.0, "single_char_ratio": 0.07, "high_entropy_count": 6.0, "high_entropy_ratio": 0.15, "all_lowercase_ratio": 0.54, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1.0 } }, "str": [ [ 325, "u8", "\\033[0;32m [+] \\033[0m\\033[0m downloading rkip" ], [ 326, "u8", "\\033[0;32m [+] \\033[0m\\033[0m downloading rkip" ], [ 519, "u8", "\\033[0;31m [-] \\033[0m\\033[0m file missing - download failed. aborting" ], [ 520, "u8", "\\033[0;31m [-] \\033[0m\\033[0m file missing - download failed. aborting" ], [ 620, "u8", "\\033[0;32m [+] \\033[0m\\033[0m starting rkip install" ], [ 621, "u8", "\\033[0;32m [+] \\033[0m\\033[0m starting rkip install" ], [ 723, "u8", "\\033[0;31m [-] \\033[0m\\033[0m no side_files_dir. aborting" ], [ 724, "u8", "\\033[0;31m [-] \\033[0m\\033[0m no side_files_dir. aborting" ], [ 913, "u8", "/etc/pps/side_files" ], [ 914, "u8", "/etc/pps/side_files" ], [ 1162, "u8", "\\033[0;31m [-] \\033[0m\\033[0m background proccess did not start. aborting. check ($maindir/1tempfiles/log.rkip). script in /etc/" ], [ 1163, "u8", "\\033[0;31m [-] \\033[0m\\033[0m background proccess did not start. aborting. check (" ], [ 1253, "u8", "/1tempfiles/log.rkip). script in /etc/pps/side_files" ], [ 1338, "u8", "\\033[0;32m [+] \\033[0m\\033[0m rkip install done (logs in $maindir/1tempfiles/log.rkip)" ], [ 1339, "u8", "\\033[0;32m [+] \\033[0m\\033[0m rkip install done (logs in " ], [ 1404, "u8", "/1tempfiles/log.rkip)" ], [ 1436, "u8", "\\033[0;36m [x] \\033[0m\\033[0m write this down in your notepad :)" ], [ 1437, "u8", "\\033[0;36m [x] \\033[0m\\033[0m write this down in your notepad :)" ], [ 1575, "u8", "$id_unic" ] ], "tgt": [ "./dep-safe.arhivez", "./install", "cat", "cd", "cp", "curl", "echo", "exit", "grep", "pidof", "pwd", "rm", "tar", "yes" ], "val": { "file.stem": "p3", "file.basename": "p3.txt", "source.shebang": "/bin/bash", "source.language": "bash", "source.imports[0]": "./dep-safe.arhivez", "source.imports[1]": "./install", "source.imports[2]": "cat", "source.imports[3]": "cd", "source.imports[4]": "cp", "source.imports[5]": "curl", "source.imports[6]": "echo", "source.imports[7]": "exit", "source.imports[8]": "grep", "source.imports[9]": "pidof", "source.strings[0]": "$id_unic", "source.strings[1]": "/1tempfiles/log.rkip)", "source.strings[2]": "/1tempfiles/log.rkip). script in /etc/pps/side_files", "source.strings[3]": "/etc/pps/side_files", "source.strings[4]": "\\033[0;31m [-] \\033[0m\\033[0m background proccess did not start. aborting. check (", "source.strings[5]": "\\033[0;31m [-] \\033[0m\\033[0m background proccess did not start. aborting. check ($maindir/1tempfiles/log.rkip). script in /etc/pps/side_files", "source.strings[6]": "\\033[0;31m [-] \\033[0m\\033[0m file missing - download failed. aborting", "source.strings[7]": "\\033[0;31m [-] \\033[0m\\033[0m no side_files_dir. aborting", "source.strings[8]": "\\033[0;32m [+] \\033[0m\\033[0m downloading rkip", "source.strings[9]": "\\033[0;32m [+] \\033[0m\\033[0m rkip install done (logs in ", "source.has_imports": true, "source.imports[10]": "pwd", "source.imports[11]": "rm", "source.imports[12]": "tar", "source.imports[13]": "yes", "source.strings[10]": "\\033[0;32m [+] \\033[0m\\033[0m rkip install done (logs in $maindir/1tempfiles/log.rkip)", "source.strings[11]": "\\033[0;32m [+] \\033[0m\\033[0m starting rkip install", "source.strings[12]": "\\033[0;36m [x] \\033[0m\\033[0m write this down in your notepad :)" } }, "find": [ { "id": "micro-behaviors/communications/http/download/curl::curl-output-file", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl download to file" }, { "id": "micro-behaviors/communications/http/download/curl::curl-silent", "atk": "T1105", "conf": 0.800000011920929, "crit": 3, "desc": "curl silent flags" }, { "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "conf": 0.6000000238418579, "crit": 2, "desc": "rm -rf command" }, { "id": "micro-behaviors/process/create/local-exec::local-execution", "conf": 1.0, "crit": 3, "desc": "Executes a file from current directory" }, { "id": "micro-behaviors/communications/http/download/curl::curl-cmd", "atk": "T1105", "conf": 0.699999988079071, "crit": 3, "desc": "curl command" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-execution-comp", "atk": "T1059", "mbc": "E1059", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell command execution capability detected" }, { "id": "micro-behaviors/process/create/shell/invoke::shell-symbols", "conf": 0.8999999761581421, "crit": 3, "desc": "Shell execution symbols" } ], "path": "/data/samples/bad/projects/openssh-backdoor-kit/openssh-5.9/p3.txt", "risk": 2, "size": 1686, "type": "shell" } ] } }