{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8251519203186035, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8251519, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8251519, "class": 0 }, { "m": "az/native", "prob": 0.07450331, "class": 0 }, { "m": "az/elf", "prob": 0.61904764, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T10:14:59Z" }, "path": "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf", "raw": { "v": "5", "fs": [ { "f": "H₂(CmF)Md₂(BiHe)", "x": 21, "ff": { "m": { "elf": { "bits": 64.0, "entry": 4562320.0, "has_got": 0.0, "has_plt": 0.0, "has_note": 1.0, "note_count": 1.0, "nx_enabled": 1.0, "dynrel_count": 0.0, "dynsym_count": 0.0, "has_eh_frame": 0.0, "symtab_count": 0.0, "dynrela_count": 0.0, "little_endian": 1.0, "pltreloc_count": 0.0, "executable_stack": 0.0, "wx_segment_count": 0.0, "program_header_count": 7.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 1262901.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 1262901.0, "section_relocation_group_count": 0.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 2438368.0, "entropy": 5.81, "size_bytes": 2438368.0 }, "binary": { "is_pie": 0.0, "is_stripped": 1.0, "code_entropy": 5.92, "data_entropy": 4.12, "string_count": 4018.0, "avg_complexity": 7.31, "max_complexity": 230.0, "huge_func_count": 134.0, "leaf_func_count": 215.0, "tiny_func_count": 594.0, "avg_basic_blocks": 13.46, "entropy_variance": 1.96, "avg_string_length": 10.74, "max_string_length": 571.0, "code_to_data_ratio": 0.92, "total_basic_blocks": 39751.0, "string_length_stddev": 14.71, "largest_section_ratio": 0.44, "sentence_string_count": 689.0, "sentence_string_ratio": 0.17, "high_entropy_string_count": 1.0 }, "sections": { "count": 14.0, "code_size": 1073234.0, "entropy_max": 5.92, "entropy_mean": 4.23, "name_entropy": 4.03, "writable_count": 5.0, "executable_count": 1.0, "nonstandard_count": 9.0, "executable_writable_count": 0.0 }, "functions": { "count": 2953.0 }, "dependencies": { "count": 0.0 } }, "s": [ [ 4012, "u8", "FtcsTU4dkTPqWRWID7Nb/5nDS4kJzwISS1y7V3dmQ/qj81tAZgW_9zvb8w_FDn/VLWydPJIvXdzNHi1bPOG" ], [ 8605, "u8", "oO f" ], [ 15131, "u8", "H0H9" ], [ 15148, "u8", "H9APt" ], [ 18759, "u8", "D$(H)" ], [ 21174, "u8", "H0H9H" ], [ 28014, "u8", "runtime L" ], [ 34335, "u8", "IH9H" ], [ 44536, "u8", "Q8H9" ], [ 44627, "u8", "H9A8" ], [ 45342, "u8", "H9SP" ], [ 61091, "u8", "A I9" ], [ 75580, "u8", "X8H9" ], [ 76825, "u8", "H9Apw" ], [ 88612, "u8", "H9Y0" ], [ 93956, "u8", "H9AxwEH9" ], [ 96444, "u8", "9ofu" ], [ 114219, "u8", "R09S0" ], [ 114274, "u8", "txH9B" ], [ 114421, "u8", "T$(H)J" ], [ 126706, "u8", "L9C0" ], [ 130985, "u8", "L$(H)" ], [ 135280, "u8", "D9FX" ], [ 135815, "u8", "H9F8" ], [ 135944, "u8", "N0H9" ], [ 143814, "u8", "H9Hpv" ], [ 178426, "u8", "Q0H9" ], [ 236974, "u8", "C0H9" ], [ 241139, "u8", "memprofiH90u" ], [ 241155, "u8", "lerau" ], [ 241317, "u8", "memprofiH" ], [ 241491, "u8", "memprofi" ], [ 241815, "u8", "9aluU" ], [ 241840, "u8", "9noneu" ], [ 241936, "u8", "9crasu" ], [ 241966, "u8", "9singu8f" ], [ 249423, "u8", "I9ZH" ], [ 249800, "u8", "I9Z8" ], [ 252408, "u8", "H L9" ], [ 254471, "u8", "tRH9B" ], [ 270412, "u8", "Z0H9" ], [ 273885, "u8", "Y H9" ], [ 274015, "u8", "P H9" ], [ 274204, "u8", "YXH9" ], [ 274855, "u8", "H H9" ], [ 275699, "u8", "I0H9" ], [ 291107, "u8", "A L9" ], [ 291295, "u8", "H9BX" ], [ 292842, "u8", "H9APw" ], [ 292848, "u8", "H9AXv" ], [ 299131, "u8", "V8H9" ], [ 299943, "u8", "Q0M9" ], [ 299986, "u8", "Q8I9" ], [ 310437, "u8", "runtime.H" ], [ 310461, "u8", "gopau" ], [ 314216, "u8", "HcD$ H" ], [ 319010, "u8", "gopa" ], [ 320356, "u8", "runtime.H9" ], [ 321931, "u8", "C0I9" ], [ 329940, "u8", "f9w2" ], [ 329956, "u8", "s0f9" ], [ 337970, "u8", "debugCalH9" ], [ 338066, "u8", "l128t" ], [ 338448, "u8", "debugCal" ], [ 338487, "u8", "l256" ], [ 338511, "u8", "l512" ], [ 338543, "u8", "l102" ], [ 338715, "u8", "l163uif" ], [ 338787, "u8", "l655" ], [ 338914, "u8", "debugCalH" ], [ 338965, "u8", "l409u3" ], [ 338995, "u8", "l819u" ], [ 346254, "u8", "l$ HcB" ], [ 353286, "u8", "Genuu" ], [ 353294, "u8", "ineIu" ], [ 353302, "u8", "ntelu" ], [ 361378, "u8", "oxpfD" ], [ 367719, "u8", "ofpL1" ], [ 374852, "u8", "3H9S" ], [ 374891, "u8", "K H9H" ], [ 382177, "u8", "u8z6" ], [ 382667, "u8", "JXH9HX" ], [ 397213, "u8", "K0H9" ], [ 436532, "u8", "2H9X" ], [ 449624, "u8", "tHH91ufH" ], [ 503587, "u8", "B8H9" ], [ 580470, "u8", "-07:00:0" ], [ 581135, "u8", "5uDH9" ], [ 581684, "u8", "Janu" ], [ 582033, "u8", "Mond" ], [ 582582, "u8", "Z070" ], [ 583165, "u8", "Z07:00:0" ], [ 583491, "u8", "2006A" ], [ 604614, "u8", "9TZif" ], [ 607608, "u8", "IHI9" ], [ 609131, "u8", ".zip" ], [ 621794, "u8", "8fileunH" ], [ 649896, "u8", "H I9" ], [ 683982, "u8", "(BADINDEH" ], [ 684366, "u8", "(MISSINGH" ], [ 688016, "u8", "BADPREC)M" ], [ 705975, "u8", "HcH H" ], [ 708827, "u8", "|$(H)" ], [ 712148, "u8", "\\$()" ], [ 714802, "u8", "+HcC H" ], [ 764042, "u8", "/dev/uraH9\u003e" ], [ 766292, "u8", "3H9K" ], [ 771565, "u8", "byXu8" ], [ 772356, "u8", "byXe" ], [ 772362, "u8", "byXm" ], [ 772368, "u8", "byXu" ], [ 776545, "u8", "ouPf" ], [ 776568, "u8", "oU fD" ], [ 778023, "u8", "expa" ], [ 778055, "u8", "te kL" ], [ 790250, "u8", "cau8A" ], [ 790273, "u8", "--remoteI90" ], [ 790297, "u8", "--remote" ], [ 790373, "u8", "--verbosI90u" ], [ 790421, "u8", "--verbos" ], [ 790442, "u8", "--timeou" ], [ 791879, "u8", "8prox" ], [ 793501, "u8", "8proxu" ], [ 836251, "u8", "J 8H" ], [ 838386, "u8", "J8H9" ], [ 838510, "u8", "J H9" ], [ 838597, "u8", "JPH9" ], [ 839198, "u8", "RPH9" ], [ 843851, "u8", "myhostnaM9\"u" ], [ 844020, "u8", "8fileu" ], [ 844364, "u8", "myhostna" ], [ 844454, "u8", "8fileuX" ], [ 844557, "u8", "8dnu" ], [ 845057, "u8", "9solau" ], [ 845085, "u8", "9linuu" ], [ 848511, "u8", "9ipul" ], [ 848534, "u8", "9ipu" ], [ 848644, "u8", "tcuZH" ], [ 848655, "u8", "9tcuH" ], [ 848823, "u8", "tauXH" ], [ 848833, "u8", "9unix" ], [ 848852, "u8", "unixgramH9" ], [ 848881, "u8", "unixpackH9" ], [ 849783, "u8", "9dial" ], [ 850007, "u8", "8dial" ], [ 850676, "u8", "unixgramH9:" ], [ 850701, "u8", "unixpackH9:u" ], [ 850771, "u8", "unixgramH9:u\tH" ], [ 850801, "u8", "unixpackL9" ], [ 854187, "u8", "unixgram" ], [ 888735, "u8", "eque" ], [ 888991, "u8", "single-r" ], [ 889600, "u8", "nameservH9" ], [ 889935, "u8", "nameserv" ], [ 905276, "u8", "tHMcQ" ], [ 924831, "u8", "9udu" ], [ 932284, "u8", "tMuAH" ], [ 933586, "u8", "8list" ], [ 937396, "u8", "9udp4u" ], [ 937431, "u8", "9udp6t" ], [ 949868, "u8", "ptu5H" ], [ 951678, "u8", "notfoundL9" ], [ 951699, "u8", "tryagainH9\u003et" ], [ 951716, "u8", "tryagain" ], [ 951728, "u8", "notfound" ], [ 967021, "u8", "unixgramM9" ], [ 967042, "u8", "unixpackM9" ], [ 968704, "u8", "unixgramH93" ], [ 968729, "u8", "unixpackH93u" ], [ 1016034, "u8", "rPH9XX" ], [ 1016086, "u8", "RpH9Ppt" ], [ 1029910, "u8", "J H9H" ], [ 1601697, "u8", ".text" ], [ 1601703, "u8", ".noptrdata" ], [ 1601714, "u8", ".data" ], [ 1601720, "u8", ".bss" ], [ 1601725, "u8", ".noptrbss" ], [ 1601735, "u8", ".go.buildinfo" ], [ 1601749, "u8", ".note.go.buildid" ], [ 1601766, "u8", ".elfdata" ], [ 1601775, "u8", ".rodata" ], [ 1601783, "u8", ".typelink" ], [ 1601793, "u8", ".itablink" ], [ 1601803, "u8", ".gosymtab" ], [ 1601813, "u8", ".gopclntab" ], [ 1601824, "u8", ".shstrtab" ], [ 2347009, "u8", "Go buildinf:" ], [ 2348432, "u8", "/proc/self/auxv" ], [ 2352672, "u8", "fatal error: cgo callback before cgo call" ], [ 2353952, "u8", "/sys/kernel/mm/transparent_hugepage/hpage_pmd_size" ], [ 2358762, "u8", "2050" ], [ 2362506, "u8", "H2O2" ], [ 2362512, "u8", "Q2_2" ], [ 2364289, "u8", "!\"#$$%%\u0026\u0026'''((()**+++++,,,,,,----......///0012222222222333333333344555566666777777777778888888888999999::::::::::::::::;;;;;;;;;" ], [ 2364832, "u8", "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~" ], [ 2371538, "u8", "0070" ], [ 2374472, "u8", "6070" ], [ 2404328, "u8", "aRss" ], [ 2404766, "u8", "G5_V" ], [ 2404982, "u8", "dtAxN" ], [ 2404991, "u8", "/wxRB" ], [ 2406135, "u8", "afNgy" ], [ 2407217, "u8", "acfO4" ], [ 2407420, "u8", "H1uyC" ], [ 5602374, "u8", "25" ], [ 5602376, "u8", "53" ], [ 5602384, "u8", "Cc" ], [ 5602386, "u8", "Cf" ], [ 5602388, "u8", "Co" ], [ 5602390, "u8", "Cs" ], [ 5602392, "u8", "Ll" ], [ 5602394, "u8", "Lm" ], [ 5602396, "u8", "Lo" ], [ 5602398, "u8", "Lt" ], [ 5602400, "u8", "Lu" ], [ 5602402, "u8", "Mc" ], [ 5602404, "u8", "Me" ], [ 5602406, "u8", "Mn" ], [ 5602408, "u8", "Nd" ], [ 5602410, "u8", "Nl" ], [ 5602412, "u8", "No" ], [ 5602414, "u8", "Pc" ], [ 5602416, "u8", "Pd" ], [ 5602418, "u8", "Pe" ], [ 5602420, "u8", "Pf" ], [ 5602422, "u8", "Pi" ], [ 5602424, "u8", "Po" ], [ 5602426, "u8", "Ps" ], [ 5602428, "u8", "Sc" ], [ 5602430, "u8", "Sk" ], [ 5602432, "u8", "Sm" ], [ 5602434, "u8", "So" ], [ 5602438, "u8", "Yi" ], [ 5602440, "u8", "Zl" ], [ 5602442, "u8", "Zp" ], [ 5602444, "u8", "Zs" ], [ 5602464, "u8", "ms" ], [ 5602466, "u8", "ns" ], [ 5602470, "u8", "up" ], [ 5602472, "u8", "us" ], [ 5602476, "u8", "}}µ G M P *( - \u003c \u003e m=%: 0.312562" ], [ 5602507, "u8", "0.3" ], [ 5602510, "u8", "125" ], [ 5602513, "u8", "625" ], [ 5602516, "u8", "::1" ], [ 5602522, "u8", "EOF" ], [ 5602525, "u8", "Han" ], [ 5602528, "u8", "Lao" ], [ 5602531, "u8", "May" ], [ 5602534, "u8", "Mro" ], [ 5602540, "u8", "Nko" ], [ 5602546, "u8", "TCP" ], [ 5602555, "u8", "UTC" ], [ 5602558, "u8", "Vai" ], [ 5602564, "u8", "adx" ], [ 5602567, "u8", "aes" ] ], "v": { "elf.type": "executable", "elf.class": "elf64", "elf.entry": 4562320, "file.stem": "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1", "elf.endian": "little", "elf.go.path": "iox", "elf.machine": "x86_64", "elf.version": 1, "file.basename": "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf", "elf.go.version": "go1.13.8", "elf.entry_section": ".text", "elf.go.deps[0].sum": "h1:gWF768j/LaZugp8dyS4UwsslYCYz9XgFxvlgsn0n9H8=", "elf.go.module.path": "iox", "elf.go.deps[0].path": "golang.org/x/sys", "elf.segments[0].type": "phdr", "elf.segments[1].type": "note", "elf.segments[2].type": "load", "elf.segments[3].type": "load", "elf.segments[4].type": "load", "elf.segments[5].type": "gnu_stack", "elf.segments[6].type": "other", "elf.go.module.version": "(devel)", "elf.segments[0].perms": "r--", "elf.segments[0].vaddr": 4194368, "elf.segments[1].perms": "r--", "elf.segments[1].vaddr": 4198300, "elf.segments[2].perms": "r-x", "elf.segments[2].vaddr": 4194304, "elf.segments[3].perms": "r--", "elf.segments[3].vaddr": 5275648, "elf.segments[4].perms": "rw-", "elf.segments[4].vaddr": 6541312, "elf.segments[5].perms": "rw-", "elf.segments[6].perms": "---", "elf.go.deps[0].version": "v0.0.0-20200420163511-1957bb5e6d1f", "build.toolchain.compiler": "go", "elf.segments[0].file_size": 392, "elf.segments[0].flags_hex": "4", "elf.segments[1].file_size": 100, "elf.segments[1].flags_hex": "4", "elf.segments[2].file_size": 1077330, "elf.segments[2].flags_hex": "5", "elf.segments[3].file_size": 1262901, "elf.segments[3].flags_hex": "4", "elf.segments[4].file_size": 91360, "elf.segments[4].flags_hex": "6", "elf.segments[5].flags_hex": "6", "elf.segments[6].flags_hex": "2a00", "elf.segments[0].file_offset": 64, "elf.segments[0].memory_size": 392, "elf.segments[1].file_offset": 3996, "elf.segments[1].memory_size": 100, "elf.segments[2].memory_size": 1077330, "elf.segments[3].file_offset": 1081344, "elf.segments[3].memory_size": 1262901, "elf.segments[4].file_offset": 2347008, "elf.segments[4].memory_size": 220072, "binary.top_complex_unnamed[0].cc": 8, "binary.top_complex_unnamed[1].cc": 8, "binary.top_complex_unnamed[2].cc": 5, "elf.stripped_metadata_sections[0]": ".symtab", "elf.stripped_metadata_sections[1]": ".strtab", "elf.stripped_metadata_sections[2]": ".comment", "elf.stripped_metadata_sections[3]": ".debug_info", "elf.stripped_metadata_sections[4]": ".debug_line", "elf.stripped_metadata_sections[5]": ".debug_str", "elf.stripped_metadata_sections[6]": ".debug_abbrev", "elf.stripped_metadata_sections[7]": ".note.gnu.gold-version", "binary.top_complex_unnamed[0].addr": "0x423111", "binary.top_complex_unnamed[1].addr": "0x423191", "binary.top_complex_unnamed[2].addr": "0x412891" }, "id": "elf", "sc": [ [ ".text", 4096, 1073234, 0.0, "alloc,executable" ], [ ".rodata", 1081344, 520349, 0.0, "alloc" ], [ ".shstrtab", 1601696, 138, 0.0, "" ], [ ".typelink", 1601856, 4680, 0.0, "alloc" ], [ ".itablink", 1606536, 512, 0.0, "alloc" ], [ ".gopclntab", 1607072, 737173, 0.0, "alloc" ], [ ".go.buildinfo", 2347008, 32, 0.0, "write,alloc" ], [ ".noptrdata", 2347040, 60728, 0.0, "write,alloc" ], [ ".data", 2407776, 30576, 0.0, "write,alloc" ], [ ".note.go.buildid", 3996, 100, 0.0, "alloc" ] ] }, "id": 0, "sz": 2438368, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 0.20000000298023224, "d": "crypto keyword (word match)", "e": [ "crypto" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-word", "l": 1, "el": [ "0x561012" ] }, { "c": 1.0, "d": "File larger than 1MB", "e": [ "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf" ], "i": "metadata/binary/metrics/size::large-file-1mb", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "/dev/urandom" ], "i": "micro-behaviors/os/random/crypto::urandom", "l": 2, "el": [ "0x5591fd" ] }, { "a": "T1059.004", "c": 0.800000011920929, "d": "Terminal type linux identifier", "e": [ "linux" ], "i": "objectives/command-and-control/reverse-shell/pty::terminal-type-linux", "l": 1, "m": "B0024", "el": [ "0x557fd9" ] }, { "c": 0.30000001192092896, "d": "token keyword", "e": [ "token" ], "i": "micro-behaviors/data/text/keywords/lexicon::token", "l": 1, "el": [ "0x559019" ] }, { "c": 0.6600000262260437, "d": "Read own executable path (/proc/self/exe)", "e": [ "/proc/self/exe" ], "i": "micro-behaviors/fs/proc/info/path::process-self-exe-path", "l": 2, "el": [ "0x559763" ] }, { "c": 0.20000000298023224, "d": "pipe keyword", "e": [ "pipe" ], "i": "micro-behaviors/data/text/keywords/lexicon::pipe", "l": 1, "el": [ "0x558fd7" ] }, { "c": 0.8999999761581421, "d": "Large ELF with 500+ strings", "e": [ "binary.string_count = 4018.00" ], "i": "metadata/binary/metrics/structural::many-strings-large-elf", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "/etc/resolv.conf", "/etc/protocols", ", not a function.WithValue(type /etc/reso", "work.full != 0 with GC prog\n/etc/mdns.allow476", ", not pointer-byte block (/etc/services3", "/etc/services", "/etc/mdns.allow", "/etc/nsswitch.conf", "/etc/hosts" ], "i": "micro-behaviors/fs/path/config/system::config-etc", "l": 2, "el": [ "0x559c37", "0x559755", "0x559c17", "0x5599d9", "0x559504", "0x55951e", "0x5599f6", "0x55a301", "0x558c22" ] }, { "c": 1.0, "d": "scanner word", "e": [ "Scanner" ], "i": "objectives/impact/infect/lexicon::scanner-word", "l": 1, "el": [ "0x55cef1" ] }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 4018.00" ], "i": "metadata/binary/metrics/threshold::string-count-1000-plus", "l": 2 }, { "c": 1.0, "d": "bootstrap string", "e": [ "bootstrap" ], "i": "objectives/command-and-control/channel/p2p::bootstrap-str", "l": 1, "el": [ "0x55fb55" ] }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf" ], "i": "metadata/binary/metrics/threshold::large-binary-500k", "l": 1 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening/layout::no-pie", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 39751.00" ], "i": "metadata/binary/metrics/structural::dense-basic-blocks", "l": 1 }, { "c": 0.20000000298023224, "d": "localtime function (string)", "e": [ "localtime" ], "i": "micro-behaviors/time/query::localtime-string", "l": 2, "el": [ "0x5589a9" ] }, { "c": 0.6000000238418579, "d": "TCP endpoint state error", "e": [ "transport endpoint is not connected", "transport endpoint is already connected" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-endpoint", "l": 2, "el": [ "0x55e806", "0x55f1a1" ] }, { "a": "T1041", "c": 0.8600000143051147, "d": "Notification config wording", "e": [ "Notify" ], "i": "objectives/exfiltration/messaging/webhook::notification-config-word", "l": 1, "m": "B0030", "el": [ "0x55e6ee" ] }, { "a": "T1059.004", "c": 0.9300000071525574, "d": "Regex component marker", "e": [ "Usage: " ], "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-0--inline-10025", "l": 1, "m": "B0024", "el": [ "0x561221" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 BIND request opcode", "e": [ "05 02 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-bind-command-byte", "l": 1, "el": [ "0xb950" ] }, { "a": "T1071.004", "c": 0.6600000262260437, "d": "Reads DNS resolver configuration", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/communications/dns/lookup/native::lookup-resolv", "l": 3, "m": "C0011", "el": [ "0x559c37" ] }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "result", "command" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030", "el": [ "0x55cff6", "0x55e4e3" ] }, { "c": 0.6600000262260437, "d": "Reference to /etc/resolv.conf", "e": [ "/etc/resolv.conf" ], "i": "micro-behaviors/fs/path/config/system::config-resolv", "l": 3, "el": [ "0x559c37" ] }, { "a": "T1021.004", "c": 0.4000000059604645, "d": "ssh string", "e": [ "ssh" ], "i": "micro-behaviors/communications/ssh/connect::ssh-string", "l": 2, "el": [ "0x557d43" ] }, { "a": "T1106", "c": 0.949999988079071, "d": "__vdso exported symbol string", "e": [ "__vdso_clock_gettime", "__vdso_gettimeofday" ], "i": "objectives/evasion/anti-av/syscall::linux-vdso-symbol", "l": 1, "m": "B0009", "el": [ "0x55ab5e", "0x55a6db" ] }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 8.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 0.8399999737739563, "d": "ICMP sequential heartbeat payload", "e": [ "!\"#$%\u0026'()*+,-./0123456789:;\u003c=\u003e?@ABCDEFGHIJKLMNO…" ], "i": "micro-behaviors/os/bpf/program/icmp::icmp-heartbeat-payload-ascii", "l": 1, "el": [ "0x2415a0" ] }, { "c": 0.30000001192092896, "d": "ICMP service/protocol reference", "e": [ "icmp" ], "i": "micro-behaviors/communications/ip/services::services-icmp", "l": 2, "el": [ "0x558997" ] }, { "c": 0.20000000298023224, "d": "output keyword", "e": [ "stopped (tty output)", "…0\n -v\n enable log output\n -h\n print usage …", "input/output error" ], "i": "micro-behaviors/data/text/keywords/lexicon::output", "l": 1, "el": [ "0x55adca", "0x561221", "0x55a47b" ] }, { "c": 0.6000000238418579, "d": "SOCKS5 UDP ASSOCIATE request opcode", "e": [ "05 03 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-udp-associate-byte", "l": 1, "el": [ "0x26246" ] }, { "c": 0.6499999761581421, "d": "Binary contains unusually large functions", "e": [ "binary.huge_func_count = 134.00" ], "i": "metadata/binary/metrics/structural::large-functions", "l": 3 }, { "c": 0.5799999833106995, "d": "Read own executable path fragment (self/ex)", "e": [ "/proc/self/exe" ], "i": "micro-behaviors/fs/proc/info/path::process-self-ex-fragment", "l": 2, "el": [ "0x559763" ] }, { "c": 0.30000001192092896, "d": "XGETBV instruction bytes", "e": [ "0F 01 D0" ], "i": "metadata/binary/instruction::xgetbv-instr", "l": 2, "el": [ "0x1b75" ] }, { "c": 0.8999999761581421, "d": "Go ELF noptrdata section", "e": [ ".noptrdata" ], "i": "metadata/lang/compiler/systems::go-noptrdata-elf", "l": 2 }, { "c": 0.8999999761581421, "d": "SOCKS5 client greeting bytes", "e": [ "05 01 00" ], "i": "micro-behaviors/communications/proxy/socks::socks5-version-greeting-bytes", "l": 1, "el": [ "0x13693" ] }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 4018.00" ], "i": "metadata/binary/metrics/threshold::many-strings-2000", "l": 1 }, { "c": 0.949999988079071, "d": "Go ELF build info section", "e": [ ".go.buildinfo" ], "i": "metadata/lang/compiler/systems::go-buildinfo-elf", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 7.31" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1, "el": [ "0x198c" ] }, { "d": "overflow keyword", "e": [ "integer overflow", "binary: varint overflows a 64-bit integer", "LockOSThread nesting overflow", "runtime: split stack overflow: ", "markBits overflow", "runtime: stat overflow: val " ], "i": "micro-behaviors/data/text/keywords/lexicon::overflow", "l": 1, "el": [ "0x559db7", "0x55f49b", "0x55ce43", "0x55d8e3", "0x55a132", "0x55cd7c" ] }, { "c": 0.20000000298023224, "d": "crypto keyword (substr, catches imports)", "e": [ "crypto/rand: blocked for 60 seconds waiting to read random data from the kernel\n" ], "i": "micro-behaviors/data/text/keywords/lexicon::crypto-substr", "l": 1, "el": [ "0x561012" ] }, { "c": 0.7200000286102295, "d": "cBPF load ICMP sequence field", "e": [ "28 00 00 00 28 00 00 00" ], "i": "micro-behaviors/os/bpf/program/icmp::cbpf-load-icmp-seq-ethernet", "l": 1, "el": [ "0x173b35" ] }, { "c": 0.8999999761581421, "d": "ELF imports zero needed libraries", "e": [ "dependencies.count = 0.00" ], "i": "metadata/binary/linking/static::elf-needed-libs-zero", "l": 2 }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2, "el": [ "0x55ebfc" ] }, { "c": 1.0, "d": "Binary symbol table is stripped", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/layout::stripped", "l": 2 }, { "c": 0.8999999761581421, "d": "Go ELF build ID note", "e": [ ".note.go.buildid" ], "i": "metadata/lang/compiler/systems::go-note-buildid-elf", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "socks only support connect command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1, "el": [ "0x55e4e3" ] }, { "c": 1.0, "d": "Go-compiled binary (identified by .gopclntab section)", "e": [ ".gopclntab" ], "i": "metadata/lang/compiler/systems::go-binary", "l": 2 }, { "a": "T1027", "c": 0.4000000059604645, "d": "Many tiny functions (\u003c16 bytes)", "e": [ "binary.tiny_func_count = 594.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::many-tiny-functions", "l": 4, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 4018.00" ], "i": "metadata/binary/metrics/threshold::high-string-count-1000", "l": 2 }, { "c": 0.6000000238418579, "d": "TCP connection refused error", "e": [ "connection refused" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-refused", "l": 2, "el": [ "0x55a3fd" ] }, { "c": 0.6000000238418579, "d": "TCP connection timeout error", "e": [ "connection timed out" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-timeout", "l": 2, "el": [ "0x55abfe" ] }, { "c": 1.0, "d": "Toolchain banner stripped, build-id retained", "e": [ "[.symtab, .strtab, .comment, .debug_info, .debug_line, .debug_str, .debug_abbrev, .note.gnu.gold-version]" ], "i": "metadata/build/artifact::aggressive-strip", "l": 2, "el": [ "value:elf.stripped_metadata_sections" ] }, { "c": 0.800000011920929, "d": "No full symbol table (likely stripped)", "e": [ "binary.is_stripped = 1.00" ], "i": "metadata/hardening/missing::stripped-binary", "l": 3 }, { "c": 0.6000000238418579, "d": "TCP connection reset error", "e": [ "connection reset by peer" ], "i": "micro-behaviors/communications/socket/tcp::go-net-error-connection-reset", "l": 2, "el": [ "0x55bc04" ] }, { "c": 0.6600000262260437, "d": "Reference to /etc/hosts", "e": [ "/etc/hosts" ], "i": "micro-behaviors/fs/path/config/system::config-hosts", "l": 3, "el": [ "0x558c22" ] }, { "c": 0.8399999737739563, "d": "Large binary with few DLL dependencies", "e": [ "dependencies.count = 0.00" ], "i": "metadata/package/metrics::import-count-under-80", "l": 2 }, { "c": 0.4000000059604645, "d": "Embedded ZIP archive", "e": [ "50 4B 03 04" ], "i": "micro-behaviors/data/embedded/payload/archive::zip-magic", "l": 2, "el": [ "0x955ad" ] }, { "a": "T1106", "c": 0.8999999761581421, "d": "Syscall with immediate number", "e": [ "1b 00 00 00", "01 00 00 00", "e7 00 00 00", "23 00 00 00", "ba 00 00 00", "26 00 00 00", "0e 00 00 00", "01 01 00 00", "27 00 00 00", "3c 00 00 00", "03 00 00 00", "00 00 00 00", "ea 00 00 00", "3e 00 00 00" ], "i": "objectives/evasion/anti-av/syscall::syscall-with-number", "l": 1, "m": "B0009", "el": [ "0x59f5f", "0x59e2e", "0x59da4", "0x59eb6", "0x59ed0", "0x59f3e", "0x5a103", "0x59de3", "0x59ee0", "0x59dc0", "0x59e04", "0x59e5d", "0x59efa", "0x59f1d" ] }, { "a": "T1027", "d": "Binary is 1MB or larger", "e": [ "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf" ], "i": "objectives/anti-static/obfuscation/binary-metrics/shape::file-size-1m-plus", "l": 1, "m": "B0032" }, { "c": 0.9399999976158142, "d": "Go ELF retains rich runtime metadata", "e": [ ".noptrdata", ".go.buildinfo", ".note.go.buildid" ], "i": "metadata/lang/compiler/systems::go-elf-rich-runtime-metadata", "l": 1 } ], "sha": "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1", "path": "5bef1edbff008d4fe5c253b7c0b6721ef45261d441d682e40ef882d4b66699f1.elf", "type": "elf" } ], "tv": "52045" } }