{ "ml": { "v": "7", "eng": "2.2.0-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.0012566149, "rte": "az", "prob": 0.0012566149 }, { "cls": 0, "raw": 0.0003874898, "rte": "az/tar", "prob": 0.0003874898 } ], "prob": 0.012197654, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.012197653762996197, "type": "apk_alpine" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.004895885940641165, "type": "elf" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.008580873720347881, "type": "elf" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.009901990182697773, "type": "elf" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.011044512502849102, "type": "elf" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.012197653762996197, "type": "elf" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.008551220409572124, "type": "elf" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.007763952016830444, "type": "elf" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000010838110938493628, "type": "text" } ], "version": "v18.18", "analyzed_at": "2026-06-26T10:13:00Z" }, "path": "gnutls-utils-3.8.13-r0.apk", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "abZy8000000T3{24[J!\u003enkh=HeH]u63?!Yp^*DIa!jX1m:JNrco?u{f=2H?Deg@xa3GU*X", "n": [ { "c": 2, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 } ], "mol": "O₄(AlAs₂CCo)H₅(Cm₁₂Cr₂F₃PoU)Md(He)", "sha": "6bf06892afe4f2035a35a537eb96d27d7922977586ba3f285d4785451245f7e3", "path": "gnutls-utils-3.8.13-r0.apk", "risk": 13, "size": 325584, "type": "apk_alpine", "facts": { "metrics": { "file": { "size": 325584.0, "entropy": 8.0, "size_bytes": 325584.0 }, "parse": { "error_count": 1.0 }, "binary": { "overall_entropy": 8.0, "peak_region_bytes": 316368.0, "peak_region_entropy": 7.84 } } }, "traits": [ { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/channel/http/message::http-delimiter", "atk": "T1071.001", "crit": 1, "desc": "HTTP header syntax marker", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "from": [ { "file": 3 } ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "from": [ { "file": 2 } ], "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.699999988079071, "crit": 2, "desc": "PEM begin marker", "from": [ { "file": 6 } ], "spans": [ [ 128095, 10 ] ] }, { "id": "objectives/command-and-control/channel/http/message::http-method-post", "atk": "T1071.001", "conf": 0.6499999761581421, "crit": 1, "desc": "Hardcoded POST method string", "from": [ { "file": 3 } ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/post::native-post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "Native HTTP POST request line", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/asymmetric/rsa::pem-private-key-embedded", "conf": 0.949999988079071, "crit": 3, "desc": "Embedded PEM RSA private key block", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "from": [ { "file": 2 } ], "spans": [ [ 63419, 6 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-package-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package name field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "from": [ { "file": 2 } ], "spans": [ [ 71892, 11 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "from": [ { "file": 3 } ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "from": [ { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "from": [ { "file": 3 } ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::base64-in-rodata", "conf": 0.800000011920929, "crit": 3, "desc": "Base64 data in rodata", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/communications/socket/receive::recvfrom-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvfrom socket call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/encode/payload::c-array-format", "conf": 0.6000000238418579, "crit": 3, "desc": "C array declaration format string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/socket/tcp::send-symbol-text", "conf": 0.75, "crit": 3, "desc": "Send API symbol text", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::usage-lower", "crit": 2, "desc": "usage: label (lowercase)", "from": [ { "file": 7 } ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "from": [ { "file": 1 } ], "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/communications/socket/send::sendto-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendto socket call", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "from": [ { "file": 1 } ], "spans": [ [ 67995, 128 ], [ 68023, 65 ], [ 76489, 128 ], [ 76528, 81 ], [ 84168, 128 ], [ 84196, 62 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/base64::dense-base64-encoding", "atk": "T1027.001", "conf": 0.8500000238418579, "crit": 3, "desc": "Dense base64-encoded content", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "from": [ { "off": 17261, "file": 2 }, { "off": 14610, "file": 3 }, { "off": 12897, "file": 4 }, { "off": 11244, "file": 5 }, { "off": 15320, "file": 6 }, { "off": 20720, "file": 7 } ], "spans": [ [ 12897, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "from": [ { "file": 2 } ] }, { "id": "objectives/command-and-control/channel/http/message::http-method-get", "atk": "T1071.001", "conf": 0.6000000238418579, "crit": 1, "desc": "Hardcoded GET method string", "from": [ { "file": 5 } ], "spans": [ [ 79763, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "from": [ { "file": 1 } ], "spans": [ [ 67995, 128 ], [ 68023, 65 ], [ 76489, 128 ], [ 76528, 81 ], [ 84168, 128 ], [ 84196, 62 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 }, { "file": 7 } ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7799999713897705, "crit": 3, "desc": "HTTP POST request line", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 }, { "file": 7 } ], "spans": [ [ 67995, 128 ], [ 68023, 65 ], [ 76489, 128 ], [ 76528, 81 ], [ 84168, 128 ], [ 84196, 62 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 2 } ], "spans": [ [ 0, 22 ] ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-origin-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package origin field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "from": [ { "file": 1 } ], "spans": [ [ 16993, 5 ] ] }, { "id": "micro-behaviors/communications/http/get::manual-http10-dynamic-get", "conf": 0.8999999761581421, "crit": 3, "desc": "Manual dynamic HTTP/1.0 GET", "from": [ { "file": 6 } ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "from": [ { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 6 }, { "file": 7 } ], "spans": [ [ 15050, 4 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "from": [ { "file": 2 } ], "spans": [ [ 0, 29 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 }, { "file": 7 } ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 3, "desc": "Get password file entry by UID", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "from": [ { "file": 1 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-version-field", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package version field", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "from": [ { "file": 2 }, { "file": 3 }, { "file": 7 } ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "from": [ { "file": 2 } ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "from": [ { "file": 1 } ] }, { "id": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "conf": 0.699999988079071, "crit": 3, "desc": "GnuTLS function names", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/communications/http/get::get", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP GET method", "from": [ { "file": 5 } ], "spans": [ [ 79763, 16 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "from": [ { "file": 1 }, { "file": 2 }, { "file": 3 }, { "file": 4 }, { "file": 5 }, { "file": 6 }, { "file": 7 } ], "spans": [ [ 67995, 128 ], [ 68023, 65 ], [ 76489, 128 ], [ 76528, 81 ], [ 84168, 128 ], [ 84196, 62 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.699999988079071, "crit": 2, "desc": "PEM end marker", "from": [ { "file": 6 } ], "spans": [ [ 128118, 8 ] ] }, { "id": "micro-behaviors/communications/http/upload::octet-stream-upload-header", "atk": "T1071.001", "conf": 0.8399999737739563, "crit": 3, "desc": "HTTP octet-stream upload header", "from": [ { "file": 4 } ] }, { "id": "metadata/package/files/system-package::alpine-pkginfo-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Alpine/Wolfi package info file" }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "from": [ { "file": 3 } ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6000000238418579, "crit": 2, "desc": "x509 string reference", "from": [ { "file": 6 } ], "spans": [ [ 125504, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-lower-string", "crit": 1, "desc": "usage: label in binary strings", "from": [ { "file": 7 } ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "from": [ { "file": 3 } ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "from": [ { "file": 2 } ] } ] }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91/=Zs}00000kMy=:00000c@x%A0000000000kMA+z4feS[8#{]T1][S6", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "W7]-@y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000a0000M00001000060000EFDc!#1vi", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "pYHE}000080000000000wQ4{h0bVp:zeTPe0af8yCWT@\u003ex(mu}x)Ks\u003cuRai\u003euU0.*wOkZ#By/F(o*--nzE(^QvR/PQw[LW%A@Zo6A:@^60crm5zEWK50crl\u003cBo2](A+PAkw=MgBB97\u00262yHpN+yHpWZx(0=\u003cByX%6ASxY\u0026AaJ[!uTEtPA+e($B97#luUjs!zdN6*zF0!!B8C@qx(n1", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 2403, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 2381, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 2366, "z": 4, "cf": 0.800000011920929 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 2304, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 2345, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 2289, "z": 4, "cf": 0.4000000059604645 } ], "ln": 2273 }, { "b": "vqPN.x(mK30a].Sz/YE\u0026xjVgcx\u003edi+BAhhezua3nr83.uwOkZ#By/F(o*--nzE(^QvR=", "n": [ { "c": 2, "d": "Get user ID", "i": "micro-behaviors/os/privilege/query::getuid", "o": 2471, "z": 6, "cf": 0.5 } ], "ln": 2455 }, { "b": "z#:GYA=M8s0b(*#x(mCYAa%o50b#H\u0026A=k%#xjVg7CxERg0a{d\u0026yxeA$A=Vhq0crm5v@(Qb0aZj\u003eg5#xqwn=Qj0a{g)BAmC8zddH30chT/z*2W(z/x/bA+tw+wPR\u003cfBye\u003c5zF5@XCX7xdz#:lLw]Is0wnb{]0aftLzFo8TuU\u003cB=v{:q0vrcD%z2", "n": [ { "c": 3, "d": "Set file creation mask (umask)", "i": "micro-behaviors/fs/chmod/modify::umask", "o": 2735, "z": 5, "cf": 0.4000000059604645 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::remove", "o": 2741, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 2767, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Get password file entry by UID", "i": "micro-behaviors/process/user/query::getpwuid", "o": 2688, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 2717, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 2697, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 2676, "z": 4, "cf": 0.8500000238418579 } ], "ln": 2660 }, { "b": "B8JV!fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Am]05-oJbpOuO?-.009620096200962009", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 2835, "z": 6, "cf": 0.30000001192092896 } ], "ln": 2819 }, { "b": "Bz(8oz/l+mz/fg{03#XsBzU%%w[=6)aswERcM)bAaz+$ayH}2-0cXAgvqY$3BrCHvwO@Rrc37BRw]zYjCxdztwEnA8vqY$3BrC7iAcSMNc37BRBz\u0026oHc37B", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 12361, "z": 3, "cf": 0.800000011920929 }, { "c": 2, "d": "Reference to a temporary directory", "i": "micro-behaviors/fs/temp/reference::temp-dir-reference", "o": 12317, "z": 3, "cf": 0.4000000059604645 } ], "ln": 12301 }, { "b": "xkRBfvpB4:az#ssvR6MWAc2/pz/oCmeG^M3BYq4kaw=0faARKuyZKf-vp%djarUSAyJKGky-(}8eJ^SYvp}+DtrE7qy^8bED($0)jz[OAwJ\u003csBj:Xx2jA+dHk3Yppe?O+03joKDzE\u003e\u003co3lQDleO3yPeIgHAvS=rDzGP!sarR^HarR^HarR^}zEE0\u003cwGUI{vS=r@x(mL\u003c2)*[AeG!+Haz(mxBrC47azCZoBzbkdA:-\u0026#wJye82)*[Xats{WzY?52ixmA?arSmSefDI", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 12693, "z": 128, "cf": 0.949999988079071 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 12857, "z": 3, "cf": 0.800000011920929 } ], "ln": 12677 }, { "b": "arTQ4wN/B^C{3JrAb]IwB7/05wN({0wQbzgx(4t/3ry.UB7]MgefG7Rvp%c]vqYP#v@Dl%x\u003eINevruj4zxJ\u003epBzkVhB2\u003cTnarR^UB$s:/eP$YCB7]MgtrMznxi=S5arR^HarUPBBz#wAaA?spB7]MgazC.9", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 13193, "z": 9, "cf": 0.9399999976158142 }, { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 13158, "z": 3, "cf": 0.800000011920929 }, { "c": 1, "d": "KEM shared secret term", "i": "micro-behaviors/crypto/asymmetric/kem::shared-term", "o": 13126, "z": 10, "cf": 0.8600000143051147 } ], "ln": 13110 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 13255, "z": 3, "cf": 0.9399999976158142 } ], "ln": 13239 }, { "b": "v@#p5e^.}ZA=kPhvqNbfBzb98azkn6wPzj3wPF#mvqYQ]z6iR9D2\u003e9uz/M$yB7DFr", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 13514, "z": 4, "cf": 0.800000011920929 } ], "ln": 13498 }, { "b": "0c00{Bz(8latUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 13947, "z": 9, "cf": 0.6000000238418579 } ], "ln": 13931 }, { "b": "x(v(uayPd#aA8vnwPz\u00260ra]#!azC)tw].D]aAIEkBA.elwIb8%BrCpsaz++4wO#N2", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 14008, "z": 4, "cf": 0.800000011920929 } ], "ln": 13992 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 14138, "z": 9, "cf": 0.699999988079071 } ], "ln": 14122 }, { "b": "oI5h^aA8oymOcMOmn)bcmO=]8k{e#\u0026qDcjPrzkXRaw=6op!$1Ue^+J*wGV8dwGTF", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 14897, "z": 3, "cf": 0.800000011920929 } ], "ln": 14881 }, { "b": "y\u0026.io3r.p\u0026aAIjmB.\u003eOhxKM6}aAz46wODs0wftq6v@DsiaA7\u003cmBzbkdm]05bm}DNH", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 14988, "z": 4, "cf": 0.800000011920929 } ], "ln": 14972 }, { "b": "v\u003c1DVv}xL0wEq\u003cZz/fhgCwhejaARphB0bBxz!B90z7V}NnOf8.z/^JMB7F]9jzn?U", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 15049, "z": 4, "cf": 0.800000011920929 } ], "ln": 15033 }, { "b": "000000000008JT}00000Ac2/pz/oCAwmYj)x8?]iRe4V304@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026Hz#", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 20488, "z": 13, "cf": 1.0 } ], "ln": 20472 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 20583, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 20575, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 20557, "z": 7, "cf": 0.8999999761581421 } ], "ln": 20541 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 20736, "z": 8, "cf": 0.8999999761581421 } ], "ln": 20720 } ], "depth": 1, "facts": { "exp": [ [ "init" ], [ "stderr" ], [ "gnutls_free" ], [ "gnutls_realloc" ], [ "fini" ], [ "gnutls_strdup" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "memmove" ], [ "", "cxa_finalize" ], [ "", "strcspn" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "fgets" ], [ "", "close" ], [ "", "strchr" ], [ "", "umask" ], [ "", "strncmp" ], [ "", "stat" ], [ "", "strerror" ], [ "", "fputs" ], [ "", "stdout" ], [ "", "dup2" ], [ "", "gnutls_hex_encode2" ], [ "", "fprintf" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "fpending" ], [ "", "execvp" ], [ "", "perror" ], [ "", "optind" ], [ "", "secure_getenv" ], [ "", "gnutls_rnd" ], [ "", "strspn" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "deregister_frame_info" ], [ "", "ferror" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_global_init" ], [ "", "libc_start_main" ], [ "", "pipe" ], [ "", "remove" ], [ "", "fclose" ], [ "", "gnutls_strerror" ], [ "", "getpwuid" ], [ "", "getuid" ], [ "", "strlen" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strtol" ], [ "", "errno_location" ], [ "", "optarg" ], [ "", "strcmp" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 88, 3.38, "alloc" ], [ ".dynsym", 992, 1296, 1.08, "alloc" ], [ ".dynstr", 2288, 570, 4.54, "alloc" ], [ ".gnu.version", 2858, 108, 1.28, "alloc" ], [ ".gnu.version_r", 2968, 32, 2.03, "alloc" ], [ ".rela.dyn", 3000, 1224, 1.46, "alloc" ], [ ".rela.plt", 4224, 24, 0.98, "alloc,info_link" ], [ ".relr.dyn", 4248, 24, 1.49, "alloc" ], [ ".init", 8192, 3, 1.58, "alloc,executable" ], [ ".plt", 8208, 32, 3.05, "alloc,executable" ], [ ".text", 8240, 3353, 5.81, "alloc,executable" ], [ ".fini", 11593, 3, 1.58, "alloc,executable" ], [ ".rodata", 12288, 3008, 5.03, "alloc" ], [ ".eh_frame_hdr", 15296, 68, 3.54, "alloc" ], [ ".eh_frame", 15368, 408, 4.69, "alloc" ], [ ".init_array", 19184, 8, 1.06, "write,alloc" ], [ ".fini_array", 19192, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 19200, 296, 0.87, "write,alloc" ], [ ".dynamic", 19496, 560, 1.45, "write,alloc" ], [ ".got", 20056, 408, 0.1, "write,alloc" ], [ ".data", 20480, 8, 0.54, "write,alloc" ], [ ".gnu_debuglink", 20488, 20, 3.75, "" ], [ ".shstrtab", 20508, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 8665.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 54.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 51.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 54.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 4272.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 4272.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 22568.0, "entropy": 3.25, "size_bytes": 22568.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 5.78, "data_entropy": 0.88, "overlay_size": 1792.0, "string_count": 138.0, "overlay_ratio": 0.08, "overall_entropy": 3.25, "overlay_entropy": 1.41, "entropy_variance": 2.54, "avg_string_length": 38.67, "max_string_length": 974.0, "peak_region_bytes": 3072.0, "code_to_data_ratio": 0.72, "peak_region_entropy": 5.75, "string_length_stddev": 114.25, "largest_section_ratio": 0.15, "sentence_string_count": 52.0, "sentence_string_ratio": 0.38, "high_entropy_string_count": 0.0 }, "exports": { "count": 6.0 }, "imports": { "count": 47.0 }, "sections": { "count": 28.0, "code_size": 3391.0, "entropy_max": 5.81, "entropy_mean": 2.49, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 1, "mol": "H₂(F₂Po)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/psktool", "risk": 4, "sha": "3aec2f3f3349df71bebf5baeef10013f0d872971d203c7c3fb170b06caa3c7e4", "size": 22568, "traits": [ { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 2735, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 12693, 128 ], [ 12719, 61 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 2304, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 2403, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 12693, 128 ], [ 12719, 61 ] ] }, { "id": "micro-behaviors/process/user/query::getpwuid", "atk": "T1033", "mbc": "E1033", "crit": 3, "desc": "Get password file entry by UID", "spans": [ [ 2688, 8 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 2767, 6 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 2767, 6 ] ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 2741, 6 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 2366, 4 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 2304, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 12693, 128 ], [ 12719, 61 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 2304, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91pJ#\u003ct00000kMy=:00000Fr{xs0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "U=r)uy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000C0000/0rr93000070000401{Xt0F7", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "F=U]L0000g0000000000wQ4{h0chTVy\u00261310af8yCWT@\u003ex(mu}x)Ks\u003cB98CzBAdv[A+eV\u00260aeq%o\u003c.BxA+e($B97#lr82.@z/fb=vpB4:0a]\u003ePBAmC6BAhnezeYF@BAhzixMs8]BAhnnwO}GRvScpe0a]?VB-Ri@uTE\u003e@vpK7Wv}YT+w)]y\u00260crl)wPz!\u003eB98CjAcRC8BAg(1Bo3x7A+oAczdJYVz/xo90af8zwPzu{x(!xcA:JB0vqPN.x(mK30cr3%A+PAk", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 9696, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 9651, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 9552, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 9572, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 9636, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 9606, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 9537, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 9687, "z": 8, "cf": 0.20000000298023224 } ], "ln": 9521 }, { "b": "x(mK30crm5v{%B\u0026v@le+w]?J{yxei.zdvB40a].Sz/YE\u0026B98CswO}GPnMnz\u003eA+e($A@", "n": [ { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 9768, "z": 5, "cf": 0.699999988079071 } ], "ln": 9752 }, { "b": "BzM29Abe%8f!)3Bz/x#eB7F\u003c4wPRo{wQan*zGQ5qB6\u003ceHfGAGVA+PYjwQdS}wPRo#yHpH^xkW", "n": [ { "c": 1, "d": "Secret marker string (key/token/api)", "i": "objectives/exfiltration/http/upload::secret-key", "o": 10067, "z": 10, "cf": 0.6000000238418579 } ], "ln": 10051 }, { "b": "uUKy(Bo2@\u003eB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuWaBZiBu-Cx)ao6C(", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 11608, "z": 9, "cf": 1.0 } ], "ln": 11592 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuUi[XxK$KcfGz3#xl4{kA9)N8x(dzYx8", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 13818, "z": 9, "cf": 1.0 } ], "ln": 13802 }, { "b": "zua:1A==ko0cqZYB-I52xjVf@zGV23BAg(8ASx-\u0026B-.CvuUB1}uU0.Tz!9Am0b3g(BzM29A=by/x(mH7uVpa9zuarXBzLVewDlvXB-.CvuWaBZiBuopByf92ByeM@uJ", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 15877, "z": 9, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 15833, "z": 6, "cf": 0.4000000059604645 } ], "ln": 15817 }, { "b": "wO#N6z/e]\u003eD0+G7wb]$zvrlH3A=+V2vqfJTw[u16z/L?/y\u0026r*0uUr}(BzkP60a]}YwO#z^w]\u002665Bo2]{wO=g30cqZ[C4bPa0b3d\u003cx(dA*ASxY\u003cB-.9[w]I)mA@YS\u0026zztHfzEWP}wNxH)ze:r5uU0.*0ax{", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 16993, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 16953, "z": 11, "cf": 0.5 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 17023, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 17014, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 16972, "z": 13, "cf": 0.4000000059604645 } ], "ln": 16937 }, { "b": "A=k%#xjVf{0b(*#x(mCYAa%o50b#H\u0026A=k%#w]}Q2yYFJ\u003cxkRc]0a{d\u0026yxeA$wnb]YB98CAz!%j\u0026B98CzAbCU(z!0i(BzkP6uVDc/BAhFwyxd%Tz!n#WB-o8oB-8niBy/uk0crl)z/{d4xjVg7vrlF\u0026B.$MdyxeD\u003czdNu%0chT/z*2W(vrlydx(n380cAKdwPN]\u003cAcbJex8(NQBz(buuU\u003cT#x8(H/wN/[50crm5zEW9@wN/N@0a{B}x()[^uUj1\u0026x-J0=BzkP60cq%/wPdSRuU\u003cB=v{:q0vrcD%zddc@0cR%[A+PAkw=M\u003c.vqC", "n": [ { "c": 3, "d": "Set file creation mask (umask)", "i": "micro-behaviors/fs/chmod/modify::umask", "o": 17188, "z": 5, "cf": 0.4000000059604645 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::remove", "o": 17201, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 17242, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 17180, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 17230, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 17261, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 17164, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 17102, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 17159, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 17109, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 17136, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Delays execution (sleep/nanosleep)", "i": "objectives/anti-analysis/timing/evasion::delay-capability", "o": 17281, "z": 5, "cf": 0.5 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 17084, "z": 4, "cf": 0.8500000238418579 } ], "ln": 17068 }, { "b": "e]$}-humMcvQ?3cB-RvJCSmP*hz^4cz.r:AoI4MIk#QJkuOC?y07P^:r7{j$gHA7Fgxm", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 17367, "z": 6, "cf": 0.30000001192092896 } ], "ln": 17351 }, { "b": "AckSax\u003e5o3wQbzgA=k!qv}xX5x\u003ez6?vru5/0a*g\u003ez/N(Yv{%m)z/^akCYmOwBrCKBvR/:*azUJ", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 106683, "z": 11, "cf": 0.5 } ], "ln": 106667 }, { "b": "qCniSvriMgA=lbnwmYo]w]zYjBzbxfaA8jgA::67z/dSVBzbkdvrM6[y**^?wGV6", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 107145, "z": 3, "cf": 0.800000011920929 } ], "ln": 107129 }, { "b": "BrCKBvR/:*azULlazCZoBzbkdBz\u003e@azz0K]aolp$By^GQvrlHjze0)2at2fYz!A+", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 107834, "z": 3, "cf": 0.800000011920929 } ], "ln": 107818 }, { "b": "B0bvsBrCTzwN/B^x\u003ep/$vqYP#x(\u003eFmvr\u0026#8wGV28ADL#owN(]}z/M$xxLzJgz/xm", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 107927, "z": 3, "cf": 0.800000011920929 } ], "ln": 107911 }, { "b": "BzkVhe^.P5vrcm1zF80Mra]?=z^)D)v@%8taz+E}wO-GkvriMez/^ayAaJJ[w[+/", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 107980, "z": 3, "cf": 0.800000011920929 } ], "ln": 107964 }, { "b": "z^^fdAckS9wQbzpAV=}=B7F\u003c4wPPItwQbzuzY\u0026\u003emvpQH5xK@q#x(4u6Bz\u0026phwGUG3Aa@(]3ig", "n": [ { "c": 1, "d": "Secret marker string (key/token/api)", "i": "objectives/exfiltration/http/upload::secret-key", "o": 108455, "z": 10, "cf": 0.6000000238418579 } ], "ln": 108439 }, { "b": "BrByKpic:xq!p5)x(mMavpTj?zyoGFp!szme?NFhm]05-oJbp[mor?{pHu{\u0026p5[j7Bn", "n": [ { "c": 2, "d": "admin keyword", "i": "objectives/discovery/account/keywords::admin-keyword", "o": 109129, "z": 5, "cf": 0.20000000298023224 } ], "ln": 109113 }, { "b": "asFKLwgO\u0026Hy?a%{azt%0az2C2A^qRC03C/-v@=\u003clBo0B]x\u003eI0#Bo0C8x\u003eIr\u003cA+e:0C4CW", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 109332, "z": 7, "cf": 0.5 } ], "ln": 109316 }, { "b": "p^EFHlRycXm[3fwqB%k.q:\u003c5Kmo0R!moJ$/mnr?Iohe+XpFKnyr7fLFr7gdXk#QiVk#6*Pogn", "n": [ { "c": 1, "d": "Secret marker string (key/token/api)", "i": "objectives/exfiltration/http/upload::secret-key", "o": 113322, "z": 10, "cf": 0.6000000238418579 } ], "ln": 113306 }, { "b": "0aP}+B95KEzGxJ8zE)u3v}Yp\u003eash8kt{8oq0aPXJASvzbiSGHffdF8+wN/T}zdNP}wN({0wD", "n": [ { "c": 3, "d": "C array declaration format string", "i": "micro-behaviors/data/encode/payload::c-array-format", "o": 118863, "z": 9, "cf": 0.6000000238418579 } ], "ln": 118847 }, { "b": "f/g*vv@L@UB-7#jz*c7wv}/)}wPw[tA%.[kB8#Fvx(mMaeIg{Sv@\u003cQLx(+zfx)a69j0j", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 121539, "z": 6, "cf": 0.4000000059604645 } ], "ln": 121523 }, { "b": "y?XifzF78cwQcrVc36y[mSiq\u0026l}wCtvrb^[wPRH7azkn6wPzj3x(v(ivivuYeN\u0026#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 121886, "z": 3, "cf": 0.800000011920929 } ], "ln": 121870 }, { "b": "h8d8\u003ewN]s)ve%\u003eHg=de(CRRclf/YkUg=de(wN/m(ve%}UB968\u003c0b3j\u003eBtkK5gbQ@\u0026xkW", "n": [ { "c": 3, "d": "X25519 key exchange marker", "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "o": 122236, "z": 6, "cf": 0.8799999952316284 } ], "ln": 122220 }, { "b": "z/Pziw]zYjwnbW\u003cByw#dB7]o8vruTjwPGEh0cq*Zf-VodvkoX#0cq*ZgbpV^B7!#ri5yRRxKH", "n": [ { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 122444, "z": 10, "cf": 1.0 } ], "ln": 122428 }, { "b": "dO8#]qDb$Kk#Yr-08vCPxK$Q)ByF/\u0026BrCpnaARphB0bKnB8#5lzvcw.x(mMAash7o04/r\u0026wO2)8wnbM%zu", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 123018, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 123005, "z": 9, "cf": 1.0 } ], "ln": 122989 }, { "b": "aAImywJy}Wwftt}BAm=?lUQHMwPw]mB.L@eB0b7kAV=VH3ij1IzGGriaz2Olz/M$eBuf", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 123568, "z": 6, "cf": 0.4000000059604645 } ], "ln": 123552 }, { "b": "iV].\u00263jfA)lPMtoA%-lOlUgpWx\u003ez6?vru66BA}?pB2\u003eAzlSvh+mj/*b07pKlwPI%miV[z}wQbx", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 123829, "z": 11, "cf": 0.5 } ], "ln": 123813 }, { "b": "w[C:!wPv=[B7Gv(dK([\u003cra]#!azC)tBzbkdw[=c\u003ey-)?uC{3Ncw]zZ3az+$ayIvW0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 124071, "z": 4, "cf": 0.800000011920929 } ], "ln": 124055 }, { "b": "c37Bv090(LwO@Rrc37BRCwhejaxqrkaswERcM\u0026zfwPq\u003cbA+fqmc37h9nLPP)mq^iU", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 124252, "z": 4, "cf": 0.800000011920929 } ], "ln": 124236 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 125284, "z": 10, "cf": 0.949999988079071 } ], "ln": 125268 }, { "b": "xkRBfvpB4:az#ssvR6MWA4%7?z/oCmeG^M3BYq4kaw+Y#qY)qtf^7NRz!]+XB75Y)iV]L:f!)=*z!{L2at2Y/y**%uax{%KvqFbkaBCp-eJ^]VzdL[nDP=:0ElqWYy^8bEt}N-Zax@#ey*vwPph+2YiTMi3rbVL-zGv\u0026C3lQDlarR^HeIg^MB960Qz!\u0026{4B08OFarR^HarR!2x(!wsvqG:5vrM6[", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 125610, "z": 128, "cf": 0.9399999976158142 } ], "ln": 125594 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 131020, "z": 9, "cf": 0.9399999976158142 } ], "ln": 131004 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 131082, "z": 3, "cf": 0.699999988079071 } ], "ln": 131066 }, { "b": "e]tJqB.\u003eRiw[=6)azCZofj/lnfk$YpB1]y5zeS%cy?mVgCwhejaARpday/tcBy/uiA@", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 131594, "z": 5, "cf": 0.6600000262260437 } ], "ln": 131578 }, { "b": "w[+[2A::67z/cXfx(4u6fj/lnfk2fBBzM1KAbe%8f!\u003ep\u003cz/fefxKL%8Bz\u0026pkCXIkvao", "n": [ { "c": 2, "d": "Reference to /etc configuration files", "i": "micro-behaviors/fs/path/config/system::config-etc", "o": 131699, "z": 5, "cf": 0.6600000262260437 } ], "ln": 131683 }, { "b": "0b%UEBz(8latUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 132381, "z": 9, "cf": 0.6000000238418579 } ], "ln": 132365 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 132572, "z": 9, "cf": 0.699999988079071 } ], "ln": 132556 }, { "b": "B0bKnA+O@#az#ssvR6MWg+HHnga\u003erZra]?=v}xX5x\u003ez6?vru66Cwg(faz2!px(W=cx(k3", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 137132, "z": 7, "cf": 0.9399999976158142 } ], "ln": 137116 }, { "b": "000000000000000000000fvlZ00000000000000000000000000000000000)5Hc!000002cm?9000006rzim", "n": [ { "c": 2, "d": "Large .data section (64KB+)", "i": "metadata/binary/section/metrics::large-data-absolute-elf", "o": 167936, "z": 20, "cf": 0.699999988079071 } ], "ln": 167920 }, { "b": "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000", "n": [ { "c": 2, "d": "python code embedded in string", "i": "metadata/lang/embedded::python", "o": 213292, "z": 48, "cf": 1.0 } ], "ln": 213276 }, { "b": "zw00J000000@@r300000A4%7?z/oCAwmYj)x8?]i7Y86(04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026Hz#", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 300640, "z": 13, "cf": 1.0 } ], "ln": 300624 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 300735, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 300727, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 300709, "z": 7, "cf": 0.8999999761581421 } ], "ln": 300693 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 300888, "z": 8, "cf": 0.8999999761581421 } ], "ln": 300872 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "gnutls_ffdhe_4096_group_prime" ], [ "gnutls_ffdhe_3072_group_generator" ], [ "gnutls_ffdhe_3072_group_prime" ], [ "fini" ], [ "gnutls_ffdhe_4096_group_generator" ], [ "gnutls_ffdhe_2048_group_prime" ], [ "gnutls_ffdhe_6144_key_bits" ], [ "gnutls_ffdhe_6144_group_prime" ], [ "gnutls_ffdhe_2048_group_generator" ], [ "gnutls_ffdhe_8192_key_bits" ], [ "gnutls_free" ], [ "gnutls_strdup" ], [ "gnutls_ffdhe_8192_group_generator" ], [ "init" ], [ "stdin" ], [ "gnutls_ffdhe_3072_key_bits" ], [ "gnutls_ffdhe_6144_group_generator" ], [ "stderr" ], [ "gnutls_malloc" ], [ "gnutls_ffdhe_2048_key_bits" ], [ "gnutls_ffdhe_4096_key_bits" ], [ "gnutls_ffdhe_8192_group_prime" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "gnutls_hex_decode" ], [ "", "gnutls_pk_to_sign" ], [ "", "gnutls_x509_crq_set_dn" ], [ "", "gnutls_pkcs11_obj_get_type" ], [ "", "gnutls_pubkey_import_pkcs11" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "gnutls_dh_params_generate2" ], [ "", "gnutls_x509_privkey_export_rsa_raw2" ], [ "", "gnutls_x509_crt_set_issuer_unique_id" ], [ "", "cxa_finalize" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_x509_privkey_deinit" ], [ "", "gnutls_session_get_desc" ], [ "", "gnutls_pk_get_name" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gnutls_dh_params_export_raw" ], [ "", "gnutls_digest_get_id" ], [ "", "gnutls_x509_tlsfeatures_add" ], [ "", "gnutls_certificate_type_get" ], [ "", "fgets" ], [ "", "close" ], [ "", "feof" ], [ "", "gnutls_pkcs11_obj_import_url" ], [ "", "strchr" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_x509_name_constraints_deinit" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_hex2bin" ], [ "", "umask" ], [ "", "calloc" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_x509_privkey_import_pkcs8" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "gnutls_x509_privkey_get_pk_algorithm" ], [ "", "strncmp" ], [ "", "gnutls_pkcs11_obj_export_url" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "fputc" ], [ "", "strrchr" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_x509_crt_set_crq_extension_by_oid" ], [ "", "gnutls_pkcs11_privkey_generate3" ], [ "", "gnutls_x509_privkey_get_pk_algorithm2" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_pkcs11_obj_deinit" ], [ "", "gnutls_x509_crq_init" ], [ "", "gnutls_pkcs11_type_get_name" ], [ "", "gnutls_pubkey_import_x509_raw" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "gnutls_x509_crt_list_import2" ], [ "", "abort" ], [ "", "gnutls_x509_privkey_import" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_x509_crt_set_dn" ], [ "", "gnutls_digest_get_name" ], [ "", "strtoll" ], [ "", "gnutls_x509_crq_set_tlsfeatures" ], [ "", "gnutls_pubkey_import_privkey" ], [ "", "fflush" ], [ "", "dup2" ], [ "", "gnutls_x509_crt_set_subject_alt_othername" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_hex_encode2" ], [ "", "gnutls_pkcs11_token_init" ], [ "", "fprintf" ], [ "", "gnutls_x509_name_constraints_add_permitted" ], [ "", "gnutls_group_get_name" ], [ "", "gnutls_pkcs11_deinit" ], [ "", "gnutls_pkcs11_privkey_import_url" ], [ "", "gnutls_pk_bits_to_sec_param" ], [ "", "gnutls_pkcs11_delete_url" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_pkcs11_token_get_info" ], [ "", "gnutls_x509_crt_set_crl_dist_points" ], [ "", "gnutls_cipher_get_name" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "gnutls_x509_privkey_export_dsa_raw" ], [ "", "asn1_strerror" ], [ "", "gnutls_x509_privkey_init" ], [ "", "gnutls_pubkey_export" ], [ "", "gnutls_x509_crq_import" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "gnutls_pkcs11_obj_get_exts" ], [ "", "gnutls_pubkey_export_ecc_raw" ], [ "", "gnutls_ecc_curve_list" ], [ "", "mktime" ], [ "", "gnutls_pubkey_import_x509" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_x509_crq_set_extension_by_oid" ], [ "", "gnutls_x509_crt_get_pk_algorithm" ], [ "", "fstat" ], [ "", "gnutls_pubkey_import" ], [ "", "gnutls_privkey_sign_data2" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_dh_params_import_pkcs3" ], [ "", "gnutls_x509_crt_set_authority_info_access" ], [ "", "strtok" ], [ "", "fileno" ], [ "", "gnutls_sign_get_name" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_cipher_list" ], [ "", "gnutls_x509_tlsfeatures_init" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_x509_privkey_generate" ], [ "", "gnutls_group_list" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "gnutls_x509_privkey_get_key_id" ], [ "", "gnutls_pkcs11_token_get_flags" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "gnutls_pubkey_init" ], [ "", "setvbuf" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_url_is_supported" ], [ "", "gnutls_pk_list" ], [ "", "gnutls_pkcs11_obj_get_pk_algorithm" ], [ "", "asprintf" ], [ "", "gnutls_x509_crt_set_subject_unique_id" ], [ "", "gnutls_pkcs11_privkey_deinit" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_pkcs11_obj_init" ], [ "", "gnutls_x509_crt_import_pkcs11" ], [ "", "gnutls_x509_privkey_generate2" ], [ "", "gnutls_priority_cipher_list" ], [ "", "gnutls_pubkey_verify_data2" ], [ "", "setenv" ], [ "", "gnutls_x509_privkey_export" ], [ "", "gnutls_pkcs11_token_get_random" ], [ "", "gnutls_pkcs11_init" ], [ "", "gnutls_x509_privkey_import2" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_global_deinit" ], [ "", "perror" ], [ "", "gnutls_x509_name_constraints_add_excluded" ], [ "", "gnutls_pkcs11_copy_secret_key" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_x509_privkey_get_spki" ], [ "", "gnutls_kx_list" ], [ "", "gnutls_x509_privkey_get_seed" ], [ "", "strncasecmp" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_pkcs11_obj_flags_get_str" ], [ "", "gnutls_cipher_suite_info" ], [ "", "gnutls_pkcs11_token_check_mechanism" ], [ "", "strcat" ], [ "", "gnutls_x509_spki_init" ], [ "", "gnutls_x509_crt_set_inhibit_anypolicy" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "reallocarray" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "gnutls_x509_crl_list_import2" ], [ "", "gnutls_x509_tlsfeatures_deinit" ], [ "", "optind" ], [ "", "gnutls_x509_crt_set_subject_alt_name" ], [ "", "gnutls_pkcs11_get_raw_issuer" ], [ "", "gnutls_pkcs11_privkey_init" ], [ "", "gnutls_x509_crt_set_name_constraints" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_x509_crt_get_pk_ecc_raw" ], [ "", "gnutls_session_channel_binding" ], [ "", "gnutls_pkcs11_obj_export2" ], [ "", "secure_getenv" ], [ "", "gnutls_rnd" ], [ "", "gnutls_x509_cidr_to_rfc5280" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "gnutls_x509_privkey_export_gost_raw" ], [ "", "fwrite" ], [ "", "strspn" ], [ "", "gnutls_x509_crt_set_policy" ], [ "", "gnutls_x509_spki_get_rsa_pss_params" ], [ "", "puts" ], [ "", "gnutls_x509_ext_print" ], [ "", "gnutls_privkey_get_pk_algorithm" ], [ "", "gnutls_x509_name_constraints_init" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "gnutls_x509_crt_get_expiration_time" ], [ "", "gnutls_x509_crt_set_extension_by_oid" ], [ "", "getc" ], [ "", "deregister_frame_info" ], [ "", "gnutls_x509_crt_check_issuer" ], [ "", "gnutls_pkcs11_copy_x509_crt2" ], [ "", "ferror" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_x509_crt_print" ], [ "", "gnutls_x509_crq_set_subject_alt_name" ], [ "", "timegm" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_sec_param_get_name" ], [ "", "gnutls_hex_decode2" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_sec_param_to_pk_bits" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_pubkey_import_url" ], [ "", "gnutls_pkcs11_obj_get_info" ], [ "", "strcasecmp" ], [ "", "gnutls_pkcs11_obj_set_info" ], [ "", "vfprintf" ], [ "", "gnutls_dh_params_import_raw2" ], [ "", "libc_start_main" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "pipe" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_pkcs11_copy_pubkey" ], [ "", "gnutls_x509_privkey_export_ecc_raw" ], [ "", "gnutls_dh_get_group" ], [ "", "fseek" ], [ "", "gnutls_certificate_type_get2" ], [ "", "remove" ], [ "", "memcmp" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "gnutls_x509_privkey_export_pkcs8" ], [ "", "gnutls_privkey_import_url" ], [ "", "strdup" ], [ "", "gnutls_x509_spki_deinit" ], [ "", "gnutls_strerror" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_privkey_init" ], [ "", "gnutls_pkcs11_obj_export3" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "gnutls_load_file" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_x509_crt_set_dn_by_oid" ], [ "", "gnutls_compression_list" ], [ "", "strtoul" ], [ "", "gnutls_gost_paramset_get_name" ], [ "", "gnutls_x509_crq_set_key_purpose_oid" ], [ "", "gnutls_pkcs11_token_get_mechanism" ], [ "", "sprintf" ], [ "", "gnutls_x509_crq_set_dn_by_oid" ], [ "", "gnutls_x509_crt_get_key_usage" ], [ "", "gnutls_x509_crt_import_url" ], [ "", "gnutls_pkcs11_add_provider" ], [ "", "sleep" ], [ "", "gnutls_pkcs11_obj_list_import_url4" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_x509_crq_set_subject_alt_othername" ], [ "", "gnutls_pkcs11_copy_x509_privkey2" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "gnutls_pkcs11_obj_get_flags" ], [ "", "gnutls_x509_privkey_sec_param" ], [ "", "strlen" ], [ "", "asn1_encode_simple_der" ], [ "", "ITM_registerTMCloneTable" ], [ "", "gnutls_x509_spki_get_rsa_oaep_params" ], [ "", "strtol" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_pkcs11_privkey_export_pubkey" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_x509_crt_set_key_purpose_oid" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_pkcs11_token_get_url" ], [ "", "gnutls_x509_crt_set_tlsfeatures" ], [ "", "gnutls_session_get_id" ], [ "", "inet_pton" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_pubkey_deinit" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "ftello" ], [ "", "gnutls_pubkey_print" ], [ "", "gmtime_r" ], [ "", "gnutls_pkcs11_token_set_pin" ], [ "", "assert_fail" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "gnutls_privkey_import_x509_raw" ], [ "", "optarg" ], [ "", "malloc" ], [ "", "gnutls_privkey_deinit" ], [ "", "strcmp" ], [ "", "gnutls_dh_params_import_dsa" ], [ "", "ftell" ], [ "", "gnutls_x509_ext_deinit" ], [ "", "getline" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 276, 4.39, "alloc" ], [ ".dynsym", 1184, 8352, 1.33, "alloc" ], [ ".dynstr", 9536, 7986, 4.57, "alloc" ], [ ".gnu.version", 17522, 696, 1.69, "alloc" ], [ ".gnu.version_r", 18224, 208, 3.3, "alloc" ], [ ".rela.dyn", 18432, 8376, 1.95, "alloc" ], [ ".rela.plt", 26808, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 26832, 408, 3.95, "alloc" ], [ ".init", 28672, 3, 1.58, "alloc,executable" ], [ ".plt", 28688, 32, 3.34, "alloc,executable" ], [ ".text", 28720, 74874, 6.2, "alloc,executable" ], [ ".fini", 103594, 3, 1.58, "alloc,executable" ], [ ".rodata", 106496, 36599, 5.71, "alloc" ], [ ".eh_frame_hdr", 143096, 1772, 5.34, "alloc" ], [ ".eh_frame", 144872, 10320, 5.03, "alloc" ], [ ".init_array", 159184, 8, 1.06, "write,alloc" ], [ ".fini_array", 159192, 8, 0.54, "write,alloc" ], [ ".data.rel.ro", 159200, 5476, 2.12, "write,alloc" ], [ ".dynamic", 164680, 576, 1.54, "write,alloc" ], [ ".got", 165256, 2656, 0.02, "write,alloc" ], [ ".data", 167936, 132704, 0.17, "write,alloc" ], [ ".gnu_debuglink", 300640, 20, 3.78, "" ], [ ".shstrtab", 300660, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 30799.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 348.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 349.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 348.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 141456.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 150064.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 302720.0, "entropy": 3.8, "size_bytes": 302720.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.2, "data_entropy": 0.25, "overlay_size": 1792.0, "string_count": 1790.0, "overlay_ratio": 0.01, "overall_entropy": 3.8, "overlay_entropy": 1.58, "entropy_variance": 3.1, "avg_string_length": 26.42, "max_string_length": 6375.0, "peak_region_bytes": 44032.0, "code_to_data_ratio": 0.35, "peak_region_entropy": 6.24, "string_length_stddev": 152.55, "largest_section_ratio": 0.44, "sentence_string_count": 383.0, "sentence_string_ratio": 0.21, "high_entropy_string_count": 1.0 }, "exports": { "count": 23.0 }, "imports": { "count": 324.0 }, "sections": { "count": 28.0, "code_size": 74912.0, "entropy_max": 6.2, "entropy_mean": 2.88, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 2, "mol": "O₂(AlC)H₅(CmCrF₃PoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/p11tool", "risk": 9, "sha": "3a83ca92fd77e9ce9c89f4dd52fd1db91723645dd01cb1240e6815ccfac7d48b", "size": 302720, "traits": [ { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 17188, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 125610, 128 ], [ 125641, 67 ] ] }, { "id": "micro-behaviors/data/encode/payload::c-array-format", "conf": 0.6000000238418579, "crit": 3, "desc": "C array declaration format string", "spans": [ [ 118863, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 9552, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 9696, 5 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 17180, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 125610, 128 ], [ 125641, 67 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 15877, 9 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 17261, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 9768, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 9572, 5 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 9572, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 125284, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 106683, 11 ], [ 123829, 11 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "spans": [ [ 122236, 6 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 125284, 10 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 9768, 5 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 109332, 7 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 17242, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 122444, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 17230, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 17242, 6 ] ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 17201, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 16993, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 9572, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 125284, 10 ], [ 125610, 128 ], [ 125641, 67 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 9768, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 17261, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 9552, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 125284, 10 ], [ 125610, 128 ], [ 125641, 67 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 9552, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91I^#!/00000kMy=:00000d4{Uw0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "R8)/[y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000C0000s0rr93000070000401{Xt0F7", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "QYyC}0000g0000000000wQ4{h0chTVy\u00261310af8yCWT@\u003ex(mu}x)Ks\u003cB98CzBAdv[A+eV\u00260aeq%o\u003c.BxA+e($B97#lr82.@z/fb=vpB4:0a]\u003ePBAmC6BAg(8ASyf5A=bx7z#:%3A=bY8zua9Oz/P}1w[C\u003e4B7+LXuVQr$v@2BYxLQ%!vqfJTB97@7A=Ie3BAg(gC(R[%BAqwgyJ1fl0ax$/x-Ji@A+oAczdJYVz/xo90af8zwPzu{x(!xcA:JB0vqPN.x(mK30cr3%A+PAk", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 8688, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 8634, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 8663, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 8536, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 8556, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 8619, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 8590, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 8521, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 8679, "z": 8, "cf": 0.20000000298023224 } ], "ln": 8505 }, { "b": "x(mK30crm5v{%B\u0026v@le+w]?J{yxei.zdvB40a].Sz/YE\u0026B98CkB-ms\u003cz/fD7v@}Y(BAhhezua3nr83.uwOkZ#By/F(o*--nzE(^QvR/PQx(mH7uVpa9zuaJ+zeA\u003c30af8AA=M5ouU\u003cT\u003cvruj4zua:1A:@%900", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 8828, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 8787, "z": 7, "cf": 0.75 }, { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 8760, "z": 5, "cf": 0.699999988079071 } ], "ln": 8744 }, { "b": "xl4{kA9)l?zE)\u0026%Bz(g1xkR\u003cly\u0026-%7wN/U0wm6y?zE--WzGQ5qB6\u0026J\u003ewn2KYgb7KAuUsy$B-pYbA+Px40a#", "n": [ { "c": 3, "d": "SSL/TLS library hook target", "i": "objectives/collection/network/ssl-intercept::ssl-tls-marker", "o": 9328, "z": 18, "cf": 0.800000011920929 } ], "ln": 9312 }, { "b": "uT^.\u003eA@Y\u0026\u003cB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuVZr%zGx=nA=+VfwD", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 10448, "z": 9, "cf": 1.0 } ], "ln": 10432 }, { "b": "BzM29xK#A}wO#0@wmWH@xkR\u003cly\u0026-%7wN/U0wm6v*v%d\u0026+zGQ5qB6\u0026A*A==2cx\u003e7N[wNxQ(A+Pc1v{%E[z/b", "n": [ { "c": 3, "d": "GnuTLS function names", "i": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "o": 12120, "z": 18, "cf": 0.699999988079071 } ], "ln": 12104 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuVP!1B7]MguVP!2uU0O!ve%}TB-.CvuJ", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 12599, "z": 9, "cf": 1.0 } ], "ln": 12583 }, { "b": "C(R]cA==ko0cqZYB-I52xjVf@zGV1(x(4u#zVBx\u003cByxm\u003ew]}Q2y\u0026oq=wPz*fASye(BARbow=MsSz!0M\u0026xjVgbx(dzYxkI:8zdN6{0cr6*yH}O/xMOfgA@Y\u0026Yx\u003cU}6A+foiz/L?@Acb/iwb{N.AaG2*wPz*fASxY[wO=e.B7]o8vqC{Qz/PQ[AclnjxKL]YB7Gf0v@}Y(ByY960crm5B8V0%y\u0026r/(y\u0026\u003cxdwNxDTB98CAz!/t=wPRu\u003ewo8y4w]vVZwPR/#zdNB0w]vVWB-o8oB-8niBy/uk0cq*@ByYrlzua:1wn=Qj0a{g)ByLq.Aclnz0b2\u003e+Aa9*e0cJc!B87+$x(dA]z2!P/zeTPe0ax}/A+PAkw=M}0B7GB[z/x/bA+tw+wPS08A=$]qzEEx[0b2\u003e+z/x/9y\u0026si70a*y^v%h!\u003ew{nofBy+CVw[=c%0bVH[x(dzYw].D]vpS[?x(mK30a*4UB7C", "n": [ { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 14358, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getaddrinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "o": 14461, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getnameinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "o": 14473, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 14422, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 14351, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Set file creation mask (umask)", "i": "micro-behaviors/fs/chmod/modify::umask", "o": 14535, "z": 5, "cf": 0.4000000059604645 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::remove", "o": 14548, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 14300, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 14603, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 14527, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 14591, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 14515, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 14610, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 14286, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 14490, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 14402, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 14485, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 14409, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 14342, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 14443, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 14328, "z": 13, "cf": 0.4000000059604645 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 14384, "z": 4, "cf": 0.8500000238418579 } ], "ln": 14270 }, { "b": "vTh{hA=.q8w]I^8zGGE\u003czGG/gA@Zk(vqG:#v{%y#vr?\u0026?x\u003c$Z)B-.Cve]$}-gCw/Bx\u003c$N8zfo]oeQflkuP6.[B8JV=07P^:r7{j$gHA7Fgxo{urA8T\u003cuO=4EuOKt", "n": [ { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 14695, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 14740, "z": 6, "cf": 0.30000001192092896 } ], "ln": 14679 }, { "b": "wJy}WA%.[+z/f5@azCZoBzbkdA+frhz/fScay]z4B8AvEaz\u003eLev}VhHwPz*fAV/x", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 74017, "z": 3, "cf": 0.800000011920929 } ], "ln": 74001 }, { "b": "aw+H3azbLjz3*m?e?g]xra]#!aA8jvx(v(iA+flkx(W=}at2fYz^^fdv}Yp+zxJ\u003er", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 74949, "z": 4, "cf": 0.800000011920929 } ], "ln": 74933 }, { "b": "p-%*\u003cA=#2maxqrhazCZov}xX5x\u003ez6?vru6wash7o0bcE@A5]T903#:/i4$t1z/fD7v@#B5xcqo", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 75117, "z": 11, "cf": 0.5 } ], "ln": 75101 }, { "b": "aAIamC4CXPash7Ye?NFhp!$1?atk3Zav]Ehp+KKQfBXvWz/Z1Yash7r3pefiwPh-LasY2]4gkEvzGGDcBs*EqAaI6Mvq{g4x\u003e7N[x(v(xz!0\u003ccePLAxB.bSo4gkEvzGGB", "n": [ { "c": 3, "d": "Native HTTP POST request line", "i": "micro-behaviors/communications/http/post::native-post-request-line", "o": 75182, "z": 17, "cf": 0.8199999928474426 }, { "c": 1, "d": "Content-Type header string", "i": "micro-behaviors/communications/http/request/client::content-type-header", "o": 75224, "z": 13, "cf": 0.5 } ], "ln": 75166 }, { "b": "BrCdjz/]Yaaz\u003eXbz/QaCw]zYjBzbkdA+flkwPI@207ggjzF%Rtx(n37A=u5gBrB9", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 75338, "z": 3, "cf": 0.800000011920929 } ], "ln": 75322 }, { "b": "BrBvDq=1PSwPI*ezGxwiCwhejaz#9uwmoN*asH@pzF%MfzF7x#pEw5SaA?spx\u003ez6?", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 75633, "z": 4, "cf": 0.800000011920929 } ], "ln": 75617 }, { "b": "B8V5nB7ExPc36y[dK([\u003clUgpWx\u003ez6?vru66CvtLnA+fAjyH}30vrrRrA%.)%dK(MuxK@qZlSl/7A+frhz/fScazC)tz!@@bd0G9vazC[rB.7", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 75771, "z": 3, "cf": 0.800000011920929 }, { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 75736, "z": 11, "cf": 0.5 } ], "ln": 75720 }, { "b": "0aP}+B95KEzGxJ8zE)u3v}Yp\u003eash8kt{8oq0bVp:z/QaCwPz*fATz!RxKL]Yc389E3lQ#Kao", "n": [ { "c": 3, "d": "C array declaration format string", "i": "micro-behaviors/data/encode/payload::c-array-format", "o": 76155, "z": 9, "cf": 0.6000000238418579 } ], "ln": 76139 }, { "b": "C}HZ43ij{SB8#5kxcn=TB7F\u003c4wPPItwQaQ.xK#A}wmYm?wmW!Ac36y[x(d*cA=-BnA=M8siV[", "n": [ { "c": 1, "d": "Secret marker string (key/token/api)", "i": "objectives/exfiltration/http/upload::secret-key", "o": 76331, "z": 10, "cf": 0.6000000238418579 } ], "ln": 76315 }, { "b": "f/g*vv@L@UB-7#jz*c7wv}/)}wPw[tA%.[kB8#Fvx(mMaeIg{Sv@\u003cQLx(+zfx)a69j0j", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 78862, "z": 6, "cf": 0.5 } ], "ln": 78846 }, { "b": "y?XifzF78cwQcrVc36y[mSiq\u0026l}wCtvrb^[wPRH7azkn6wPzj3x(v(ivivuYeN\u0026#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 79209, "z": 3, "cf": 0.800000011920929 } ], "ln": 79193 }, { "b": "h8d8\u003ewN]s)ve%\u003eHg=de(CRRclf/YkUg=de(wN/m(ve%\u003eGv/QdWB968\u003c0b3j\u003eBtkK5gbP", "n": [ { "c": 3, "d": "X25519 key exchange marker", "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "o": 79563, "z": 6, "cf": 0.8799999952316284 } ], "ln": 79547 }, { "b": "awClYazC)tvSDy5wO%4wvqYP#B7/Gmy?aVaz/^ahwGVbpwN(](zH0vwz/Pziw]zYjwnbW\u003cByw#dB7]o8vruTjwPGEh0cq*Zf-VodvkoX#0cq*ZgbpV^B7!#ri5yRRxKH", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 79731, "z": 3, "cf": 0.800000011920929 }, { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 79775, "z": 10, "cf": 1.0 } ], "ln": 79715 }, { "b": "dO8#]qDb$Kk#Yr-08vCPxK$Q)ByF/\u0026BrCpnaARphB0bKnB8#5lzvcw.x(mMAash7o04/r\u0026wO2)8wnbM%zu", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 81601, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 81588, "z": 9, "cf": 1.0 } ], "ln": 81572 }, { "b": "aAImywJy}Wwftt}BAm=?lUQHMwPw]mB.L@eB0b7kAV=VH3ij1IzGGriaz2Olz/M$eBuf", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 82151, "z": 6, "cf": 0.4000000059604645 } ], "ln": 82135 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 83889, "z": 10, "cf": 0.949999988079071 } ], "ln": 83873 }, { "b": "zGC(2y\u0026.gtCYmOwBy/E)z!0\u003ccBz(8lat1ZazGO]LqY[\u003e6q=1PUz/oC0rDzOYwJy}Rz!0\u003ccBz(8lax]%ujz5zrxfECxjA+dHk3YpUat2fczEEx[k3Jv%D)0\u00261C42hJt{9A9e?OmN3qLISwJye9arR^UwgO\u0026PeO5B4B.r\u003cPB.@lzarR^HarR^HarT9\u003cvpB4:ay]4)B.tu3zF6p.2)*[\u0026azC{uzfo]w", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 84168, "z": 128, "cf": 0.9399999976158142 } ], "ln": 84152 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 86208, "z": 9, "cf": 0.9399999976158142 } ], "ln": 86192 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 86270, "z": 3, "cf": 0.699999988079071 } ], "ln": 86254 }, { "b": "z!0\u003ccBz(8latUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 87196, "z": 9, "cf": 0.6000000238418579 } ], "ln": 87180 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 87387, "z": 9, "cf": 0.699999988079071 } ], "ln": 87371 }, { "b": "00000000000i=F700000z!0\u003ccBz(8le[wK5B.pWO!z:uR04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaG", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 106504, "z": 14, "cf": 1.0 } ], "ln": 106488 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 106599, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 106591, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 106573, "z": 7, "cf": 0.8999999761581421 } ], "ln": 106557 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 106752, "z": 8, "cf": 0.8999999761581421 } ], "ln": 106736 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "gnutls_ffdhe_4096_group_prime" ], [ "gnutls_ffdhe_3072_group_generator" ], [ "gnutls_ffdhe_3072_group_prime" ], [ "fini" ], [ "gnutls_ffdhe_4096_group_generator" ], [ "gnutls_ffdhe_2048_group_prime" ], [ "gnutls_ffdhe_6144_key_bits" ], [ "gnutls_ffdhe_6144_group_prime" ], [ "gnutls_ffdhe_2048_group_generator" ], [ "gnutls_ffdhe_8192_key_bits" ], [ "gnutls_free" ], [ "gnutls_ffdhe_8192_group_generator" ], [ "init" ], [ "stdin" ], [ "gnutls_ffdhe_3072_key_bits" ], [ "gnutls_ffdhe_6144_group_generator" ], [ "stderr" ], [ "gnutls_malloc" ], [ "gnutls_ffdhe_2048_key_bits" ], [ "gnutls_ffdhe_4096_key_bits" ], [ "gnutls_ffdhe_8192_group_prime" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "gnutls_deinit" ], [ "", "gnutls_ocsp_resp_init" ], [ "", "gnutls_hex_decode" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "gnutls_dh_params_generate2" ], [ "", "gnutls_x509_privkey_export_rsa_raw2" ], [ "", "gnutls_ocsp_resp_check_crt" ], [ "", "cxa_finalize" ], [ "", "endservent" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_x509_privkey_deinit" ], [ "", "gnutls_session_get_desc" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gnutls_dh_params_export_raw" ], [ "", "gnutls_digest_get_id" ], [ "", "gnutls_certificate_type_get" ], [ "", "fgets" ], [ "", "close" ], [ "", "strchr" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_ocsp_resp_verify" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_session_set_data" ], [ "", "gnutls_hex2bin" ], [ "", "umask" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_ocsp_req_import" ], [ "", "gnutls_x509_privkey_import_pkcs8" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "gnutls_x509_privkey_get_pk_algorithm" ], [ "", "strncmp" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "htons" ], [ "", "freeaddrinfo" ], [ "", "fputc" ], [ "", "ntohs" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "strerror" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_record_set_timeout" ], [ "", "gnutls_x509_privkey_get_pk_algorithm2" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_x509_crq_init" ], [ "", "gnutls_ocsp_resp_import" ], [ "", "gnutls_ocsp_resp_get_single" ], [ "", "gnutls_record_recv" ], [ "", "gnutls_pubkey_import_x509_raw" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "gnutls_x509_crt_list_import2" ], [ "", "abort" ], [ "", "gnutls_x509_privkey_import" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_digest_get_name" ], [ "", "gnutls_pubkey_import_privkey" ], [ "", "fflush" ], [ "", "gnutls_ocsp_req_export" ], [ "", "dup2" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_hex_encode2" ], [ "", "fprintf" ], [ "", "gnutls_group_get_name" ], [ "", "gnutls_pk_bits_to_sec_param" ], [ "", "getnameinfo" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_cipher_get_name" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "gnutls_x509_privkey_export_dsa_raw" ], [ "", "gnutls_ocsp_req_add_cert" ], [ "", "gnutls_x509_privkey_init" ], [ "", "gnutls_pubkey_export" ], [ "", "gnutls_x509_crq_import" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "gnutls_ecc_curve_list" ], [ "", "recv" ], [ "", "mktime" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_transport_set_pull_function" ], [ "", "fstat" ], [ "", "gnutls_pubkey_import" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_dh_params_import_pkcs3" ], [ "", "strtok" ], [ "", "fileno" ], [ "", "gnutls_sign_get_name" ], [ "", "putchar" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_ocsp_req_deinit" ], [ "", "gnutls_cipher_list" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_x509_privkey_generate" ], [ "", "gnutls_transport_set_push_function" ], [ "", "gnutls_group_list" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "gnutls_x509_privkey_get_key_id" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "gnutls_pubkey_init" ], [ "", "setvbuf" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_url_is_supported" ], [ "", "gnutls_pk_list" ], [ "", "asprintf" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_x509_privkey_generate2" ], [ "", "gnutls_priority_cipher_list" ], [ "", "setenv" ], [ "", "gnutls_x509_privkey_export" ], [ "", "gnutls_x509_privkey_import2" ], [ "", "gnutls_ocsp_resp_verify_direct" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_global_deinit" ], [ "", "perror" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_x509_privkey_get_spki" ], [ "", "gnutls_kx_list" ], [ "", "gnutls_x509_privkey_get_seed" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "gnutls_heartbeat_pong" ], [ "", "shutdown" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_cipher_suite_info" ], [ "", "gnutls_idna_map" ], [ "", "gnutls_x509_crt_get_authority_info_access" ], [ "", "setsockopt" ], [ "", "gnutls_x509_spki_init" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "reallocarray" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "gnutls_x509_crl_list_import2" ], [ "", "gnutls_system_recv_timeout" ], [ "", "getservbyname" ], [ "", "optind" ], [ "", "gnutls_ocsp_resp_export2" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_session_channel_binding" ], [ "", "secure_getenv" ], [ "", "gnutls_rnd" ], [ "", "atoi" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "gnutls_x509_privkey_export_gost_raw" ], [ "", "fwrite" ], [ "", "strspn" ], [ "", "gnutls_x509_spki_get_rsa_pss_params" ], [ "", "gnutls_ocsp_req_set_nonce" ], [ "", "puts" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "deregister_frame_info" ], [ "", "ferror" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_x509_trust_list_init" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_transport_set_int2" ], [ "", "gnutls_x509_crt_print" ], [ "", "timegm" ], [ "", "gnutls_bye" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_sec_param_get_name" ], [ "", "gnutls_transport_set_pull_timeout_function" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_sec_param_to_pk_bits" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_pubkey_import_url" ], [ "", "getservbyport" ], [ "", "strcasecmp" ], [ "", "vfprintf" ], [ "", "gnutls_dh_params_import_raw2" ], [ "", "socket" ], [ "", "libc_start_main" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "gnutls_ocsp_resp_get_nonce" ], [ "", "pipe" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_x509_privkey_export_ecc_raw" ], [ "", "gnutls_dh_get_group" ], [ "", "fseek" ], [ "", "gnutls_certificate_type_get2" ], [ "", "remove" ], [ "", "memcmp" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "gnutls_x509_privkey_export_pkcs8" ], [ "", "gnutls_privkey_import_url" ], [ "", "gnutls_x509_trust_list_add_cas" ], [ "", "gnutls_ocsp_req_init" ], [ "", "strdup" ], [ "", "gnutls_x509_spki_deinit" ], [ "", "gnutls_ocsp_resp_deinit" ], [ "", "gnutls_strerror" ], [ "", "getaddrinfo" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gai_strerror" ], [ "", "gnutls_ocsp_resp_print" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_privkey_init" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_record_send_range" ], [ "", "gnutls_record_send_early_data" ], [ "", "gnutls_compression_list" ], [ "", "gnutls_x509_trust_list_deinit" ], [ "", "gnutls_gost_paramset_get_name" ], [ "", "gnutls_ocsp_resp_import2" ], [ "", "sprintf" ], [ "", "gnutls_x509_crt_import_url" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "connect" ], [ "", "select" ], [ "", "gnutls_x509_privkey_sec_param" ], [ "", "strlen" ], [ "", "ITM_registerTMCloneTable" ], [ "", "gnutls_x509_spki_get_rsa_oaep_params" ], [ "", "strtol" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_ocsp_req_print" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_transport_set_ptr" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_session_get_id" ], [ "", "inet_pton" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "memmem" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_pubkey_deinit" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "ftello" ], [ "", "gnutls_pubkey_print" ], [ "", "gmtime_r" ], [ "", "gnutls_record_send" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "gnutls_privkey_import_x509_raw" ], [ "", "optarg" ], [ "", "malloc" ], [ "", "send" ], [ "", "strcmp" ], [ "", "gnutls_dh_params_import_dsa" ], [ "", "ftell" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 272, 4.29, "alloc" ], [ ".dynsym", 1176, 7344, 1.33, "alloc" ], [ ".dynstr", 8520, 6361, 4.51, "alloc" ], [ ".gnu.version", 14882, 612, 1.72, "alloc" ], [ ".gnu.version_r", 15496, 176, 3.19, "alloc" ], [ ".rela.dyn", 15672, 7296, 1.89, "alloc" ], [ ".rela.plt", 22968, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 22992, 72, 3.24, "alloc" ], [ ".init", 24576, 3, 1.58, "alloc,executable" ], [ ".plt", 24592, 32, 3.34, "alloc,executable" ], [ ".text", 24624, 46271, 6.15, "alloc,executable" ], [ ".fini", 70895, 3, 1.58, "alloc,executable" ], [ ".rodata", 73728, 17367, 5.53, "alloc" ], [ ".eh_frame_hdr", 91096, 1124, 5.06, "alloc" ], [ ".eh_frame", 92224, 6520, 4.94, "alloc" ], [ ".init_array", 99888, 8, 1.06, "write,alloc" ], [ ".fini_array", 99896, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 99904, 3716, 2.33, "write,alloc" ], [ ".dynamic", 103624, 560, 1.52, "write,alloc" ], [ ".got", 104184, 2304, 0.03, "write,alloc" ], [ ".data", 106496, 8, 1.06, "write,alloc" ], [ ".gnu_debuglink", 106504, 20, 3.98, "" ], [ ".shstrtab", 106524, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 25739.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 306.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 304.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 306.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 46322.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 46322.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 108584.0, "entropy": 5.52, "size_bytes": 108584.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.15, "data_entropy": 1.45, "overlay_size": 1792.0, "string_count": 996.0, "overlay_ratio": 0.02, "overall_entropy": 5.52, "overlay_entropy": 1.55, "entropy_variance": 2.68, "avg_string_length": 25.28, "max_string_length": 2650.0, "peak_region_bytes": 27648.0, "code_to_data_ratio": 0.88, "peak_region_entropy": 6.19, "string_length_stddev": 89.85, "largest_section_ratio": 0.43, "sentence_string_count": 279.0, "sentence_string_ratio": 0.28, "high_entropy_string_count": 0.0 }, "exports": { "count": 22.0 }, "imports": { "count": 283.0 }, "sections": { "count": 28.0, "code_size": 46309.0, "entropy_max": 6.15, "entropy_mean": 2.89, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 3, "mol": "O₃(AlCCo)H₅(Cm₈CrF₃PoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/ocsptool", "risk": 11, "sha": "4c6aa1cb1bf55100211049f3d940a1f672ce50fe0b9d0d361eafee44d2d0c4e4", "size": 108584, "traits": [ { "id": "objectives/command-and-control/channel/http/message::http-method-post", "atk": "T1071.001", "conf": 0.6499999761581421, "crit": 1, "desc": "Hardcoded POST method string", "spans": [ [ 75182, 6 ] ] }, { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 14535, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 84168, 128 ], [ 84196, 62 ] ] }, { "id": "micro-behaviors/data/encode/payload::c-array-format", "conf": 0.6000000238418579, "crit": 3, "desc": "C array declaration format string", "spans": [ [ 76155, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 8536, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 8688, 5 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 14527, 7 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 8787, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 84168, 128 ], [ 84196, 62 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 8828, 9 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 12134, 4 ] ] }, { "id": "micro-behaviors/communications/http/post::native-post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "Native HTTP POST request line", "spans": [ [ 75182, 17 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "spans": [ [ 14473, 11 ] ] }, { "id": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "conf": 0.699999988079071, "crit": 3, "desc": "GnuTLS function names", "spans": [ [ 9328, 18 ], [ 12120, 18 ] ] }, { "id": "objectives/command-and-control/channel/http/message::http-delimiter", "atk": "T1071.001", "crit": 1, "desc": "HTTP header syntax marker", "spans": [ [ 75191, 16 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 14610, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 8760, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 12134, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 8556, 5 ] ] }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7799999713897705, "crit": 3, "desc": "HTTP POST request line", "spans": [ [ 75182, 17 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 14351, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 8663, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 8556, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 83889, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 75117, 11 ], [ 75736, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 14695, 5 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "spans": [ [ 79563, 6 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "spans": [ [ 14422, 6 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 83889, 10 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 8760, 5 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "spans": [ [ 14461, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 14358, 5 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 14603, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 79775, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 14591, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 14603, 6 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 8787, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 9342, 4 ] ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 14548, 6 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 14351, 6 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 14300, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 9342, 4 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 8787, 7 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 8556, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 83889, 10 ], [ 84168, 128 ], [ 84196, 62 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 8760, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 14610, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 8536, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 83889, 10 ], [ 84168, 128 ], [ 84196, 62 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 8536, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91sZIde00000kMy=:00000ib[%00000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "-K7jIy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000d000040rr920000600008I69{\u003e1Yb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "000000044JvqG:#v/P\u003eyv%zA?w[=c\u003ey?Xib0crm5B98B5w].D\u003ewb]$dr83.gwPzu{x(!xcA-t+2y\u0026si5raflLwDlsPwPR$[B98CjxMs8]BAhnezeYF@BAhnnwO}GRvScpe0a]?VB-Ri@uTE\u003e@vpK7Wv}YT+w)]y\u00260crm3v@MX[B97@7A=Ie3BAg(gC(R[%BAqwgyJ1fl0crm5v{%DVB98CmBzkP60a{d*wO}GPuU0.*wOkZ#By/G1w].r%wNxd?w]vV\u003czG6SgzGC", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 7588, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 7525, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 7561, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 7427, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 7447, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 7510, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 7481, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 7579, "z": 8, "cf": 0.20000000298023224 } ], "ln": 7411 }, { "b": "v@Df\u003cxjVf(C4CYnx(v\u003e?xkR\u003cly\u0026-%7wN/U0wm6y?zE--WzGQ5qB6\u0026)bx(w3aBA}k7wOD3@Bo2@\u003eB-.CvuT%", "n": [ { "c": 3, "d": "SSL/TLS library hook target", "i": "objectives/collection/network/ssl-intercept::ssl-tls-marker", "o": 8099, "z": 18, "cf": 0.800000011920929 } ], "ln": 8083 }, { "b": "zEm3/Bo2@\u003eB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuVZr%zGx=nA=+VfwD", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 9165, "z": 9, "cf": 1.0 } ], "ln": 9149 }, { "b": "uTW+ZA=+V3wPRo%vqPMQxkR\u003cly\u0026-%7wN/U0wm6v*v%d\u0026+zGQ5qB6\u0026A*A==2cx\u003e7N[wNxQ(A+Pc1v{%E[z/b", "n": [ { "c": 3, "d": "GnuTLS function names", "i": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "o": 10492, "z": 18, "cf": 0.699999988079071 } ], "ln": 10476 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuT)U/Bzku3v{%E\u003cuVP!2uV{13x\u003ezS$w=", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 11015, "z": 9, "cf": 1.0 } ], "ln": 10999 }, { "b": "v@2B.zGG]AuUaF3x(W=(BzkP60b3g(BzM29v}xX5x\u003ez6?vru6/B7GD2CR}fnuT[a)", "n": [ { "c": 2, "d": "Get current calendar time (seconds)", "i": "micro-behaviors/time/query::time", "o": 12129, "z": 4, "cf": 0.30000001192092896 } ], "ln": 12113 }, { "b": "wDl^[A==ko0cqZYB-I52xjVf@zGV1(v@uy80aP?-v@2B:wPS3dzdJYWzffGewNxDTv{%g\u0026z^@=Vx(4u#zVB\u0026%v@2T$0b2.OuVQsfwPz*fASy2%BzkS60b#T\u003ewDlWXA=M8s0c075v/QN:xkRc]0a{d\u0026yxef+B97#h0cqZ/wN//ZB97@bzua3PCXIm1B98CzAbCU(z!0i(BzkP6uVDcVwPRu\u003ewo8y4w]vVUx(mCYxjVg5vqPN\u0026zF0!!woz\u0026D0cJg2wPRH3B]VO%B-.ejCwWz4ByYrjBo2](B-.W8xjVg7vrlF\u0026BzkP6xkESSB8VelzGGE\u003cBB51tBo3t)v%hE8z/2F)AcbJex8(NQBz(buuU\u003cT#x8(H/wN/[50crm5wPz*fA:J?!uUj1\u0026x-Ji=zE^\u003cc0bVH[x(dzYAb](fA:-/(x(n9jv{%E[z/e{6xM4{kuV6p?wDldGv}xR30a{m.wNPaWA+PA6zVBcKy?Wu*uVQr$A=+V9vqfPVCxdztwDl)=Ab]VgBy\u003eI[wNPy\u003ez!0i@A::j[uTE+)z!A@@z2", "n": [ { "c": 3, "d": "Resolve endpoint with getaddrinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "o": 12668, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getnameinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "o": 12685, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Bind socket to address", "i": "micro-behaviors/communications/socket/bind/function::bind", "o": 12680, "z": 4, "cf": 0.75 }, { "c": 3, "d": "select() I/O multiplexing", "i": "micro-behaviors/communications/socket/multiplex::select-multiplex", "o": 12630, "z": 6, "cf": 0.5 }, { "c": 3, "d": "Uses recvfrom socket call", "i": "micro-behaviors/communications/socket/receive::recvfrom-symbol", "o": 12763, "z": 8, "cf": 0.6600000262260437 }, { "c": 3, "d": "Accept API symbol text", "i": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "o": 12859, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Listen API symbol text", "i": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "o": 12623, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Send API symbol text", "i": "micro-behaviors/communications/socket/tcp::send-symbol-text", "o": 12815, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 12567, "z": 6, "cf": 0.75 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 12791, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 12733, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 12779, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "File descriptor manipulation and control", "i": "micro-behaviors/fs/file/handle::fcntl", "o": 12524, "z": 5, "cf": 0.4000000059604645 }, { "c": 2, "d": "Write files (write)", "i": "micro-behaviors/fs/file/write/direct::write--write", "o": 12897, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 12517, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 12702, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 12611, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 12697, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 12618, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 12644, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 12544, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (symbol)", "i": "micro-behaviors/time/query::localtime-symbol", "o": 12656, "z": 11, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 12530, "z": 13, "cf": 0.4000000059604645 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 12594, "z": 4, "cf": 0.8500000238418579 } ], "ln": 12501 }, { "b": "B8JV!fAt{6vQ?3cB-RvJCSmP*hz^4cz.r:Am]05-oJbpOuPhsF07P^:r7{j$gHA4Ef/5", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 12962, "z": 6, "cf": 0.30000001192092896 } ], "ln": 12946 }, { "b": "0000)It6MJjtfJemlS?gnqS0BR#=@0nvRFWjwX{Aj]!cgGE0-5002YH-.qjSbP{:-t%[U)nq3Zq4$\u003c", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 31578, "z": 14, "cf": 0.699999988079071 } ], "ln": 31562 }, { "b": "e\u0026Lyse\u00260zUaw=SXAWL]Jv}xX5x\u003ez6?vru66CvtLnpes?iC4CYdw[+*!e=X%YA=bPexf4eBy?WC", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 61487, "z": 11, "cf": 0.5 } ], "ln": 61471 }, { "b": "wohA)yH]KHc36y[dK([\u003cra]#!azC)tvixP4B9hthwft@8B8#5lzu94xB.\u003eOhzF%Rt", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 61809, "z": 4, "cf": 0.800000011920929 } ], "ln": 61793 }, { "b": "ash7o07ggjzF%RtB7GCoBzbkdzddW6zfoXrA+e:0A+3qkwN/p=C4z!qx)KtkBz\u0026o", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 61974, "z": 3, "cf": 0.800000011920929 } ], "ln": 61958 }, { "b": "Bzk]fay/tczE)s1x(v(iw]zYjv@c78wEnACv}f7?BsnNr3mWe:v}f7?By!#9v@Dk", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 62293, "z": 3, "cf": 0.800000011920929 } ], "ln": 62277 }, { "b": "mriA!AYLr?A%.[qmn$xfnk@L+fek7katLS8awUSt3pw-HBy/uieP=nSwJy@QwQ5qIxMO9c", "n": [ { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 62449, "z": 8, "cf": 0.6600000262260437 } ], "ln": 62433 }, { "b": "k0gF$qA+A/jxbixjxaZjlUgpWx\u003ez6?vru66rc-B]iY]5{l{r.jl{q]rjtfV4k0gF$qA+A/jxbh", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 62949, "z": 11, "cf": 0.5 } ], "ln": 62933 }, { "b": "k0gF$qA+A/jxbixjxaZjlUQHMwPx)^r75]jr75[@B389Pl{rZ^r8L)!06BjUk0h!jk1#", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 63229, "z": 6, "cf": 0.5 } ], "ln": 63213 }, { "b": "fg5D5sW1@3nk@qSj{?R%nk@L+fek7kat+=eawM\u0026%avZo(zE:g-lVl\u003c:wO#PwBA}?piV@I", "n": [ { "c": 2, "d": "HTTP/1.x version string", "i": "micro-behaviors/communications/http/request/client::http-version", "o": 63389, "z": 7, "cf": 0.5 } ], "ln": 63373 }, { "b": "fg5D5sW1@3nk@qSj{?R%nk@L+fek7katLS8awUSt3pw-HBy/uieMv1mwJy@xAbYScv{%E[z/djDv@#p7ePV2OwNPA+3pw-HBy/uieLG.[xlm/Fashdt3jNsxA+e-(x)a4", "n": [ { "c": 4, "d": "Android upload transport", "i": "objectives/exfiltration/stealer/credential/mobile::android-upload-transport", "o": 63553, "z": 38, "cf": 0.9200000166893005 }, { "c": 2, "d": "HTTP/1.x version string", "i": "micro-behaviors/communications/http/request/client::http-version", "o": 63536, "z": 7, "cf": 0.5 } ], "ln": 63520 }, { "b": "wGV59zE^E0xcp.[BytHRra]?=v}xX5x\u003ez6?vru66zGP/9wPw]jA=lbnwmYo]c):0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 63885, "z": 3, "cf": 0.800000011920929 } ], "ln": 63869 }, { "b": "az#9uAb]Vovru66yH}=lvqYP#v}xX5x\u003ez6?vru66Aa9E3B0bWrA+cwmwPPKi07ge", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 64534, "z": 3, "cf": 0.800000011920929 } ], "ln": 64518 }, { "b": "dO8#]qDb$Kk#Yr-08vCPxK$Q)ByF/\u0026BrCpnaARphB0bKnB8#5lzvcw.x(mMAash7o04/r\u0026wO2)8wnbM%zu", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 65362, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 65349, "z": 9, "cf": 1.0 } ], "ln": 65333 }, { "b": "B2\u003eAzm]Ab.p+r#m08MruB7]o8vruTjwPG)P08(DVpaW=k07gEtxK#ibB9hhswPG)t00#qfC{0", "n": [ { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 66077, "z": 10, "cf": 1.0 } ], "ln": 66061 }, { "b": "c37Bv090(LwO@Rrc37BRCwhejaxqrkaswERcM\u0026zfwPq\u003cbA+fqmc37h9nLPP)mq^iU", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 66603, "z": 4, "cf": 0.800000011920929 } ], "ln": 66587 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 67635, "z": 10, "cf": 0.949999988079071 } ], "ln": 67619 }, { "b": "az\u003eXbz/QaCw]zYjc36y[xkR\u003cly\u0026.gHwPz@peG^M3BYq4kaAIamC4CX3rDzOYwJy}RxkR\u003cly\u0026.gHwPz@ptoCHWw]7)*j%j5(C42hJt{aIqeIf85vqPNttyeIXaBMv}vqFbkaycPLe*7Gdph+2YiTMiparSmDefDI@wmYj)xfycPz6f@zarR^HarR^HavQfRvR/P#wmYj)xj\u003e{@x9[}K2)\u0026gax(\u003eFm", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 67995, "z": 128, "cf": 0.9399999976158142 } ], "ln": 67979 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 71637, "z": 9, "cf": 0.9399999976158142 } ], "ln": 71621 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 71699, "z": 3, "cf": 0.699999988079071 } ], "ln": 71683 }, { "b": "3r7IRC4CXpAb](fA:-/cBzb98az++kBy/uhaARJAx(mB0ze0)2axh3kay/tczE)s1", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 71964, "z": 4, "cf": 0.800000011920929 } ], "ln": 71948 }, { "b": "BzM1IB7GxnatUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 72622, "z": 9, "cf": 0.6000000238418579 } ], "ln": 72606 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 72813, "z": 9, "cf": 0.699999988079071 } ], "ln": 72797 }, { "b": "000000rr910rr910rr91xkR\u003cly\u0026.gHwPz@DwmYj)x8?]i\u003c}5=!04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026Hz#", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 94228, "z": 17, "cf": 1.0 } ], "ln": 94212 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 94327, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 94319, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 94301, "z": 7, "cf": 0.8999999761581421 } ], "ln": 94285 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 94480, "z": 8, "cf": 0.8999999761581421 } ], "ln": 94464 } ], "depth": 1, "facts": { "exp": [ [ "stderr" ], [ "fini" ], [ "stdin" ], [ "init" ], [ "gnutls_malloc" ], [ "stdout" ], [ "gnutls_free" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "gnutls_deinit" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "gnutls_dh_params_generate2" ], [ "", "cxa_finalize" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_session_get_desc" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "strerror_r" ], [ "", "gnutls_error_is_fatal" ], [ "", "gnutls_certificate_type_get" ], [ "", "fgets" ], [ "", "close" ], [ "", "strchr" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_record_recv_early_data" ], [ "", "calloc" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_db_set_store_function" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "strncmp" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "freeaddrinfo" ], [ "", "gnutls_certificate_set_known_dh_params" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "gnutls_anon_set_server_params_function" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_session_ticket_key_generate" ], [ "", "gnutls_record_recv" ], [ "", "gnutls_certificate_set_x509_trust_file" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "abort" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_digest_get_name" ], [ "", "gnutls_db_set_remove_function" ], [ "", "gnutls_certificate_set_x509_key_file" ], [ "", "gnutls_compression_get" ], [ "", "fflush" ], [ "", "dup2" ], [ "", "gnutls_certificate_set_x509_crl_file" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_handshake_set_private_extensions" ], [ "", "gnutls_hex_encode2" ], [ "", "gnutls_session_is_resumed" ], [ "", "exit" ], [ "", "gnutls_alert_send_appropriate" ], [ "", "fprintf" ], [ "", "gnutls_group_get_name" ], [ "", "getnameinfo" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_cipher_get_name" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "accept" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "gnutls_certificate_set_ocsp_status_request_file" ], [ "", "mktime" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_handshake" ], [ "", "gnutls_global_set_audit_log_function" ], [ "", "gnutls_transport_set_pull_function" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_dh_params_import_pkcs3" ], [ "", "gnutls_record_recv_seq" ], [ "", "fileno" ], [ "", "gnutls_sign_get_name" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_key_generate" ], [ "", "gnutls_dtls_cookie_verify" ], [ "", "gnutls_cipher_list" ], [ "", "stpcpy" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_transport_set_push_function" ], [ "", "gnutls_group_list" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "listen" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_alpn_set_protocols" ], [ "", "gnutls_certificate_set_flags" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_transport_set_errno" ], [ "", "gnutls_pk_list" ], [ "", "asprintf" ], [ "", "gnutls_session_set_ptr" ], [ "", "gnutls_anti_replay_init" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_dtls_prestate_set" ], [ "", "gnutls_heartbeat_enable" ], [ "", "gnutls_priority_cipher_list" ], [ "", "setenv" ], [ "", "gnutls_pkcs11_init" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_psk_set_server_known_dh_params" ], [ "", "perror" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_record_set_max_recv_size" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_kx_list" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "gnutls_heartbeat_pong" ], [ "", "gnutls_db_set_ptr" ], [ "", "shutdown" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_cipher_suite_info" ], [ "", "setsockopt" ], [ "", "sendto" ], [ "", "strcat" ], [ "", "gnutls_dtls_set_mtu" ], [ "", "gnutls_psk_set_server_credentials_hint" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "reallocarray" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "optind" ], [ "", "gnutls_psk_set_server_credentials_file" ], [ "", "program_invocation_short_name" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_init" ], [ "", "gnutls_session_channel_binding" ], [ "", "secure_getenv" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "strspn" ], [ "", "gnutls_certificate_set_rawpk_key_file" ], [ "", "puts" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_record_set_max_early_data_size" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "deregister_frame_info" ], [ "", "putc" ], [ "", "gnutls_session_get_ptr" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_transport_set_int2" ], [ "", "fcntl" ], [ "", "gnutls_x509_crt_print" ], [ "", "timegm" ], [ "", "gnutls_handshake_set_timeout" ], [ "", "gnutls_bye" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_transport_set_pull_timeout_function" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_sec_param_to_pk_bits" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_credentials_set" ], [ "", "gnutls_anti_replay_enable" ], [ "", "write" ], [ "", "gnutls_session_ticket_enable_server" ], [ "", "gnutls_anti_replay_set_ptr" ], [ "", "vfprintf" ], [ "", "socket" ], [ "", "libc_start_main" ], [ "", "gnutls_alert_get" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "pipe" ], [ "", "gnutls_certificate_set_verify_function" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_dh_get_group" ], [ "", "gnutls_alert_get_name" ], [ "", "time" ], [ "", "gnutls_certificate_type_get2" ], [ "", "memcmp" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "gnutls_psk_set_server_params_function" ], [ "", "strdup" ], [ "", "gnutls_cipher_suite_get_name" ], [ "", "gnutls_strerror" ], [ "", "getaddrinfo" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gai_strerror" ], [ "", "recvfrom" ], [ "", "gnutls_psk_allocate_server_credentials" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_psk_server_get_username" ], [ "", "gnutls_set_default_priority" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "gnutls_certificate_set_params_function" ], [ "", "gnutls_load_file" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_anti_replay_set_add_function" ], [ "", "gnutls_srtp_set_profile_direct" ], [ "", "gnutls_compression_list" ], [ "", "sprintf" ], [ "", "gnutls_pkcs11_add_provider" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "select" ], [ "", "bind" ], [ "", "strlen" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strtol" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_dtls_cookie_send" ], [ "", "gnutls_priority_set_direct" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_transport_set_ptr" ], [ "", "gnutls_alert_send" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_session_get_id" ], [ "", "progname" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "gnutls_db_check_entry_expire_time" ], [ "", "gnutls_anon_set_server_known_dh_params" ], [ "", "gmtime_r" ], [ "", "gnutls_record_send" ], [ "", "gnutls_db_set_retrieve_function" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "optarg" ], [ "", "gnutls_handshake_set_post_client_hello_function" ], [ "", "malloc" ], [ "", "strcmp" ], [ "", "gnutls_certificate_allocate_credentials" ], [ "", "gnutls_anon_allocate_server_credentials" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.19, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 104, 3.59, "alloc" ], [ ".dynsym", 1008, 6408, 1.22, "alloc" ], [ ".dynstr", 7416, 5687, 4.36, "alloc" ], [ ".gnu.version", 13104, 534, 1.72, "alloc" ], [ ".gnu.version_r", 13640, 176, 3.23, "alloc" ], [ ".rela.dyn", 13816, 6336, 1.85, "alloc" ], [ ".rela.plt", 20152, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 20176, 88, 3.67, "alloc" ], [ ".init", 20480, 3, 1.58, "alloc,executable" ], [ ".plt", 20496, 32, 3.34, "alloc,executable" ], [ ".text", 20528, 40893, 6.24, "alloc,executable" ], [ ".fini", 61421, 3, 1.58, "alloc,executable" ], [ ".rodata", 61440, 15447, 5.59, "alloc" ], [ ".eh_frame_hdr", 76888, 1708, 5.07, "alloc" ], [ ".eh_frame", 78600, 7800, 4.76, "alloc" ], [ ".init_array", 87024, 8, 1.06, "write,alloc" ], [ ".fini_array", 87032, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 87040, 4480, 2.37, "write,alloc" ], [ ".dynamic", 91520, 560, 1.5, "write,alloc" ], [ ".got", 92080, 2104, 0.03, "write,alloc" ], [ ".data", 94208, 20, 0.99, "write,alloc" ], [ ".gnu_debuglink", 94228, 24, 4.05, "" ], [ ".shstrtab", 94252, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 24409.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 267.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 264.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 267.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 40944.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 40944.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 96312.0, "entropy": 5.66, "size_bytes": 96312.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.23, "data_entropy": 1.61, "overlay_size": 1792.0, "string_count": 849.0, "overlay_ratio": 0.02, "overall_entropy": 5.66, "overlay_entropy": 1.52, "entropy_variance": 2.67, "avg_string_length": 28.63, "max_string_length": 4132.0, "peak_region_bytes": 25600.0, "code_to_data_ratio": 0.85, "peak_region_entropy": 6.19, "string_length_stddev": 145.66, "largest_section_ratio": 0.42, "sentence_string_count": 223.0, "sentence_string_ratio": 0.26, "high_entropy_string_count": 0.0 }, "exports": { "count": 7.0 }, "imports": { "count": 259.0 }, "sections": { "count": 28.0, "code_size": 40931.0, "entropy_max": 6.24, "entropy_mean": 2.87, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 4, "mol": "O₃(AlCCo)H₄(Cm₈FPoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/gnutls-serv", "risk": 9, "sha": "be3f1224b8f7f17902a8ba83c0c1a995947b2ecf3d8a7640d043fc92a6f04ffb", "size": 96312, "traits": [ { "id": "micro-behaviors/communications/socket/tcp::listen-symbol-text", "conf": 0.75, "crit": 3, "desc": "Listen API symbol text", "spans": [ [ 12623, 6 ] ] }, { "id": "micro-behaviors/communications/http/upload::octet-stream-upload-header", "atk": "T1071.001", "conf": 0.8399999737739563, "crit": 3, "desc": "HTTP octet-stream upload header", "spans": [ [ 63553, 38 ] ] }, { "id": "micro-behaviors/communications/socket/bind/function::bind", "conf": 0.75, "crit": 3, "desc": "Bind socket to address", "spans": [ [ 12680, 4 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 67995, 128 ], [ 68023, 65 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 7427, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 7588, 5 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 12733, 7 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::accept-symbol-text", "conf": 0.75, "crit": 3, "desc": "Accept API symbol text", "spans": [ [ 12859, 6 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 67995, 128 ], [ 68023, 65 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recvfrom-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recvfrom socket call", "spans": [ [ 12763, 8 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "spans": [ [ 12685, 11 ] ] }, { "id": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "conf": 0.699999988079071, "crit": 3, "desc": "GnuTLS function names", "spans": [ [ 8099, 18 ], [ 10492, 18 ] ] }, { "id": "micro-behaviors/communications/socket/listen::accept-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "accept function symbol", "spans": [ [ 12859, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen-sym", "atk": "T1071", "mbc": "C0001", "conf": 0.6000000238418579, "crit": 3, "desc": "listen function symbol", "spans": [ [ 12623, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 7447, 5 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 12567, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 7561, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 7447, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 67635, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 61487, 11 ], [ 62949, 11 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "spans": [ [ 12630, 6 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 67635, 10 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::send-symbol-text", "conf": 0.75, "crit": 3, "desc": "Send API symbol text", "spans": [ [ 12815, 6 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "spans": [ [ 12668, 11 ] ] }, { "id": "micro-behaviors/communications/socket/send::sendto-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses sendto socket call", "spans": [ [ 12815, 6 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (write)", "spans": [ [ 12897, 5 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 12791, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 66077, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 12779, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 12791, 6 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 12567, 6 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/communications/socket/listen::listen", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Listen on a socket", "spans": [ [ 12567, 6 ], [ 12623, 6 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 7447, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 67635, 10 ], [ 67995, 128 ], [ 68023, 65 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 12897, 5 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 7427, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 67635, 10 ], [ 67995, 128 ], [ 68023, 65 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 7427, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91f\u0026ObM00000kMy=:00000np{{y0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "r53/{y?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000d0002:000010000600008I69{\u003e1Yb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "K]UK.000080000000000wQ4{h0chTVy\u00261310af8yCWT@\u003ex(mu}x)Ks\u003cB98CzBAdv*nMnz\u003ewmY^)xk8BewPy:AlU{WUwMi8Ey?iPUxjVga0crm5v}Y(.B98Cuv@le+B98Cuy?mF:vpBd}Bo2]+y\u0026%/j0af8OBywV{uT)++uUi.XyYFJ#wmY!40crm5v@MX[B7GDmz!0N3Ac883BAg(1Bo2-\u003ez!Ph)BAg#nx(dzYw]zT1zua3JwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zVB\u0026@Ab]VgBn", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 6961, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 6900, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 6929, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 6808, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 6885, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 6856, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 6793, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 6952, "z": 8, "cf": 0.20000000298023224 } ], "ln": 6777 }, { "b": "0crm5woz?\u003eB8VelzGGE\u003cv@Dm5wN//ZB98CswO}GPnMnz\u003eA+e($B97#lr82.@z/fb=vpB4:0blsZByf0ez/bL(wO(o}z2^{IwPz*ez^Ns0v{%E[z/bL@BAg(dz#Y", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 7103, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 7062, "z": 7, "cf": 0.75 } ], "ln": 7046 }, { "b": "v@Df\u003cxjVf(C4CYnx(v\u003e?xkR\u003cly\u0026-%7wN/U0wm6y?zE--WzGQ5qB6\u0026)bx(w3aBA}k7wOD3@Bo2@\u003eB-.CvuT%", "n": [ { "c": 3, "d": "SSL/TLS library hook target", "i": "objectives/collection/network/ssl-intercept::ssl-tls-marker", "o": 7403, "z": 18, "cf": 0.800000011920929 } ], "ln": 7387 }, { "b": "zc{{!Bo2@\u003eB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuVZr%zGx=nA=+VfwD", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 8168, "z": 9, "cf": 1.0 } ], "ln": 8152 }, { "b": "uTW+ZA=+V3wPRo%vqPMQxkR\u003cly\u0026-%7wN/U0wm6v*v%d\u0026+zGQ5qB6\u0026A*A==2cx\u003e7N[wNxQ(A+Pc1v{%E[z/b", "n": [ { "c": 3, "d": "GnuTLS function names", "i": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "o": 9405, "z": 18, "cf": 0.699999988079071 } ], "ln": 9389 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuVP!1B7]MguVP!2uU0O!ve%}TB-.CvuJ", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 9814, "z": 9, "cf": 1.0 } ], "ln": 9798 }, { "b": "wDl^[A==ko0cqZYB-I52xjVf@zGV1\u0026y\u0026r*0uUr}(BzkP60b3d\u003cx(dA*ASyf0v@2T$0bcE)zGt!\u003cvqf7\u0026BAg@kA=k%#z/x/jzE--^x(ER-AaK6gz/L\u00260x\u003eIr(yYF6=A++U]B-.bbvr8u?wO+{/Bo3x7wnb]YB98CzAbCU(z!0i(BzkP6uVDcVwPRu\u003ewo8y4w]vVZwPR/#zdNB0w]vVWB-o8oB-8niBy/uk0cq*@ByYrlzua:1wn=Qj0a{g)ByLq.Aclnz0b2\u003e+Aa9*e0cz{(wOk\u0026WA+f9aC4yU}DuiUt0b(*#vrb#XxjVgawPz%6D2v5cwDldPvrch+xjVg6AcbD6z/fg/wQ4=@C5NB[CxdztwDl^=xjkp(x(v\u003e?uUj1\u0026x-J0=BzkP60a{m.wNPaWA+PA6zVBu^wohs5C4CMk0axwEwPI[)uTER-vQ\u0026+^ByxiiuU%j=zuarXBAq2lC4b-oz/P}1C4LYlx(n380b=)%xMBe]wNPy\u003ez!0i@A::j[y?Wu\u003ezGQ5qB1RJLe\u0026bfYy?Wu*e]t-Ly+o(\u003ehEwv0e]$}-f-TZsrA8T\u003cuO=4FuO.WLpe$m!q^Rs/hEwf{", "n": [ { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 11014, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 11346, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getaddrinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "o": 11104, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getnameinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "o": 11116, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 11072, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 11007, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::remove", "o": 11185, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 11237, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 11170, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 11225, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "Check if file exists", "i": "micro-behaviors/fs/file/stat::stat-exists", "o": 11298, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 11158, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 11244, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 10977, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 11133, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler (POSIX sigaction)", "i": "micro-behaviors/os/signal/handler::sigaction", "o": 11251, "z": 9, "cf": 0.8999999761581421 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 11052, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 11391, "z": 6, "cf": 0.30000001192092896 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 11128, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 11059, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 10998, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 11093, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Schedule alarm timer", "i": "micro-behaviors/time/schedule/timeout/alarm::alarm", "o": 11219, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 10984, "z": 13, "cf": 0.4000000059604645 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 11040, "z": 4, "cf": 0.8500000238418579 } ], "ln": 10961 }, { "b": "B8bGeAaJLWCw7MfxK#ibBzbkdB7GxnwPw]4v}f7?BAnNnwObv[y\u0026*!uwN/U0wft{", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 61634, "z": 3, "cf": 0.800000011920929 } ], "ln": 61618 }, { "b": "p^F56x(+zqwPq\u003cbA+e+Yw]zYjr7{jkf!Ld5c@JJ4gbpWAdiJXOAbY-oBo2]\u003eAV!r", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 61904, "z": 3, "cf": 0.800000011920929 } ], "ln": 61888 }, { "b": "zF%Rtv}YB-yH}2Rw]zYjv}xX5x\u003ez6?vru66x(mK3A=2lbx(v\u003e?w]zYjv}xX5x\u003ez6?vru66v}Yo", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 62313, "z": 11, "cf": 0.5 } ], "ln": 62297 }, { "b": "AbP=sasHeQq=UsEw]zYjwO#0#D2N\u003cSBzbl6eLOI#asHbSlPl!VhyP+\u0026B-qqrA=.p[z/M%", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 62481, "z": 7, "cf": 0.5 } ], "ln": 62465 }, { "b": "gb*T8B9hCvz/P}1w]zYjxK$Q)ByF/\u0026Brz#fmNG6\u003egb7d1B9hCvz/P}1w]zYjC4CYnx(v(iAS", "n": [ { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 62560, "z": 9, "cf": 1.0 } ], "ln": 62544 }, { "b": "zE^*4vqxAOCw7MfxK#ibv}/)}wPw]mB.L@eB0bvsBrCpnax8ijatUS7aAIHkv\u003c2i2wGQ", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 62781, "z": 6, "cf": 0.4000000059604645 } ], "ln": 62765 }, { "b": "g=diFdf9%#AV!\u003emA=#1pstz-\u003ef/Zv8qBT2kg+{*n0a{d\u0026aveB{eK@f5ay/b8xK#ibc@H", "n": [ { "c": 3, "d": "X25519 key exchange marker", "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "o": 63419, "z": 6, "cf": 0.8799999952316284 } ], "ln": 63403 }, { "b": "t@\u003c8dmriA!AV!!jasgLvCwhejaAITBx(mMac36y[mriA!AV!!jash7\u0026ash7o08ur+mlh}^nL?@Dqy$gdoGBW\u0026qBr]Hrz\u003ez6gb}rBgEKVgeKI\u0026(iX9Y@qV", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 64236, "z": 4, "cf": 0.800000011920929 }, { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 64275, "z": 6, "cf": 0.4000000059604645 } ], "ln": 64220 }, { "b": "x\u003ez6?vru74azbLmzE:)\u003clQ:)LnK=osk#ZnMB76l6wftP7ay]4)B.rpovrj5tB-WR3z/fa^pesQ", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 71892, "z": 11, "cf": 0.5 } ], "ln": 71876 }, { "b": "ph.m*wNPR3vR5$\u0026azCZoBzbxfaAIanB7]Mg3ik3VzF80Mc36y[eG^(3wPw]7x\u003eeu7", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 73874, "z": 4, "cf": 0.800000011920929 } ], "ln": 73858 }, { "b": "aAImywJy}Wwftt}BAm=?lUQHMwPw]mB.L@eB0b7kAV=VH3ij1IzGGriaz2Olz/M$eBuf", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 74424, "z": 6, "cf": 0.4000000059604645 } ], "ln": 74408 }, { "b": "B2\u003eAzm]Ab.p+r#m08MruB7]o8vruTjwPG)P08(DVpaW=k07gEtxK#ibB9hhswPG)t00#qfC{0", "n": [ { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 74610, "z": 10, "cf": 1.0 } ], "ln": 74594 }, { "b": "iV].\u00263jfA)lPMtoA%-lOlUgpWx\u003ez6?vru66BA}?pB2\u003eAzlSvh+mj/*b07pKlwPI%miV[z}wQbx", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 74688, "z": 11, "cf": 0.5 } ], "ln": 74672 }, { "b": "oJbp{nLPndB7Gv(dK([\u003cra]#!azC)tBzbkdw[=c\u003ey-)?uC{3Ncw]zZ3az+$ayIvW0", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 74955, "z": 4, "cf": 0.800000011920929 } ], "ln": 74939 }, { "b": "wO@Rrc37BRx(k5my\u0026szrvqYP#Ab]JhB0b4iBy/F10a*g\u003ez/M$vwNPa-zF78azG6Z", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 75424, "z": 3, "cf": 0.800000011920929 } ], "ln": 75408 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 76163, "z": 10, "cf": 0.949999988079071 } ], "ln": 76147 }, { "b": "xkRBfvpB4:az#ssvR6MWxkR\u003cly\u0026.gry?UFiwNY^{at1ZazGO]LqY]QZvS=rav@b\u003c\u003czGDj=B75Y)iV]LTzGQ5qB1H)rx!r\u003ebvS=ratoCHWw]7)*j%j5(C42hJt{aIqeIf85vqPNttyeIXaBMv}vqFbkaycPLe*awiz/Z2rvqPNY3joKDzE\u003e\u003co3lQDleO3yPeIgHAvS=rDzGP!sarR^HarR^HarR^}", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 76489, "z": 128, "cf": 0.9399999976158142 } ], "ln": 76473 }, { "b": "eIh3=vrcEiy\u0026.gEA=l5rj-+Z=arR!axK@q{AbYScv{%E[z/cXpA=l5rv@DfaBz\u0026o", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 76957, "z": 3, "cf": 0.800000011920929 } ], "ln": 76941 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 77251, "z": 9, "cf": 0.9399999976158142 } ], "ln": 77235 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 77313, "z": 3, "cf": 0.699999988079071 } ], "ln": 77297 }, { "b": "y?UFiwNY^{atUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 78324, "z": 9, "cf": 0.6000000238418579 } ], "ln": 78308 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 78515, "z": 9, "cf": 0.699999988079071 } ], "ln": 78499 }, { "b": "06@kie=XZx08Lpxe=U\u003eKm[3x1fcA!+r8tk5e?^.wxkR\u003cly\u0026.gry?UFiwNY^{x!r\u003ebvS=ragCgTtf/5", "n": [ { "c": 3, "d": "HTTP GET method", "i": "micro-behaviors/communications/http/get::get", "o": 80208, "z": 14, "cf": 0.699999988079071 } ], "ln": 80192 }, { "b": "gCguY0rr913]4+.00000xkR\u003cly\u0026.gry?UFiwNY^{e[wK5B.pWOsSwqX04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaG", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 98848, "z": 22, "cf": 1.0 } ], "ln": 98832 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 98951, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 98943, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 98925, "z": 7, "cf": 0.8999999761581421 } ], "ln": 98909 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 99104, "z": 8, "cf": 0.8999999761581421 } ], "ln": 99088 } ], "depth": 1, "facts": { "exp": [ [ "stderr" ], [ "fini" ], [ "stdin" ], [ "init" ], [ "gnutls_malloc" ], [ "stdout" ], [ "gnutls_free" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "alarm" ], [ "", "gnutls_deinit" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "cxa_finalize" ], [ "", "endservent" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_session_get_desc" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gnutls_error_is_fatal" ], [ "", "gnutls_certificate_type_get" ], [ "", "gnutls_session_get_flags" ], [ "", "fgets" ], [ "", "close" ], [ "", "strchr" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_session_set_data" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "strncmp" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "htons" ], [ "", "freeaddrinfo" ], [ "", "fputc" ], [ "", "ntohs" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "strerror" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_record_set_timeout" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_record_recv" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "gnutls_record_set_max_size" ], [ "", "gnutls_x509_crt_list_import2" ], [ "", "abort" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_digest_get_name" ], [ "", "fflush" ], [ "", "dup2" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_hex_encode2" ], [ "", "gnutls_session_is_resumed" ], [ "", "fprintf" ], [ "", "gnutls_group_get_name" ], [ "", "gnutls_ocsp_status_request_enable_client" ], [ "", "getnameinfo" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_certificate_set_retrieve_function" ], [ "", "gnutls_cipher_get_name" ], [ "", "gnutls_dh_params_export2_pkcs3" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "recv" ], [ "", "mktime" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_handshake" ], [ "", "gnutls_hello_set_default_version" ], [ "", "gnutls_global_set_audit_log_function" ], [ "", "gnutls_transport_set_pull_function" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_record_get_max_size" ], [ "", "gnutls_sign_get_name" ], [ "", "putchar" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_cipher_list" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_transport_set_push_function" ], [ "", "gnutls_group_list" ], [ "", "sigaction" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_session_get_data" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_pk_list" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_heartbeat_enable" ], [ "", "gnutls_server_name_set" ], [ "", "gnutls_priority_cipher_list" ], [ "", "setenv" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_global_deinit" ], [ "", "perror" ], [ "", "gnutls_x509_rdn_get" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_heartbeat_allowed" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_kx_list" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "gnutls_heartbeat_pong" ], [ "", "shutdown" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_cipher_suite_info" ], [ "", "gnutls_idna_map" ], [ "", "setsockopt" ], [ "", "strcat" ], [ "", "gnutls_check_version" ], [ "", "gnutls_fips140_mode_enabled" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "reallocarray" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "gnutls_system_recv_timeout" ], [ "", "getservbyname" ], [ "", "optind" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_init" ], [ "", "gnutls_session_channel_binding" ], [ "", "secure_getenv" ], [ "", "atoi" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "fwrite" ], [ "", "strspn" ], [ "", "puts" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "deregister_frame_info" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_dh_get_pubkey" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_rsa_pms_set_version" ], [ "", "gnutls_transport_set_int2" ], [ "", "gnutls_x509_crt_print" ], [ "", "access" ], [ "", "timegm" ], [ "", "gnutls_bye" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_transport_set_pull_timeout_function" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_credentials_set" ], [ "", "getservbyport" ], [ "", "strcasecmp" ], [ "", "vfprintf" ], [ "", "gnutls_certificate_free_credentials" ], [ "", "socket" ], [ "", "libc_start_main" ], [ "", "gnutls_alert_get" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "pipe" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_dh_get_group" ], [ "", "gnutls_alert_get_name" ], [ "", "gnutls_certificate_type_get2" ], [ "", "remove" ], [ "", "memcmp" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "strdup" ], [ "", "gnutls_strerror" ], [ "", "getaddrinfo" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gai_strerror" ], [ "", "gnutls_anon_free_client_credentials" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_record_send_range" ], [ "", "gnutls_record_send_early_data" ], [ "", "gnutls_compression_list" ], [ "", "sprintf" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "connect" ], [ "", "select" ], [ "", "strlen" ], [ "", "gnutls_ocsp_status_request_get" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strtol" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_priority_set_direct" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_transport_set_ptr" ], [ "", "gnutls_record_set_default_version" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_session_get_id" ], [ "", "inet_pton" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_anon_allocate_client_credentials" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "gnutls_pem_base64_encode2" ], [ "", "memmem" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "gmtime_r" ], [ "", "gnutls_record_send" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "optarg" ], [ "", "malloc" ], [ "", "send" ], [ "", "strcmp" ], [ "", "gnutls_certificate_allocate_credentials" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.14, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 104, 3.37, "alloc" ], [ ".dynsym", 1008, 5784, 1.21, "alloc" ], [ ".dynstr", 6792, 4746, 4.4, "alloc" ], [ ".gnu.version", 11538, 482, 1.7, "alloc" ], [ ".gnu.version_r", 12024, 176, 3.21, "alloc" ], [ ".rela.dyn", 12200, 5736, 1.84, "alloc" ], [ ".rela.plt", 17936, 24, 1.14, "alloc,info_link" ], [ ".relr.dyn", 17960, 120, 4.26, "alloc" ], [ ".init", 20480, 3, 1.58, "alloc,executable" ], [ ".plt", 20496, 32, 3.34, "alloc,executable" ], [ ".text", 20528, 37067, 6.12, "alloc,executable" ], [ ".fini", 57595, 3, 1.58, "alloc,executable" ], [ ".rodata", 61440, 20279, 5.88, "alloc" ], [ ".eh_frame_hdr", 81720, 1260, 5.04, "alloc" ], [ ".eh_frame", 82984, 6016, 4.89, "alloc" ], [ ".init_array", 90096, 8, 1.06, "write,alloc" ], [ ".fini_array", 90104, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 90112, 5728, 2.42, "write,alloc" ], [ ".dynamic", 95840, 560, 1.5, "write,alloc" ], [ ".got", 96400, 1904, 0.03, "write,alloc" ], [ ".data", 98304, 544, 3.0, "write,alloc" ], [ ".gnu_debuglink", 98848, 28, 4.04, "" ], [ ".shstrtab", 98876, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 21553.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 241.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 239.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 241.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 37118.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 37118.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 100936.0, "entropy": 5.44, "size_bytes": 100936.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.12, "data_entropy": 1.88, "overlay_size": 1792.0, "string_count": 693.0, "overlay_ratio": 0.02, "overall_entropy": 5.44, "overlay_entropy": 1.54, "entropy_variance": 2.63, "avg_string_length": 35.85, "max_string_length": 1601.0, "peak_region_bytes": 17408.0, "code_to_data_ratio": 0.81, "peak_region_entropy": 6.2, "string_length_stddev": 81.33, "largest_section_ratio": 0.37, "sentence_string_count": 220.0, "sentence_string_ratio": 0.32, "high_entropy_string_count": 0.0 }, "exports": { "count": 7.0 }, "imports": { "count": 233.0 }, "sections": { "count": 28.0, "code_size": 37105.0, "entropy_max": 6.12, "entropy_mean": 2.96, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 5, "mol": "O₃(AlCCo)H₅(Cm₈CrFPoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/gnutls-cli-debug", "risk": 10, "sha": "ec1ce71b34d3917a5761b7fa61293b966f3556b95fb9ece655aaac739c69df7b", "size": 100936, "traits": [ { "id": "objectives/command-and-control/channel/http/message::http-method-get", "atk": "T1071.001", "conf": 0.6000000238418579, "crit": 1, "desc": "Hardcoded GET method string", "spans": [ [ 80208, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 76489, 128 ], [ 76528, 81 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 6808, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 6961, 5 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 11170, 7 ] ] }, { "id": "micro-behaviors/communications/http/get::get", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP GET method", "spans": [ [ 80208, 14 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 7062, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 76489, 128 ], [ 76528, 81 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 7103, 9 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 9419, 4 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "spans": [ [ 11116, 11 ] ] }, { "id": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "conf": 0.699999988079071, "crit": 3, "desc": "GnuTLS function names", "spans": [ [ 7403, 18 ], [ 9405, 18 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 11244, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 9419, 4 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 11007, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 6929, 10 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 76163, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 62313, 11 ], [ 71892, 11 ], [ 74688, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 11346, 5 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "spans": [ [ 63419, 6 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "spans": [ [ 11072, 6 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 76163, 10 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "spans": [ [ 11104, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 11014, 5 ] ] }, { "id": "micro-behaviors/crypto/library/keyword::encrypt-keyword", "conf": 0.4000000059604645, "crit": 3, "desc": "Generic 'encrypt' term in strings", "spans": [ [ 62481, 7 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 11237, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 74610, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 11225, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 11237, 6 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 7062, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 7417, 4 ] ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 11185, 6 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 11007, 6 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 7417, 4 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 7062, 7 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 76163, 10 ], [ 76489, 128 ], [ 76528, 81 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 11244, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 6808, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 76163, 10 ], [ 76489, 128 ], [ 76528, 81 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 6808, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91AD.x.00000kMy=:00000:NYAj0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "ZW!6Ky?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000c0000.0rr92000060000EI69{%1Yb", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "0rr9:0rr9+0rr9=0rr9^0rr9!0rr910000!0rr910000000000000000000F9Gg%", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 945, "z": 3, "cf": 0.800000011920929 } ], "ln": 929 }, { "b": "0S\u0026u4000080000000000wQ4{h0chTVy\u00261310bVp:zeTPe0af8yCWT@\u003ex(mu}x)Ks\u003cB98CzBAdv\u003ey\u0026r*0uUr}(BzkP60aeq%o\u003c.BxA+e($B97#lr82.@z/fb=vpB4:0a]\u003ePBAmC6BAg(8ASyf5A=bx7z#:%3A=bY8zua9Oz/P}1w[C\u003e4B7+LXuVQr$v@2BYxLQ%!vqfJTw[=6)zF]I@ByX%6ASyf5A:%6l0cqZ[B8LM7z/x^#vruB40crm5w]}:7wDlsXAaJ[!uTEtPA+e($B97#luUjs!zdN6*zF0!!B8C@qx(n1", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 9023, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 8962, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Set socket options", "i": "micro-behaviors/communications/socket/options::options-set", "o": 8998, "z": 10, "cf": 0.6600000262260437 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 8856, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 8947, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 8918, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 8833, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 9014, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 8876, "z": 13, "cf": 0.4000000059604645 } ], "ln": 8817 }, { "b": "0a].Sz/YE\u0026B8VelzGGE\u003cv@Dm5wN//ZB98CswO}GPnMnz\u003eA+e($B97#lr82.@z/fb=vpB4:0blsZByf0ez/bL(wO(o}z2^{IvrlH3A=+V2vqfJTuTEw+A=b/5y\u0026r/(BzkVh0crm5v@le+xjVg3x(mF", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 9158, "z": 9, "cf": 0.6600000262260437 }, { "c": 3, "d": "Connect API symbol text", "i": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "o": 9117, "z": 7, "cf": 0.75 }, { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 9177, "z": 11, "cf": 0.5 } ], "ln": 9101 }, { "b": "v@Df\u003cxjVf(C4CYnx(v\u003e?xkR\u003cly\u0026-%7wN/U0wm6y?zE--WzGQ5qB6\u0026)bx(w3aBA}k7wOD3@Bo2@\u003eB-.CvuT%", "n": [ { "c": 3, "d": "SSL/TLS library hook target", "i": "objectives/collection/network/ssl-intercept::ssl-tls-marker", "o": 9673, "z": 18, "cf": 0.800000011920929 } ], "ln": 9657 }, { "b": "uWaBZiriYfB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuVZr%zGx=nA=+VfwD", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 10668, "z": 9, "cf": 1.0 } ], "ln": 10652 }, { "b": "uTW+ZA=+V3wPRo%vqPMQxkR\u003cly\u0026-%7wN/U0wm6v*v%d\u0026+zGQ5qB6\u0026A*A==2cx\u003e7N[wNxQ(A+Pc1v{%E[z/b", "n": [ { "c": 3, "d": "GnuTLS function names", "i": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "o": 12275, "z": 18, "cf": 0.699999988079071 } ], "ln": 12259 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuT)U/Bzku3v{%E\u003cuVP!2uV{13x\u003ezS$w=", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 12885, "z": 9, "cf": 1.0 } ], "ln": 12869 }, { "b": "z#:%3A==ko0cqZYB-I52xjVf@zGV1(B97\u0026j0a{s:y\u002611\u0026w].D\u003ewb{jMA=M8s0cqZ[C4bPa0b3d\u003cx(dA*ASyf0v@2T$0bcE)zGt!\u003cvqf7\u0026BAg@kA=k%#z/x/jzE--^x(ER-B7]o8vqC{Qz/PQ[B7Gf0v@}Y(ByY960crm5B8V0%y\u0026r/(y\u0026\u003cxdwNxDTB7]n#ze:PxB7GB[xjVf[wmPZ{zF0!!xjVg5vqPN\u0026zF0!!woz\u0026D0aP?Rvrb}1ASyl1B7GD8zGV23ADld3B7/Yrwn=Wf0crl)z/{d4w]I)mv/QaWB-.W8xjVg7vrlF\u0026BzkP6xkES\u003cDuiUt0b(*#vrb#XxjVgawPz%6D2v5cwDldPvrch+xjVg6AcbD6z/fg/wQ4=@C5NB[CxdztwDl^=xjkp(x(v\u003e?uUj1\u0026x-J0=BzkP60a{m.wNPaWA+PA6zVBu^wohq", "n": [ { "c": 3, "d": "Converts host to network short", "i": "micro-behaviors/communications/ip/parse::htons-symbol", "o": 15086, "z": 5, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getaddrinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "o": 15173, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "Resolve endpoint with getnameinfo", "i": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "o": 15185, "z": 11, "cf": 0.6600000262260437 }, { "c": 3, "d": "I/O multiplexing on sockets", "i": "micro-behaviors/communications/socket/multiplex::multiplex", "o": 15129, "z": 6, "cf": 0.6600000262260437 }, { "c": 3, "d": "Socket API symbol text", "i": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "o": 15079, "z": 6, "cf": 0.75 }, { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 15036, "z": 5, "cf": 0.800000011920929 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 15313, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 15253, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 15301, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 15049, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 15241, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 15320, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 15029, "z": 6, "cf": 0.4000000059604645 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 15211, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler (POSIX sigaction)", "i": "micro-behaviors/os/signal/handler::sigaction", "o": 15327, "z": 9, "cf": 0.8999999761581421 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 15117, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 15197, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 15124, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 15070, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 15150, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Schedule alarm timer", "i": "micro-behaviors/time/schedule/timeout/alarm::alarm", "o": 15295, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 15112, "z": 4, "cf": 0.8500000238418579 } ], "ln": 15013 }, { "b": "vTh{hA=.q8w]I^8zGGE\u003czGG/gA@ZobB7ocaw=M\u003c.vqG:#v{%y#vr?\u0026?x\u003c$Z)B-.Cve]$}-gCw/Bx\u003c$N8zfo]oeQflkuP6.[B8JV=07P^:r7{j$gHA7FfAsQrrA8T\u003cuO=4EuOKt", "n": [ { "c": 3, "d": "Converts network to host short", "i": "micro-behaviors/communications/ip/parse::ntohs-symbol", "o": 15422, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Query system configuration information", "i": "micro-behaviors/os/sysinfo/config::sysconf", "o": 15428, "z": 7, "cf": 0.4000000059604645 }, { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 15475, "z": 6, "cf": 0.30000001192092896 } ], "ln": 15406 }, { "b": "y?aVaz/^auAaJ]fc36y[lQ:)LnK=osk#ZnMwPz*fA:6\u00262t@\u003c8OA%.[+zY\u0026L3A==2cx\u003e7N[wPF%", "n": [ { "c": 2, "d": "X.509 certificate handling (legitimate)", "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "o": 77886, "z": 11, "cf": 0.800000011920929 } ], "ln": 77870 }, { "b": "q=1PSwPI*ezGxwiw]zYjv}xX5x\u003ez6?vru66c3oK{wPz*fAV/1aBAzkmxco#qq=1PSwPI*ezGxv", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 78024, "z": 11, "cf": 0.5 } ], "ln": 78008 }, { "b": "04GDFaxA5]x\u003ezT8zF77uCwhejawUv6p:)JdwPz%9AV!\u003e6A==2cx\u003e7N[wGUF@vqfQ4", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78428, "z": 4, "cf": 0.800000011920929 } ], "ln": 78412 }, { "b": "z/Z1yc37hyB0bmoz*c7wvqYP#x(\u003eFiB0a[jB8LM5vru6\u003eaA}KwxDQ.awnbT/wPzt", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78758, "z": 3, "cf": 0.800000011920929 } ], "ln": 78742 }, { "b": "C}GB7nPV7(x\u003eIa3ayX[8Bzb98aARpdaAIamC4CXpxKL%8zfoVpx(E)1azULlB1wCL", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78814, "z": 4, "cf": 0.800000011920929 } ], "ln": 78798 }, { "b": "e^.ODzY\u003cszBS+^DB-RTEBzbkdA+e-(x)a5#azULlkoIw1fhr@Saol4(B-.CvuV]#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 78926, "z": 3, "cf": 0.800000011920929 } ], "ln": 78910 }, { "b": "aAIamC4CXPash7Ye?NFhm[3x1fc$VZnk@L+fek7k4gkTAB96C=c36I5l1szoAcab-dLAmX3pw-HzE)s1", "n": [ { "c": 3, "d": "Manual dynamic HTTP/1.0 GET", "i": "micro-behaviors/communications/http/get::manual-http10-dynamic-get", "o": 79763, "z": 16, "cf": 0.8999999761581421 } ], "ln": 79747 }, { "b": "ay/tbAbo9cwN(bFdK([\u003cra]#!azC)tvixP4B9hthwft@8B8#5lzvcwjA=M8sazCZo", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 80033, "z": 4, "cf": 0.800000011920929 } ], "ln": 80017 }, { "b": "wmP4^A=lbnwmY^xash7elUgpWx\u003ez6?vru66vqG:#v{%E[z/cXmwO(vaC{3WsA=k$9090#YB95J", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 80976, "z": 11, "cf": 0.5 } ], "ln": 80960 }, { "b": "wPz*fATz!Fvrcm1zF80MBzbxfaAI*HBy/qiwn=42zyoJGB9hCvz/P}xvix8(w)]*#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 81058, "z": 4, "cf": 0.800000011920929 } ], "ln": 81042 }, { "b": "A=k$vB7GDnx(mMaBzbkdCR}fnaARTDB95Kpx(4uwash7o08NYOv}x.5wN(]fwfsl9", "n": [ { "c": 2, "d": "x509 string reference", "i": "micro-behaviors/crypto/certificate/usage::x509-string", "o": 81127, "z": 4, "cf": 0.6000000238418579 } ], "ln": 81111 }, { "b": "dO8#]qDb$Kk#Yr-08vCPxK$Q)ByF/\u0026BrCpnaARphB0bKnB8#5lzvcw.x(mMAash7o04/r\u0026wD", "n": [ { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 82254, "z": 9, "cf": 1.0 } ], "ln": 82238 }, { "b": "aAImywJy}Wwftt}BAm=?lUQHMwPw]mB.L@eB0b7kAV=VH3ihw7h867TfNa($gi+t)fN9", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 82817, "z": 6, "cf": 0.5 } ], "ln": 82801 }, { "b": "B2\u003eAzm]Ab.p+r#m08MruB7]o8vruTjwPG)P08(DVpaW=k07gEtxK#ibB9hhswPG)t00#qfC{0", "n": [ { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 82957, "z": 10, "cf": 1.0 } ], "ln": 82941 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 84452, "z": 10, "cf": 0.949999988079071 } ], "ln": 84436 }, { "b": "c37B^3ijKDzEWu%vrccnv}/)}wPxzk0bls\u0026B-X-HjS)H1oItC0zGQ5qB6\u0026%9wgf@yrA5", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 86109, "z": 6, "cf": 0.4000000059604645 } ], "ln": 86093 }, { "b": "xcoGek%#\u00269x(E-%A=S=OAaa3dz^^f0B7]@iiV].\u003e3igA2xK$W?x(mMav}/)}wPxv%k%(:", "n": [ { "c": 1, "d": "payload keyword", "i": "objectives/command-and-control/dropper/keywords::payload", "o": 86448, "z": 7, "cf": 0.6000000238418579 } ], "ln": 86432 }, { "b": "lQTEleMbIkiX9M$qDujrstz-\u003ef/YkepFKttd]]8pq.p%xq.Y)XiX9G+q.oZVi4WS/o/-", "n": [ { "c": 3, "d": "X25519 key exchange marker", "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "o": 88123, "z": 6, "cf": 0.8799999952316284 } ], "ln": 88107 }, { "b": "aAIamC4CXPash7Ye?NFhp!$1?atk3Zav]Ehp+KKQfBXvWz/Z1Yash7r3pefiwPh-LasY2]4gkEvzGGDcBs*EqAaI6Mvq{g4x\u003e7N[x(v(xz!0\u003ccePLAxB.bSo4gkEvzGGB", "n": [ { "c": 3, "d": "Native HTTP POST request line", "i": "micro-behaviors/communications/http/post::native-post-request-line", "o": 88567, "z": 17, "cf": 0.8199999928474426 }, { "c": 1, "d": "Content-Type header string", "i": "micro-behaviors/communications/http/request/client::content-type-header", "o": 88609, "z": 13, "cf": 0.5 } ], "ln": 88551 }, { "b": "z!\u0026]{ayPvmc36y[dK([\u003cra]?=pEw5SaAz4mAbPSnwGUYdaA87basICxB0bgrB9h3", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 89072, "z": 3, "cf": 0.800000011920929 } ], "ln": 89056 }, { "b": "az\u003eXbz/QaCw]zYjc36y[xkR\u003cly\u0026.gry?U1zav*r(r7{jkv@b\u003c\u003czGDj=B75Y)iV]LTzGQ5qB1H)rx={R5eJ^SYvp}+DtrE7qy^8bED($0)jz[OAwJ\u003csBj:Xx2jA+dHk3Yppe?O+0twd}@Bz+J7wNbSIph+2YiTMiparSmDefDI@wmYj)xfycPz6f@zarR^HarR^HavQfRvR/P#wmYj)xj\u003e{@x9[}K", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 89467, "z": 128, "cf": 0.9399999976158142 } ], "ln": 89451 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 95136, "z": 9, "cf": 0.9399999976158142 } ], "ln": 95120 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 95198, "z": 3, "cf": 0.699999988079071 } ], "ln": 95182 }, { "b": "B-.CveN@QhatUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 96355, "z": 9, "cf": 0.6000000238418579 } ], "ln": 96339 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 96546, "z": 9, "cf": 0.699999988079071 } ], "ln": 96530 }, { "b": "00000000000000000000eIeLaeKz(@nLQx}mn^8RmOb%kr7ew\u003ceIeKYo?v]zi7cb3k#}Yjl3C)!l1-+Xs7tAbxlXhVo)g2\u003cl@v8Vok!09xM^(Xk#y6AlqZ3)m0.o%o*J?\u003ck}#wd3pe]hmnU:cBwm6Exgv80CU.pcCtgFrCUHO6g!*}M", "n": [ { "c": 3, "d": "Dense base64-encoded content", "i": "objectives/anti-static/obfuscation/encoding/base64::dense-base64-encoding", "o": 119004, "z": 64, "cf": 0.8500000238418579 }, { "c": 2, "d": "File contains a PEM-encoded certificate.", "i": "micro-behaviors/crypto/certificate/usage::has-pem-certificate", "o": 118976, "z": 10, "cf": 1.0 } ], "ln": 118960 }, { "b": "rbji:r=rgIr7fFPl2e%$k}#wdl3M9\u003eqzy:!t53unlt6}JxI?F{k#y6qk#ZcHlt6!FxI?F\u003el1%gZlt6}JxI?F{k#y6rl1-}Xk%Xym3q9s1o*}G}fIkzbqfbX]vNLiYv\u003eZ\u003eSv}]4SiA/u(A5p72o(%rEo!f1nxl=*lA-U)\u0026Dq4c)nQr{gq=)^yi0}D2gF@f+pGqNGst%hrr8)Y\u003eC#V.gpEn!}lQCH4k$%WUpf6[-o*RcTi7lbFk%XjiqaA]brB!J}qbf?KBWDH6s9O)\u003egdDs[m(+)al{T^sxhhF#q=MmOl{TEjxj(lKxgkoRqdA0Wr6:tExhhF#q8*)dw\u0026JjCqb6CBg^Kzmo*QK7k}#wIl$Yv#lpaKLq:\u003e!sCxl]cBz:(]hD:DAzGE\u003caxgtY+qeeyelt64]nk\u0026kKm)]TAxf]MPAy\u003cqp3rYq@yEQS=xjLTmltZEqgb*\u003cRfMIF9pc@PeACfc4m(+=Elp1E\u0026mNosolQs\u003czk#GyYBA/-ss4b}uol\u003c9Po:SZ[sw9g7C#VW@C4AKev}P^Ji5k+SfedrPAA1!\u0026p\u0026x=Cm0qmDqDDp%qf3@dBxR6*yI=%Hzbt7!f)dkfw[8fmvO*VmzC$X1l%9@hhFE2FfFuAXfh$$9lpJ+OA8M", "n": [ { "c": 3, "d": "Dense base64-encoded content", "i": "objectives/anti-static/obfuscation/encoding/base64::dense-base64-encoding", "o": 119134, "z": 64, "cf": 0.8500000238418579 } ], "ln": 119118 }, { "b": "mS-5{Bv4=lx(lHrg=n}NeIeLaeK-A5avwN}r7PLJlQsWueIeLaeEzET0000000000eIeLaeKz(@nLQy8qB%[Pr7d{5moIh]eIeKYo*@XZk#x{(noXidok:", "n": [ { "c": 2, "d": "PEM begin marker", "i": "micro-behaviors/crypto/certificate/usage::pem-begin", "o": 120064, "z": 10, "cf": 0.699999988079071 }, { "c": 2, "d": "PEM end marker", "i": "micro-behaviors/crypto/certificate/usage::pem-end", "o": 120028, "z": 8, "cf": 0.699999988079071 } ], "ln": 120012 }, { "b": "mqU^\u003ez.VJ7fN336wP6ZseIeLaeK-A5aw+%crZxXNawkdaeIeLaeEzET001P5eIeLvmmP{A", "n": [ { "c": 2, "d": "PEM end marker", "i": "micro-behaviors/crypto/certificate/usage::pem-end", "o": 120194, "z": 8, "cf": 0.699999988079071 } ], "ln": 120178 }, { "b": "00000000000000000000eIeLaeKz(@nLQx%lM/i6nMFbRmiCk(sUhiSeIdr7nm$pQqai]Bqa7", "n": [ { "c": 2, "d": "PEM begin marker", "i": "micro-behaviors/crypto/certificate/usage::pem-begin", "o": 121696, "z": 10, "cf": 0.699999988079071 } ], "ln": 121680 }, { "b": "s2r/Mw]hm8vTpy4n(X1YeIeLaeK-A5avOTup/o\u003e=k#Zn}ogq#neIeLa3ig5a0000000000", "n": [ { "c": 2, "d": "PEM end marker", "i": "micro-behaviors/crypto/certificate/usage::pem-end", "o": 121894, "z": 8, "cf": 0.699999988079071 } ], "ln": 121878 }, { "b": "00000000000000000000eIeLaeKz(@nLQyaq:zK5qB%[Pr7d{5moIh]eIeKYo?v]Dhd]GEk%Xdhl0lSxh+=RJx\u0026vGmzCtd{x\u0026)g", "n": [ { "c": 3, "d": "Embedded PEM RSA private key block", "i": "micro-behaviors/crypto/asymmetric/rsa::pem-private-key-embedded", "o": 121952, "z": 31, "cf": 0.949999988079071 } ], "ln": 121936 }, { "b": "swqt5swq!kk}+(Eo\u0026\u003c7SeIeLaeK-A5aw#c7aw+%crZxXNawkdaeIeLaeEzET0000JeIeLa", "n": [ { "c": 2, "d": "PEM end marker", "i": "micro-behaviors/crypto/certificate/usage::pem-end", "o": 124381, "z": 8, "cf": 0.699999988079071 } ], "ln": 124365 }, { "b": "eIeKY00000hAH{t00000xkR\u003cly\u0026.gry?UIjwNY^{000006Z\u0026$l04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026H", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 127648, "z": 16, "cf": 1.0 } ], "ln": 127632 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 127747, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 127739, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 127721, "z": 7, "cf": 0.8999999761581421 } ], "ln": 127705 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 127900, "z": 8, "cf": 0.8999999761581421 } ], "ln": 127884 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "stderr" ], [ "fini" ], [ "gnutls_strdup" ], [ "init" ], [ "gnutls_malloc" ], [ "stdin" ], [ "gnutls_free" ] ], "imp": [ [ "", "printf" ], [ "", "exit" ], [ "", "alarm" ], [ "", "gnutls_deinit" ], [ "", "gnutls_ocsp_resp_init" ], [ "", "gnutls_get_library_config" ], [ "", "gnutls_hex_decode" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "gnutls_hmac_fast" ], [ "", "memmove" ], [ "", "gnutls_ocsp_resp_check_crt" ], [ "", "gnutls_session_get_data2" ], [ "", "cxa_finalize" ], [ "", "endservent" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_certificate_set_x509_key_mem" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "gnutls_certificate_set_retrieve_function2" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_session_get_desc" ], [ "", "fread" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gnutls_error_is_fatal" ], [ "", "setbuf" ], [ "", "gnutls_certificate_type_get" ], [ "", "gnutls_session_get_flags" ], [ "", "fgets" ], [ "", "close" ], [ "", "strchr" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_session_set_data" ], [ "", "gnutls_hmac" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "strncmp" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "htons" ], [ "", "freeaddrinfo" ], [ "", "fputc" ], [ "", "ntohs" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "gnutls_cipher_get_iv_size" ], [ "", "strerror" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_record_set_timeout" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_aead_cipher_init" ], [ "", "gnutls_ocsp_resp_import" ], [ "", "gnutls_ocsp_resp_get_single" ], [ "", "gnutls_certificate_set_verify_flags" ], [ "", "gnutls_record_recv" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "gnutls_record_set_max_size" ], [ "", "gnutls_x509_crt_list_import2" ], [ "", "abort" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_digest_get_name" ], [ "", "gnutls_perror" ], [ "", "sysconf" ], [ "", "fflush" ], [ "", "gnutls_ocsp_req_export" ], [ "", "gnutls_cipher_deinit" ], [ "", "dup2" ], [ "", "gnutls_record_can_use_length_hiding" ], [ "", "gnutls_certificate_set_x509_crl_file" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_hex_encode2" ], [ "", "gnutls_session_is_resumed" ], [ "", "gnutls_alert_send_appropriate" ], [ "", "gnutls_psk_set_client_credentials" ], [ "", "fprintf" ], [ "", "gnutls_group_get_name" ], [ "", "getnameinfo" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_verify_stored_pubkey" ], [ "", "gnutls_cipher_get_name" ], [ "", "gnutls_aead_cipher_encrypt" ], [ "", "gnutls_certificate_set_pin_function" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "gnutls_x509_crt_list_import" ], [ "", "gnutls_ocsp_req_add_cert" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "gnutls_get_system_config_file" ], [ "", "recv" ], [ "", "gnutls_hmac_deinit" ], [ "", "mktime" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_handshake" ], [ "", "gnutls_x509_crt_set_pin_function" ], [ "", "gnutls_transport_set_pull_function" ], [ "", "fstat" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_dh_set_prime_bits" ], [ "", "fileno" ], [ "", "gnutls_sign_get_name" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_ocsp_req_deinit" ], [ "", "gnutls_cipher_list" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_transport_set_push_function" ], [ "", "gnutls_group_list" ], [ "", "sigaction" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "setvbuf" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_pcert_import_x509" ], [ "", "gnutls_alpn_set_protocols" ], [ "", "gnutls_certificate_set_flags" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_url_is_supported" ], [ "", "gnutls_transport_set_errno" ], [ "", "gnutls_pk_list" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_heartbeat_enable" ], [ "", "gnutls_server_name_set" ], [ "", "gnutls_hmac_init" ], [ "", "gnutls_priority_cipher_list" ], [ "", "gnutls_session_key_update" ], [ "", "gnutls_cipher_init" ], [ "", "setenv" ], [ "", "gnutls_privkey_set_pin_function" ], [ "", "gnutls_pkcs11_init" ], [ "", "gnutls_ocsp_resp_verify_direct" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_cipher_get_tag_size" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_global_deinit" ], [ "", "perror" ], [ "", "gnutls_x509_rdn_get" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_certificate_get_issuer" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_kx_list" ], [ "", "gnutls_hmac_get_key_size" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "read" ], [ "", "gnutls_heartbeat_pong" ], [ "", "shutdown" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_cipher_suite_info" ], [ "", "gnutls_idna_map" ], [ "", "gnutls_x509_crt_get_authority_info_access" ], [ "", "setsockopt" ], [ "", "gnutls_dtls_set_mtu" ], [ "", "gnutls_check_version" ], [ "", "gnutls_fips140_mode_enabled" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "reallocarray" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "gnutls_system_recv_timeout" ], [ "", "getservbyname" ], [ "", "optind" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_init" ], [ "", "gnutls_psk_allocate_client_credentials" ], [ "", "gnutls_session_channel_binding" ], [ "", "secure_getenv" ], [ "", "gnutls_rnd" ], [ "", "atoi" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "fwrite" ], [ "", "strspn" ], [ "", "gnutls_ocsp_req_set_nonce" ], [ "", "puts" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_cipher_get_key_size" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "deregister_frame_info" ], [ "", "ferror" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_anon_free_server_credentials" ], [ "", "gnutls_x509_trust_list_init" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_transport_set_int2" ], [ "", "gnutls_x509_crt_print" ], [ "", "gnutls_record_check_pending" ], [ "", "timegm" ], [ "", "gnutls_handshake_set_timeout" ], [ "", "gnutls_bye" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_transport_set_pull_timeout_function" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_hex_encode" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_credentials_set" ], [ "", "getservbyport" ], [ "", "strcasecmp" ], [ "", "vfprintf" ], [ "", "gnutls_certificate_free_credentials" ], [ "", "socket" ], [ "", "libc_start_main" ], [ "", "gnutls_alert_get" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "gnutls_ocsp_resp_get_nonce" ], [ "", "pipe" ], [ "", "gnutls_certificate_set_verify_function" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_certificate_set_trust_list" ], [ "", "gnutls_dh_get_group" ], [ "", "gnutls_aead_cipher_deinit" ], [ "", "gnutls_alert_get_name" ], [ "", "gnutls_certificate_type_get2" ], [ "", "memcmp" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "gnutls_privkey_import_url" ], [ "", "gnutls_ocsp_req_init" ], [ "", "strdup" ], [ "", "gnutls_ocsp_resp_deinit" ], [ "", "gnutls_strerror" ], [ "", "gnutls_priority_set" ], [ "", "getaddrinfo" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gai_strerror" ], [ "", "gnutls_anon_free_client_credentials" ], [ "", "gnutls_ocsp_resp_print" ], [ "", "sigemptyset" ], [ "", "gnutls_ocsp_status_request_get2" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_privkey_init" ], [ "", "gnutls_set_default_priority" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "sqrt" ], [ "", "gnutls_load_file" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_record_send_range" ], [ "", "gnutls_record_send_early_data" ], [ "", "gnutls_srtp_set_profile_direct" ], [ "", "gnutls_compression_list" ], [ "", "gnutls_cipher_encrypt2" ], [ "", "gnutls_psk_set_client_credentials_function" ], [ "", "sprintf" ], [ "", "gnutls_x509_crt_import_url" ], [ "", "gnutls_pkcs11_add_provider" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "connect" ], [ "", "select" ], [ "", "strlen" ], [ "", "gnutls_store_pubkey" ], [ "", "ITM_registerTMCloneTable" ], [ "", "strtol" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_record_recv_packet" ], [ "", "gnutls_priority_set_direct" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_transport_set_ptr" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_x509_trust_list_add_trust_file" ], [ "", "gnutls_priority_string_list" ], [ "", "gnutls_session_get_id" ], [ "", "clearerr" ], [ "", "inet_pton" ], [ "", "gnutls_x509_trust_list_add_system_trust" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_anon_allocate_client_credentials" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "gnutls_pem_base64_encode2" ], [ "", "memmem" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "gnutls_x509_trust_list_set_getissuer_function" ], [ "", "ftello" ], [ "", "gmtime_r" ], [ "", "gnutls_record_send" ], [ "", "assert_fail" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "gnutls_psk_free_client_credentials" ], [ "", "gnutls_privkey_import_x509_raw" ], [ "", "optarg" ], [ "", "gnutls_packet_deinit" ], [ "", "malloc" ], [ "", "send" ], [ "", "strcmp" ], [ "", "gnutls_certificate_allocate_credentials" ], [ "", "gnutls_transport_set_fastopen" ], [ "", "gnutls_anon_allocate_server_credentials" ], [ "", "getline" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.25, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 104, 3.93, "alloc" ], [ ".dynsym", 1008, 7824, 1.23, "alloc" ], [ ".dynstr", 8832, 6811, 4.38, "alloc" ], [ ".gnu.version", 15644, 652, 1.67, "alloc" ], [ ".gnu.version_r", 16296, 208, 3.21, "alloc" ], [ ".rela.dyn", 16504, 7776, 1.89, "alloc" ], [ ".rela.plt", 24280, 24, 1.22, "alloc,info_link" ], [ ".relr.dyn", 24304, 112, 3.75, "alloc" ], [ ".init", 24576, 3, 1.58, "alloc,executable" ], [ ".plt", 24592, 32, 3.34, "alloc,executable" ], [ ".text", 24624, 50444, 6.22, "alloc,executable" ], [ ".fini", 75068, 3, 1.58, "alloc,executable" ], [ ".rodata", 77824, 23479, 5.54, "alloc" ], [ ".eh_frame_hdr", 101304, 972, 5.03, "alloc" ], [ ".eh_frame", 102280, 5672, 4.96, "alloc" ], [ ".init_array", 110480, 8, 1.06, "write,alloc" ], [ ".fini_array", 110488, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 110496, 5152, 2.21, "write,alloc" ], [ ".dynamic", 115648, 560, 1.51, "write,alloc" ], [ ".got", 116208, 2576, 0.02, "write,alloc" ], [ ".data", 118784, 8864, 6.0, "write,alloc" ], [ ".gnu_debuglink", 127648, 24, 4.0, "" ], [ ".shstrtab", 127672, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 30577.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 326.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 324.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 326.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 50495.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 489864.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 129736.0, "entropy": 5.75, "size_bytes": 129736.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.22, "data_entropy": 3.81, "overlay_size": 1796.0, "string_count": 1229.0, "overlay_ratio": 0.01, "overall_entropy": 5.75, "overlay_entropy": 1.57, "entropy_variance": 2.92, "avg_string_length": 34.56, "max_string_length": 6422.0, "peak_region_bytes": 38912.0, "code_to_data_ratio": 0.75, "peak_region_entropy": 6.24, "string_length_stddev": 185.53, "largest_section_ratio": 0.39, "sentence_string_count": 358.0, "sentence_string_ratio": 0.29, "high_entropy_string_count": 0.0 }, "exports": { "count": 8.0 }, "imports": { "count": 317.0 }, "sections": { "count": 28.0, "code_size": 50482.0, "entropy_max": 6.22, "entropy_mean": 3.07, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 2.0 } } }, "id": 6, "mol": "O₄(AlAs₂CCo)H₅(Cm₉Cr₂F₂PoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/gnutls-cli", "risk": 11, "sha": "0df5960a40025c2a67ad86632f26d7c73ec0889b52735766dbfcc11a40090486", "size": 129736, "traits": [ { "id": "micro-behaviors/crypto/asymmetric/rsa::pem-private-key-embedded", "conf": 0.949999988079071, "crit": 3, "desc": "Embedded PEM RSA private key block", "spans": [ [ 121952, 31 ] ] }, { "id": "objectives/command-and-control/channel/http/message::http-method-post", "atk": "T1071.001", "conf": 0.6499999761581421, "crit": 1, "desc": "Hardcoded POST method string", "spans": [ [ 88567, 6 ] ] }, { "id": "objectives/command-and-control/channel/http/message::http-method-get", "atk": "T1071.001", "conf": 0.6000000238418579, "crit": 1, "desc": "Hardcoded GET method string", "spans": [ [ 79763, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 8856, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 9023, 5 ] ] }, { "id": "micro-behaviors/communications/http/get::manual-http10-dynamic-get", "conf": 0.8999999761581421, "crit": 3, "desc": "Manual dynamic HTTP/1.0 GET", "spans": [ [ 79763, 16 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.699999988079071, "crit": 2, "desc": "PEM begin marker", "spans": [ [ 118976, 10 ], [ 120064, 10 ], [ 121696, 10 ], [ 121952, 10 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 15253, 7 ] ] }, { "id": "micro-behaviors/communications/http/get::get", "conf": 0.699999988079071, "crit": 3, "desc": "HTTP GET method", "spans": [ [ 79763, 16 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::connect-symbol-text", "conf": 0.75, "crit": 3, "desc": "Connect API symbol text", "spans": [ [ 9117, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 9158, 9 ] ] }, { "id": "micro-behaviors/communications/socket/receive::_recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _recv socket call", "spans": [ [ 12289, 4 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6000000238418579, "crit": 2, "desc": "x509 string reference", "spans": [ [ 81127, 4 ] ] }, { "id": "micro-behaviors/communications/http/post::native-post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.8199999928474426, "crit": 3, "desc": "Native HTTP POST request line", "spans": [ [ 88567, 17 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getnameinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getnameinfo", "spans": [ [ 15185, 11 ] ] }, { "id": "objectives/collection/network/ssl-intercept::ssl-gnutls-fn", "conf": 0.699999988079071, "crit": 3, "desc": "GnuTLS function names", "spans": [ [ 9673, 18 ], [ 12275, 18 ] ] }, { "id": "objectives/command-and-control/channel/http/message::http-delimiter", "atk": "T1071.001", "crit": 1, "desc": "HTTP header syntax marker", "spans": [ [ 88576, 16 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 15320, 6 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.699999988079071, "crit": 2, "desc": "PEM end marker", "spans": [ [ 120028, 8 ], [ 120194, 8 ], [ 121894, 8 ], [ 124381, 8 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/receive::recv-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses recv socket call", "spans": [ [ 12289, 4 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 15049, 5 ] ] }, { "id": "micro-behaviors/communications/http/post::post-request-line", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7799999713897705, "crit": 3, "desc": "HTTP POST request line", "spans": [ [ 88567, 17 ] ] }, { "id": "micro-behaviors/communications/socket/tcp::socket-symbol-text", "conf": 0.75, "crit": 3, "desc": "Socket API symbol text", "spans": [ [ 15079, 6 ] ] }, { "id": "micro-behaviors/communications/socket/options::options-set", "conf": 0.6600000262260437, "crit": 3, "desc": "Set socket options", "spans": [ [ 8998, 10 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 15049, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 84452, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 77886, 11 ], [ 78024, 11 ], [ 80976, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::ntohs-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts network to host short", "spans": [ [ 15422, 5 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "spans": [ [ 88123, 6 ] ] }, { "id": "micro-behaviors/fs/file/read::read", "conf": 0.699999988079071, "crit": 2, "desc": "Read file descriptor (read/pread)", "spans": [ [ 15050, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/encoding/base64::dense-base64-encoding", "atk": "T1027.001", "conf": 0.8500000238418579, "crit": 3, "desc": "Dense base64-encoded content", "spans": [ [ 119004, 64 ], [ 119134, 64 ], [ 119199, 64 ], [ 119264, 64 ], [ 119329, 64 ], [ 119394, 64 ], [ 119459, 64 ], [ 119524, 64 ] ] }, { "id": "micro-behaviors/communications/socket/multiplex::select-multiplex", "crit": 3, "desc": "select() I/O multiplexing", "spans": [ [ 15129, 6 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 84452, 10 ] ] }, { "id": "micro-behaviors/communications/ip/resolve::resolve-getaddrinfo", "conf": 0.6600000262260437, "crit": 3, "desc": "Resolve endpoint with getaddrinfo", "spans": [ [ 15173, 11 ] ] }, { "id": "micro-behaviors/communications/ip/parse::htons-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Converts host to network short", "spans": [ [ 15086, 5 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 15313, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 82957, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 15301, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 15313, 6 ] ] }, { "id": "micro-behaviors/communications/socket/connect::connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses connect socket call", "spans": [ [ 9117, 7 ] ] }, { "id": "micro-behaviors/communications/socket/send::send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses send socket call", "spans": [ [ 9687, 4 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/code-in-data::base64-in-rodata", "conf": 0.800000011920929, "crit": 3, "desc": "Base64 data in rodata", "spans": [ [ 119004, 64 ], [ 119134, 64 ], [ 119199, 64 ], [ 119264, 64 ], [ 119329, 64 ], [ 119394, 64 ], [ 119459, 64 ], [ 119524, 64 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/communications/socket/listen::socket-sym", "mbc": "C0001", "conf": 0.4000000059604645, "crit": 3, "desc": "socket function symbol", "spans": [ [ 15079, 6 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 15036, 5 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/communications/socket/send::_send-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _send socket call", "spans": [ [ 9687, 4 ] ] }, { "id": "micro-behaviors/communications/socket/connect::_connect-symbol", "atk": "T1071", "mbc": "C0001", "conf": 0.6600000262260437, "crit": 3, "desc": "Uses _connect socket call", "spans": [ [ 9117, 7 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 15049, 5 ], [ 15050, 4 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 84452, 10 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 15320, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 8856, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 84452, 10 ], [ 89467, 128 ], [ 89494, 75 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 8856, 12 ] ] } ], "type": "elf" }, { "ctx": [ { "b": "E))420S-r400000000000@$H+0rr91uvS1Q00000kMy=:00000PV3%j0000000000kMA+z4feS[8#{]T1][S61o", "n": [ { "c": 3, "d": "Strips toolchain banner but retains build-id", "i": "metadata/build/artifact::aggressive-strip", "o": 0, "z": 1, "cf": 1.0 } ], "ln": 0 }, { "b": "!Rb$oy?Wuiy?bbmB-RvJCSmP*hz^4cz.r:A0000C0001O0rr93000070000401{Xt0F7", "n": [ { "c": 3, "d": "Architecture detection strings", "i": "objectives/discovery/host/software::arch-detection", "o": 889, "z": 6, "cf": 0.5 } ], "ln": 873 }, { "b": "UMs!80000g0000000000wQ4{h0chTVy\u00261310af8yCWT@\u003ex(mu}x)Ks\u003cB98CzBAdv[A+eV\u00260aeq%o\u003c.BxA+e($B97#lr82.@z/fb=vpB4:0a]\u003ePBAmC6BAhnezeYF@BAhnnwO}GRvScpe0a]?VB-Ri@uTE\u003e@vpK7Wv}YT+w)]y\u00260crl)wPz!\u003eB98CjAcRC8BAg#nx(dzYw]zT1zua3JwmY^)xk8BewPzc\u0026A:-/@uUKy\u0026zVB\u0026@Ab]VgBn", "n": [ { "c": 4, "d": "Sets LD_PRELOAD hooks to hide filesystem", "i": "objectives/evasion/kernel-hide/userspace::preload-rootkit-hook-set", "o": 11265, "z": 5, "cf": 0.9200000166893005 }, { "c": 3, "d": "Stack protector/canary enabled", "i": "metadata/hardening/build::stack-protector", "o": 11227, "z": 14, "cf": 0.8999999761581421 }, { "c": 3, "d": "Benign network-capable library context", "i": "objectives/supply-chain/trojanized/backdoor::benign-network-library-context", "o": 11136, "z": 12, "cf": 0.8999999761581421 }, { "c": 2, "d": "Generic file read/write operations", "i": "micro-behaviors/fs/file/read-write::binary-file-ops", "o": 11156, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Abort program execution", "i": "micro-behaviors/os/signal/handler::abort", "o": 11212, "z": 5, "cf": 0.8999999761581421 }, { "c": 2, "d": "Line-based file reading (fgets)", "i": "micro-behaviors/process/create/direct::fgets-loop", "o": 11190, "z": 5, "cf": 1.0 }, { "c": 2, "d": "Terminates process immediately without cleanup", "i": "micro-behaviors/process/terminate/signal::_exit", "o": 11121, "z": 4, "cf": 0.4000000059604645 }, { "c": 2, "d": "Format time as string", "i": "micro-behaviors/time/query::strftime", "o": 11256, "z": 8, "cf": 0.20000000298023224 } ], "ln": 11105 }, { "b": "x(mK30crm5v{%B\u0026v@le+w]?J{yxd%Ry\u0026sxa0crm5y?mF:uRai\u003euVGZ\u003cx(!xcA-t+2yY", "n": [ { "c": 3, "d": "Binary file read/write operations", "i": "micro-behaviors/fs/file/binary::binary-read-write-ops", "o": 11337, "z": 5, "cf": 0.699999988079071 } ], "ln": 11321 }, { "b": "wMi8Ey?iP-wO(o}z2^{IvrlH3A=+V2vqfJTB98CjzeYF/wPR:5zE\u0026/XzGQ5qB6\u0026)4v@\u003cvWuT^B", "n": [ { "c": 2, "d": "Characteristic libc export __assert_fail", "i": "micro-behaviors/dylib/library/libc::libc-characteristic-assert-fail", "o": 11392, "z": 11, "cf": 0.5 } ], "ln": 11376 }, { "b": "uT^.\u003eA@Y\u0026\u003cB-.CvuU0?SxjVf(AaJQ3B6\u0026)evR/:*uT^.\u003eA@Y\u0026\u003cB-.CvuVo^\u003cB2NDHwPzG%C(", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 13598, "z": 9, "cf": 1.0 } ], "ln": 13582 }, { "b": "BzM29v}xX5x\u003ez6?vru6/xjVf(AaJQ3A@Y\u0026\u003cB-.CvuUi[XxK$KcfGz3#xl4{kA9)N8x(dzYx8", "n": [ { "c": 1, "d": "get_peers DHT operation", "i": "objectives/command-and-control/channel/p2p::get-peers-str", "o": 16821, "z": 9, "cf": 1.0 } ], "ln": 16805 }, { "b": "zua:1A==ko0cqZYB-I52xjVf@zGV23BAg(8ASx-\u0026B-.CvuVH3{0blsZByf0ez/bL/zGQ5qB6\u003ceHfGAGIA=+VfwPRo\u0026zEl\u003c#uVfT?0a#", "n": [ { "c": 3, "d": "Parse IP with inet_pton", "i": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "o": 19430, "z": 9, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable access functions", "i": "micro-behaviors/os/env/vars/access::env-access-comp", "o": 19405, "z": 6, "cf": 0.4000000059604645 } ], "ln": 19389 }, { "b": "zEl\u003c#uVfT?0a]!.A=k%#v@c6[yHpZ=BAzklwDlsRy?mH50a{p]vrqGYBy/o8zVB\u0026\u0026BARbow=MEXBzkP6uVDcUAclnj0a{g)BAmB\u003cB8AZtwO#0@wmYa?x(d*9wNw$VASxJ?", "n": [ { "c": 3, "d": "Read file status and metadata (core)", "i": "micro-behaviors/fs/file/stat::stat-core", "o": 20452, "z": 5, "cf": 0.800000011920929 }, { "c": 2, "d": "Write single bytes to file", "i": "micro-behaviors/fs/file/write/direct::fputc", "o": 20482, "z": 5, "cf": 0.6600000262260437 }, { "c": 2, "d": "Convert time to UTC time", "i": "micro-behaviors/time/query::gmtime", "o": 20473, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Execution time measurement APIs", "i": "objectives/anti-analysis/timing/evasion::timing-measurement", "o": 20431, "z": 13, "cf": 0.4000000059604645 } ], "ln": 20415 }, { "b": "A=k%#xjVf{0b(*#x(mCYAa%o50b#H\u0026A=k%#w]}Q2yYFJ\u003cxkRc]0a{d\u0026yxeA$wnb]YB98CAz!%j\u0026B98CzAbCU(z!0i(BzkP6uVDc/BAhFwyxd%Tz!n#WB-o8oB-8niBy/uk0crl)z/{d4xjVg7vrlF\u0026B.$MdyxeD\u003czdNu%0chT/z*2W(vrlydx(n380cAKdwPN]\u003cAcbJex8(NQBz(buuU\u003cT#x8(H/wN/[50crm5zEW9@wN/N@0a{B}x()[^uUj1\u0026x-J0=BzkP60af8Hx\u003c$NVB97\u0026hBye([x(i[", "n": [ { "c": 3, "d": "Set file creation mask (umask)", "i": "micro-behaviors/fs/chmod/modify::umask", "o": 20647, "z": 5, "cf": 0.4000000059604645 }, { "c": 3, "d": "Delete files", "i": "micro-behaviors/fs/file/delete::remove", "o": 20660, "z": 6, "cf": 0.30000001192092896 }, { "c": 3, "d": "C-style exec family functions", "i": "micro-behaviors/process/create/execv::c-exec-variants", "o": 20701, "z": 6, "cf": 0.800000011920929 }, { "c": 3, "d": "Terminal password prompt", "i": "micro-behaviors/process/tty/pty::getpass", "o": 20639, "z": 7, "cf": 0.6000000238418579 }, { "c": 3, "d": "Regex component marker", "i": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "o": 20689, "z": 11, "cf": 0.9300000071525574 }, { "c": 2, "d": "Write files (fwrite)", "i": "micro-behaviors/fs/file/write/direct::write--fwrite", "o": 20720, "z": 6, "cf": 0.6600000262260437 }, { "c": 2, "d": "Environment variable modification", "i": "micro-behaviors/os/env/vars/access::set", "o": 20623, "z": 8, "cf": 0.5 }, { "c": 2, "d": "Install signal handler", "i": "micro-behaviors/os/signal/handler::signal", "o": 20561, "z": 6, "cf": 0.8999999761581421 }, { "c": 2, "d": "Duplicate file descriptor (I/O redirection)", "i": "micro-behaviors/process/fd/dup::dup2", "o": 20618, "z": 4, "cf": 0.5 }, { "c": 2, "d": "Process forking", "i": "micro-behaviors/process/fork/clone::fork", "o": 20568, "z": 4, "cf": 0.6600000262260437 }, { "c": 2, "d": "localtime function (string)", "i": "micro-behaviors/time/query::localtime-string", "o": 20595, "z": 8, "cf": 0.20000000298023224 }, { "c": 2, "d": "Binary process execution capability", "i": "objectives/anti-static/obfuscation/eval/loader::binary-process-execution", "o": 20543, "z": 4, "cf": 0.8500000238418579 } ], "ln": 20527 }, { "b": "e]$}-humMcvQ?3cB-RvJCSmP*hz^4cz.r:AoI4MIk#QJkuOC?y07P^:r7{j$gHA7Fgxm", "n": [ { "c": 2, "d": "x86_64 architecture string", "i": "micro-behaviors/os/sysinfo/platform/string::arch-x86-64", "o": 20820, "z": 6, "cf": 0.30000001192092896 } ], "ln": 20804 }, { "b": "07ggjzF%Rtz/xo9ash7Kw]zYjA+eV\u0026x(mL\u003c0aQ4\u003euUKy(BugJ\u003cA%.[zy?m3@wGUM4By/FnBzbkdwmY\u003c\u003ex(4\u0026kz!pblxK@q@wPz)bw[+:-By=?vay]hcBzkS9B.L]gwN({3vqPNdawc=$BrCKywPE", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 122908, "z": 3, "cf": 0.800000011920929 }, { "c": 2, "d": "X.509 certificate handling (legitimate)", "i": "micro-behaviors/crypto/certificate/usage::certificate-handling", "o": 122967, "z": 11, "cf": 0.800000011920929 } ], "ln": 122892 }, { "b": "Byf0cz*lLmwnTBJc36y[ra]#!azbt0y?aVfxM53fwft=dBrC47aA.:pwftP7az$+m", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 123056, "z": 4, "cf": 0.800000011920929 } ], "ln": 123040 }, { "b": "wJy}WA%.[Gvrcm1zF80Mra]?=BzkP6aAIaoaz2!cwO2y[aARpdavwBxB0b4sAa%s", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 123240, "z": 3, "cf": 0.800000011920929 } ], "ln": 123224 }, { "b": "gCgNrf!Lsoh7**ugCgG:yH}=#B-Q#7wJy}WA%.[*wPRp2BZ/8%v@#6[wQdS%wi7?VA%.[UA=M8sao", "n": [ { "c": 3, "d": "Terminal socket exec helper context", "i": "micro-behaviors/process/fd/dup::unix-terminal-socket-exec-benign-context", "o": 123588, "z": 13, "cf": 0.949999988079071 } ], "ln": 123572 }, { "b": "B15kCzEWQ4Aa9\u003c5vR/P#CwhejaARpdazULlasFKSdgc5@Abfe{x(mTbiV].\u00263ijTT", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 123748, "z": 4, "cf": 0.800000011920929 } ], "ln": 123732 }, { "b": "yH}=lc37W\u003ee^.ONz//LkBzb98avOT=q:zKwwQettCwhejaAImywGU/2B8@ECxKL^3", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 124093, "z": 4, "cf": 0.800000011920929 } ], "ln": 124077 }, { "b": "C57VmiV].\u00263iiyYm[DC#lQ:)LnK=osk#ZnMlpByop9rT@fGxbyA=+V5ze:AlBugJ\u003cA%.[^BZ/b$D0+o5AbP=siV[", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 125486, "z": 11, "cf": 0.5 }, { "c": 2, "d": "x509 string reference", "i": "micro-behaviors/crypto/certificate/usage::x509-string", "o": 125504, "z": 4, "cf": 0.6000000238418579 } ], "ln": 125470 }, { "b": "B2\u003eA\u0026A%.[\u003evrcm1zF80MBzbxfayP80z/PMlxL!(5z!i#jzF%RtB9hCvz/P}xwO#0#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 126188, "z": 4, "cf": 0.800000011920929 } ], "ln": 126172 }, { "b": "Accv9p!KeOar@\u0026*oj-wGlUgpWx\u003ez6?vru5Xmq=QQD2N\u003epwb[${oAn15v@=d5099]LzF%-p07xS", "n": [ { "c": 2, "d": "certificate string reference", "i": "micro-behaviors/crypto/certificate/usage::certificate-ref", "o": 127471, "z": 11, "cf": 0.5 } ], "ln": 127455 }, { "b": "l](CpA%.[oA=M8sazCZovQTs?hz=K/zEWP}x(mMAash7o090SyA+cwqwPzu8wPz*fA=R", "n": [ { "c": 2, "d": "base64 encoding keyword", "i": "micro-behaviors/data/encoded::base64-token", "o": 127897, "z": 6, "cf": 0.699999988079071 } ], "ln": 127881 }, { "b": "wmY^7vS==nzF{Ubz!aa[eIeLaeKz(@nLQy8og8SpeIeLaeEzFfeIeLamnuk[p!KeOh.uQkeIdqfw[=c[aAhEjy?Wx4yH}=lwPz!", "n": [ { "c": 2, "d": "File contains a PEM-encoded certificate.", "i": "micro-behaviors/crypto/certificate/usage::has-pem-certificate", "o": 128095, "z": 10, "cf": 1.0 }, { "c": 2, "d": "PEM end marker", "i": "micro-behaviors/crypto/certificate/usage::pem-end", "o": 128118, "z": 8, "cf": 0.699999988079071 } ], "ln": 128079 }, { "b": "0aP}+B95KEzGxJ8zE)u3v}Yp\u003eash8kt{8oq0aPXJASvzbiSGHffdF8+wN/T}zdNP}wN({0wD", "n": [ { "c": 3, "d": "C array declaration format string", "i": "micro-behaviors/data/encode/payload::c-array-format", "o": 129486, "z": 9, "cf": 0.6000000238418579 } ], "ln": 129470 }, { "b": "C}HZ43ij{SB8#5kxcn=TB7F\u003c4wPPItwQaQ.xK#A}wmYm?wmW!Ac36y[x(d*cA=-BnA=M8siV[", "n": [ { "c": 1, "d": "Secret marker string (key/token/api)", "i": "objectives/exfiltration/http/upload::secret-key", "o": 129651, "z": 10, "cf": 0.6000000238418579 } ], "ln": 129635 }, { "b": "f/g*vv@L@UB-7#jz*c7wv}/)}wPw[tA%.[^A+PYjwQdS]CYmOwBugJ\u003cA%.[^A+PYjwQa", "n": [ { "c": 3, "d": "Encryption API usage markers", "i": "micro-behaviors/crypto/library/keyword::encryption-functions", "o": 132089, "z": 6, "cf": 0.5 } ], "ln": 132073 }, { "b": "y?XifzF78cwQcrVc36y[mSiq\u0026l}wCtvrb^[wPRH7azkn6wPzj3x(v(ivivuYeN\u0026#", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 132266, "z": 3, "cf": 0.800000011920929 } ], "ln": 132250 }, { "b": "h8d8\u003ewN]s)ve%\u003eHg=de(CRRclf/YkUg=de(wN/m(ve%\u003eGv/QdWB968\u003c0b3j\u003eBtkK5gbP", "n": [ { "c": 3, "d": "X25519 key exchange marker", "i": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "o": 132616, "z": 6, "cf": 0.8799999952316284 } ], "ln": 132600 }, { "b": "z/Pziw]zYjwnbW\u003cByw#dB7]o8vruTjwPGEh0cq*Zf-VodvkoX#0cq*ZgbpV^B7!#ri5yRRxKH", "n": [ { "c": 1, "d": "False positive indicators", "i": "objectives/impact/ransom/encrypt/threat-text::fp-indicators", "o": 132828, "z": 10, "cf": 1.0 } ], "ln": 132812 }, { "b": "dO8#]qDb$Kk#Yr-08vCPxK$Q)ByF/\u0026BrCpnaARphB0bKnB8#5lzvcw.x(mMAash7o04/r\u0026wD", "n": [ { "c": 2, "d": "C2 heartbeat/beacon protocols", "i": "well-known/malware/backdoor/melofee::c2-protocols", "o": 133372, "z": 9, "cf": 1.0 } ], "ln": 133356 }, { "b": "aAImywJy}Wwftt}BAm=?lUQHMwPw]mB.L@eB0b7kAV=VH3ij1IzGGriaz2Olz/M$eBuf", "n": [ { "c": 2, "d": "Generic 'cipher' crypto term", "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "o": 133935, "z": 6, "cf": 0.4000000059604645 } ], "ln": 133919 }, { "b": "ash7o04/r/k%)WQc36y[eG^\u0026dBzkVhB2\u003cpzwQ5rdzE^r?az\u003eLdBy/FnB7F\u003c4wPPE6aAH$6wGQ", "n": [ { "c": 3, "d": "Linker and terminal benign dual-mode forwarding", "i": "micro-behaviors/process/fd/dup::unix-dual-mode-socket-exec-benign-context", "o": 135693, "z": 10, "cf": 0.9399999976158142 } ], "ln": 135677 }, { "b": "xkRBfvpB4:az#ssvR6MWv}xX5Bz(8lat1ZazGO]LqY]NYA==2cx\u003e7N[wGV8kz!]+XB75Y)iV]LPwPz)mz/oCmtoCHWw]7)*j%j5(C42hJt{aIqeIf85vqPNttyeIXaBMv}vqFbkaycPLe*7Gdph+2YiTMiparSmDefDI@wmYj)xfycPz6f@zarR^HarR^HavQfRvR/P#wmYj)xj\u003e{@x9[}K2)\u0026ga", "n": [ { "c": 3, "d": "Benign socket shell helper context", "i": "micro-behaviors/process/fd/dup::posix-fd-redirect-shell-benign-context", "o": 136019, "z": 128, "cf": 0.9399999976158142 } ], "ln": 136003 }, { "b": "Acb/jzGv\u0026C3lQDleP@V/eIhcSA=U@kzD/njA+wV2arR^HarR!BB-.OBBrC:rA=U@kzxJUhw=", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 142832, "z": 9, "cf": 0.699999988079071 } ], "ln": 142816 }, { "b": "x(v(ivqYP#wQ4{h3lQDleODWTeIgTEy\u0026yHtarR^HarR^HarR^HarR!qx(!lfvr\u0026%", "n": [ { "c": 2, "d": "Short -h help flag", "i": "micro-behaviors/ui/help::usage-help", "o": 142894, "z": 3, "cf": 0.699999988079071 } ], "ln": 142878 }, { "b": "v}xX5Bz(8latUSfe?]c?lVl{?A+Pf1Brz#0diHx1fFC7lfFUBbmSJ6Kax9h\u003cBA.elwGTDXBP", "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 143981, "z": 9, "cf": 0.6000000238418579 } ], "ln": 143965 }, { "b": "p\u003c3k-x\u003e5nVx\u003e7Z(B7D)fC4CYnx(v(igAZQRaz+FdwPw[QxMOuniXJd0zGNNIA+v4wx\u003e7Z(A@", "n": [ { "c": 2, "d": "Version information string", "i": "micro-behaviors/ui/help::version-text", "o": 144172, "z": 9, "cf": 0.699999988079071 } ], "ln": 144156 }, { "b": "B0bKnA+O@#az#ssvR6MWg+HHnga\u003erZra]?=v}xX5x\u003ez6?vru66Cwg(faz2!px(W=cx(k3", "n": [ { "c": 3, "d": "Dotted-quad PE version metadata context", "i": "objectives/command-and-control/infrastructure/ip::ipv4-version-metadata-context", "o": 148996, "z": 7, "cf": 0.9399999976158142 } ], "ln": 148980 }, { "b": "%nP2]0SSi2002%#00000000:g0SSi2000Pi004Lg%nJ)i0SSi2000Pi003$?%nR%)0SSi2000Pi000", "n": [ { "c": 1, "d": "Encoded HTML tag fragment", "i": "objectives/anti-static/obfuscation/encoding/content::encoded-html-tag-fragment", "o": 174046, "z": 14, "cf": 0.699999988079071 } ], "ln": 174030 }, { "b": "-Y%O9000000@@r300000v}xX5Bz(8le[wK5B.pWOLW0Np04@taB98CAvpxi?zF%Sde[Y6Ae]U\u0026HAaG", "n": [ { "c": 2, "d": ".gnu_debuglink reference present", "i": "metadata/build/debug::elf-debuglink", "o": 181376, "z": 14, "cf": 1.0 } ], "ln": 181360 }, { "b": "By^7qzGNNvB.LV5eOO.}e[]iBwPz.\u0026e[Y6Ae[!WmxAfU}D2vXGz2=h0D2vXBASv.8zGNNPwPz\u003caz/bLcxkR\u0026AC4CYnx(v(@ASv.jwD", "n": [ { "c": 2, "d": "ELF dynstr section name", "i": "metadata/binary/linking/static::elf-dynstr-section-name", "o": 181471, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF dynsym section name", "i": "metadata/binary/linking/static::elf-dynsym-section-name", "o": 181463, "z": 7, "cf": 0.8999999761581421 }, { "c": 2, "d": "ELF interpreter section name", "i": "metadata/binary/linking/static::elf-interpreter-section-name", "o": 181445, "z": 7, "cf": 0.8999999761581421 } ], "ln": 181429 }, { "b": "vr?\u00269wmoN*e]\u003eJte]\u003e\u003ege[xlBvqPZ*04}]5Bo0}7vrt]Te[e)y04}]4BZFV\u003cvS=s1x(mX^", "n": [ { "c": 2, "d": "ELF dynamic section name", "i": "metadata/binary/linking/static::elf-dynamic-section-name", "o": 181624, "z": 8, "cf": 0.8999999761581421 } ], "ln": 181608 } ], "depth": 1, "facts": { "exp": [ [ "stdout" ], [ "gnutls_ffdhe_4096_group_prime" ], [ "gnutls_ffdhe_3072_group_generator" ], [ "gnutls_ffdhe_3072_group_prime" ], [ "fini" ], [ "gnutls_ffdhe_4096_group_generator" ], [ "gnutls_ffdhe_2048_group_prime" ], [ "gnutls_ffdhe_6144_key_bits" ], [ "gnutls_ffdhe_6144_group_prime" ], [ "gnutls_ffdhe_2048_group_generator" ], [ "gnutls_ffdhe_8192_key_bits" ], [ "gnutls_free" ], [ "gnutls_strdup" ], [ "gnutls_ffdhe_8192_group_generator" ], [ "init" ], [ "stdin" ], [ "gnutls_ffdhe_3072_key_bits" ], [ "gnutls_ffdhe_6144_group_generator" ], [ "stderr" ], [ "gnutls_malloc" ], [ "gnutls_ffdhe_2048_key_bits" ], [ "gnutls_ffdhe_4096_key_bits" ], [ "gnutls_ffdhe_8192_group_prime" ] ], "imp": [ [ "", "gnutls_x509_crt_get_key_id" ], [ "", "printf" ], [ "", "exit" ], [ "", "gnutls_x509_crq_export" ], [ "", "gnutls_pkcs12_verify_mac" ], [ "", "gnutls_hex_decode" ], [ "", "gnutls_x509_crq_set_dn" ], [ "", "realloc" ], [ "", "gnutls_digest_list" ], [ "", "gnutls_dh_params_generate2" ], [ "", "gnutls_x509_privkey_export_rsa_raw2" ], [ "", "gnutls_pkcs12_bag_get_count" ], [ "", "gnutls_x509_crt_set_issuer_unique_id" ], [ "", "gnutls_x509_crl_set_number" ], [ "", "gnutls_privkey_get_spki" ], [ "", "cxa_finalize" ], [ "", "gnutls_x509_crl_print" ], [ "", "tzset" ], [ "", "gnutls_memset" ], [ "", "gnutls_alpn_get_selected_protocol" ], [ "", "strstr" ], [ "", "clock_gettime" ], [ "", "gnutls_x509_privkey_deinit" ], [ "", "gnutls_session_get_desc" ], [ "", "gnutls_pk_get_name" ], [ "", "fread" ], [ "", "gnutls_x509_crl_verify" ], [ "", "gnutls_x509_crt_get_signature_oid" ], [ "", "ITM_deregisterTMCloneTable" ], [ "", "gnutls_dh_params_export_raw" ], [ "", "gnutls_digest_get_id" ], [ "", "gnutls_x509_tlsfeatures_add" ], [ "", "gnutls_certificate_type_get" ], [ "", "fgets" ], [ "", "close" ], [ "", "feof" ], [ "", "gnutls_pkcs7_get_embedded_data_oid" ], [ "", "strchr" ], [ "", "gnutls_x509_crl_get_number" ], [ "", "gnutls_pem_base64_encode" ], [ "", "gnutls_x509_name_constraints_deinit" ], [ "", "gnutls_pkcs7_export2" ], [ "", "gnutls_global_set_log_function" ], [ "", "gnutls_hex2bin" ], [ "", "umask" ], [ "", "gnutls_pkcs7_verify_direct" ], [ "", "calloc" ], [ "", "gnutls_protocol_get_version" ], [ "", "gnutls_x509_privkey_import_pkcs8" ], [ "", "gnutls_pkcs12_bag_get_friendly_name" ], [ "", "gnutls_pkcs11_set_token_function" ], [ "", "gnutls_x509_privkey_get_pk_algorithm" ], [ "", "strncmp" ], [ "", "gnutls_dh_get_prime_bits" ], [ "", "gnutls_priority_group_list" ], [ "", "fputc" ], [ "", "stat" ], [ "", "gnutls_x509_crt_get_subject_key_id" ], [ "", "gnutls_protocol_list" ], [ "", "strnlen" ], [ "", "free" ], [ "", "gnutls_priority_init" ], [ "", "gnutls_x509_crt_set_crq_extension_by_oid" ], [ "", "gnutls_x509_privkey_get_pk_algorithm2" ], [ "", "gnutls_pkcs11_set_pin_function" ], [ "", "gnutls_x509_crt_set_spki" ], [ "", "gnutls_x509_crq_set_challenge_password" ], [ "", "gnutls_x509_crt_init" ], [ "", "gnutls_x509_crq_print" ], [ "", "gnutls_x509_crq_init" ], [ "", "gnutls_pubkey_import_x509_raw" ], [ "", "gnutls_safe_renegotiation_status" ], [ "", "fputs" ], [ "", "gnutls_pkcs7_print" ], [ "", "gnutls_x509_crq_privkey_sign" ], [ "", "gnutls_x509_crt_list_import2" ], [ "", "abort" ], [ "", "gnutls_x509_privkey_import" ], [ "", "gnutls_global_set_time_function" ], [ "", "gnutls_x509_crt_set_dn" ], [ "", "gnutls_x509_crt_set_serial" ], [ "", "gnutls_digest_get_name" ], [ "", "strtoll" ], [ "", "gnutls_x509_crq_set_tlsfeatures" ], [ "", "gnutls_x509_privkey_verify_params" ], [ "", "gnutls_pubkey_import_privkey" ], [ "", "gnutls_pkcs12_mac_info" ], [ "", "fflush" ], [ "", "dup2" ], [ "", "gnutls_x509_crt_set_subject_alt_othername" ], [ "", "gnutls_priority_kx_list" ], [ "", "gnutls_x509_crl_set_authority_key_id" ], [ "", "gnutls_hex_encode2" ], [ "", "fprintf" ], [ "", "gnutls_pkcs12_bag_set_friendly_name" ], [ "", "gnutls_x509_name_constraints_add_permitted" ], [ "", "gnutls_group_get_name" ], [ "", "gnutls_pkcs11_deinit" ], [ "", "gnutls_pk_bits_to_sec_param" ], [ "", "gnutls_x509_crl_import" ], [ "", "gnutls_priority_protocol_list" ], [ "", "gnutls_x509_crt_set_authority_key_id" ], [ "", "gnutls_x509_crt_set_crl_dist_points" ], [ "", "gnutls_pkcs7_init" ], [ "", "gnutls_cipher_get_name" ], [ "", "unsetenv" ], [ "", "gnutls_pk_algorithm_get_name" ], [ "", "gnutls_x509_crt_import" ], [ "", "gnutls_x509_privkey_export_dsa_raw" ], [ "", "gnutls_x509_crt_list_import" ], [ "", "asn1_strerror" ], [ "", "gnutls_x509_privkey_init" ], [ "", "gnutls_pubkey_export" ], [ "", "gnutls_x509_crq_import" ], [ "", "gnutls_pkcs7_sign" ], [ "", "fork" ], [ "", "stack_chk_fail" ], [ "", "gnutls_pkcs12_bag_get_key_id" ], [ "", "gnutls_pkcs12_bag_init" ], [ "", "gnutls_x509_crt_get_fingerprint" ], [ "", "gnutls_ecc_curve_list" ], [ "", "mktime" ], [ "", "gnutls_pubkey_import_x509" ], [ "", "gnutls_compression_get_id" ], [ "", "gnutls_heartbeat_ping" ], [ "", "getpass" ], [ "", "gnutls_x509_crq_set_extension_by_oid" ], [ "", "gnutls_x509_trust_list_verify_crt" ], [ "", "gnutls_x509_crt_get_pk_algorithm" ], [ "", "fstat" ], [ "", "gnutls_pubkey_import" ], [ "", "gnutls_session_etm_status" ], [ "", "gnutls_dh_params_import_pkcs3" ], [ "", "gnutls_x509_crt_set_authority_info_access" ], [ "", "strtok" ], [ "", "fileno" ], [ "", "gnutls_sign_get_name" ], [ "", "gnutls_sign_algorithm_get_client" ], [ "", "gnutls_cipher_list" ], [ "", "gnutls_x509_tlsfeatures_init" ], [ "", "gnutls_certificate_type_list" ], [ "", "gnutls_certificate_verification_profile_get_id" ], [ "", "gnutls_x509_privkey_generate" ], [ "", "gnutls_group_list" ], [ "", "gnutls_srtp_get_selected_profile" ], [ "", "gnutls_pkcs_schema_get_name" ], [ "", "gnutls_x509_privkey_get_key_id" ], [ "", "gnutls_x509_crl_privkey_sign" ], [ "", "getenv" ], [ "", "execvp" ], [ "", "gnutls_certificate_server_set_request" ], [ "", "gnutls_pubkey_init" ], [ "", "setvbuf" ], [ "", "gnutls_kx_get_name" ], [ "", "gnutls_pkcs7_set_crl" ], [ "", "gnutls_pubkey_export2" ], [ "", "gnutls_url_is_supported" ], [ "", "gnutls_pk_list" ], [ "", "gnutls_x509_crq_set_key_usage" ], [ "", "asprintf" ], [ "", "gnutls_pkcs7_set_crt" ], [ "", "gnutls_x509_crt_set_subject_unique_id" ], [ "", "gnutls_certificate_type_get_name" ], [ "", "gnutls_x509_crq_verify" ], [ "", "gnutls_x509_privkey_generate2" ], [ "", "gnutls_priority_cipher_list" ], [ "", "setenv" ], [ "", "gnutls_x509_privkey_export" ], [ "", "gnutls_x509_trust_list_verify_crt2" ], [ "", "gnutls_pkcs11_init" ], [ "", "gnutls_x509_privkey_import2" ], [ "", "gnutls_certificate_get_ours" ], [ "", "gnutls_ecc_curve_get" ], [ "", "gnutls_global_deinit" ], [ "", "perror" ], [ "", "gnutls_x509_name_constraints_add_excluded" ], [ "", "gnutls_pkcs7_get_embedded_data" ], [ "", "gnutls_x509_crt_deinit" ], [ "", "gnutls_x509_crl_get_issuer_dn3" ], [ "", "gnutls_protocol_get_name" ], [ "", "gnutls_pcert_deinit" ], [ "", "gnutls_x509_privkey_get_spki" ], [ "", "gnutls_kx_list" ], [ "", "gnutls_x509_privkey_get_seed" ], [ "", "gnutls_x509_crl_export2" ], [ "", "strncasecmp" ], [ "", "strcpy" ], [ "", "gnutls_reauth" ], [ "", "gnutls_x509_privkey_export2" ], [ "", "gnutls_priority_sign_list" ], [ "", "gnutls_cipher_suite_info" ], [ "", "gnutls_pkcs12_bag_get_type" ], [ "", "gnutls_pkcs12_import" ], [ "", "gnutls_x509_crl_deinit" ], [ "", "gnutls_x509_crq_set_basic_constraints" ], [ "", "gnutls_x509_spki_init" ], [ "", "gnutls_x509_crt_set_inhibit_anypolicy" ], [ "", "gnutls_dh_params_import_raw" ], [ "", "gnutls_mac_list" ], [ "", "gnutls_privkey_verify_seed" ], [ "", "reallocarray" ], [ "", "gnutls_x509_crl_set_crt" ], [ "", "gnutls_ocsp_status_request_is_checked" ], [ "", "gnutls_x509_crl_list_import2" ], [ "", "gnutls_x509_tlsfeatures_deinit" ], [ "", "optind" ], [ "", "gnutls_x509_crt_set_subject_alt_name" ], [ "", "gnutls_x509_crt_set_name_constraints" ], [ "", "gnutls_certificate_verification_status_print" ], [ "", "gnutls_pkcs7_get_signature_info" ], [ "", "gnutls_pubkey_import_x509_crq" ], [ "", "gnutls_pkcs12_generate_mac3" ], [ "", "gnutls_session_channel_binding" ], [ "", "secure_getenv" ], [ "", "gnutls_rnd" ], [ "", "gnutls_x509_cidr_to_rfc5280" ], [ "", "gnutls_cipher_get" ], [ "", "strftime" ], [ "", "gnutls_group_get" ], [ "", "gnutls_global_set_log_level" ], [ "", "gnutls_dh_get_secret_bits" ], [ "", "gnutls_x509_privkey_export_gost_raw" ], [ "", "gnutls_x509_crt_get_signature_algorithm" ], [ "", "fwrite" ], [ "", "strspn" ], [ "", "gnutls_x509_crt_set_policy" ], [ "", "gnutls_x509_crt_set_expiration_time" ], [ "", "gnutls_x509_spki_get_rsa_pss_params" ], [ "", "puts" ], [ "", "gnutls_x509_name_constraints_init" ], [ "", "getopt_long" ], [ "", "fopen" ], [ "", "gnutls_pkcs12_bag_enc_info" ], [ "", "gnutls_priority_mac_list" ], [ "", "gnutls_x509_crt_export2" ], [ "", "gnutls_x509_crt_get_expiration_time" ], [ "", "gnutls_x509_crt_set_extension_by_oid" ], [ "", "getc" ], [ "", "deregister_frame_info" ], [ "", "gnutls_x509_crq_deinit" ], [ "", "ferror" ], [ "", "snprintf" ], [ "", "register_frame_info" ], [ "", "gnutls_pkcs12_init" ], [ "", "gnutls_pkcs7_signature_info_deinit" ], [ "", "gnutls_x509_trust_list_init" ], [ "", "gnutls_x509_crt_check_key_purpose" ], [ "", "gnutls_certificate_verify_peers" ], [ "", "gnutls_x509_crt_print" ], [ "", "gnutls_x509_crq_set_subject_alt_name" ], [ "", "timegm" ], [ "", "gnutls_x509_spki_set_rsa_oaep_params" ], [ "", "gnutls_pkcs12_bag_deinit" ], [ "", "gnutls_sign_algorithm_get" ], [ "", "gnutls_sec_param_get_name" ], [ "", "gnutls_hex_decode2" ], [ "", "gnutls_global_init" ], [ "", "gnutls_mac_get_name" ], [ "", "gnutls_x509_crt_set_version" ], [ "", "gnutls_pcert_import_rawpk_raw" ], [ "", "gnutls_sec_param_to_pk_bits" ], [ "", "gnutls_hex_encode" ], [ "", "gnutls_rehandshake" ], [ "", "gnutls_x509_crl_set_next_update" ], [ "", "gnutls_pubkey_import_url" ], [ "", "strcasecmp" ], [ "", "gnutls_pkcs7_deinit" ], [ "", "vfprintf" ], [ "", "gnutls_dh_params_import_raw2" ], [ "", "libc_start_main" ], [ "", "gnutls_pubkey_get_pk_algorithm" ], [ "", "pipe" ], [ "", "gnutls_session_ext_master_secret_status" ], [ "", "gnutls_privkey_import_x509" ], [ "", "gnutls_x509_crt_set_basic_constraints" ], [ "", "gnutls_x509_privkey_export_ecc_raw" ], [ "", "gnutls_x509_crt_set_proxy" ], [ "", "gnutls_dh_get_group" ], [ "", "gnutls_pkcs12_bag_encrypt" ], [ "", "fseek" ], [ "", "gnutls_pubkey_get_preferred_hash_algorithm" ], [ "", "gnutls_pkcs_schema_get_oid" ], [ "", "gnutls_certificate_type_get2" ], [ "", "gnutls_x509_crt_set_crq_extensions" ], [ "", "gnutls_pkcs12_bag_get_data" ], [ "", "remove" ], [ "", "gnutls_x509_crl_init" ], [ "", "gnutls_x509_crt_set_activation_time" ], [ "", "gnutls_sign_list" ], [ "", "fclose" ], [ "", "gnutls_x509_privkey_export_pkcs8" ], [ "", "gnutls_privkey_import_url" ], [ "", "gnutls_pkcs12_bag_set_key_id" ], [ "", "gnutls_x509_trust_list_add_cas" ], [ "", "gnutls_pkcs12_get_bag" ], [ "", "strdup" ], [ "", "gnutls_x509_spki_deinit" ], [ "", "gnutls_strerror" ], [ "", "gnutls_pkcs12_bag_set_crt" ], [ "", "gnutls_pkcs12_deinit" ], [ "", "gnutls_ecc_curve_get_name" ], [ "", "gnutls_pkcs12_bag_decrypt" ], [ "", "gnutls_pkcs7_print_signature_info" ], [ "", "gnutls_ecc_curve_get_size" ], [ "", "gnutls_x509_crq_set_pubkey" ], [ "", "gnutls_certificate_get_peers" ], [ "", "gnutls_mac_get" ], [ "", "gnutls_pkcs7_import" ], [ "", "gnutls_privkey_init" ], [ "", "gnutls_pkcs12_set_bag" ], [ "", "gnutls_priority_get_cipher_suite_index" ], [ "", "gnutls_pkcs12_bag_set_crl" ], [ "", "gnutls_load_file" ], [ "", "gnutls_compress_certificate_set_methods" ], [ "", "gnutls_kx_get" ], [ "", "gnutls_x509_crt_set_dn_by_oid" ], [ "", "gnutls_x509_crt_set_pubkey" ], [ "", "gnutls_compression_list" ], [ "", "gnutls_x509_trust_list_deinit" ], [ "", "strtoul" ], [ "", "gnutls_pkcs12_export" ], [ "", "gnutls_gost_paramset_get_name" ], [ "", "gnutls_x509_crt_get_dn3" ], [ "", "gnutls_x509_crq_set_key_purpose_oid" ], [ "", "sprintf" ], [ "", "gnutls_x509_crq_set_dn_by_oid" ], [ "", "gnutls_x509_crt_import_url" ], [ "", "gnutls_pkcs7_export" ], [ "", "gnutls_pkcs11_add_provider" ], [ "", "gnutls_server_name_get" ], [ "", "gnutls_x509_crq_set_subject_alt_othername" ], [ "", "gnutls_dh_params_init" ], [ "", "gnutls_dh_params_deinit" ], [ "", "gnutls_compression_get_name" ], [ "", "gnutls_auth_get_type" ], [ "", "signal" ], [ "", "gnutls_x509_privkey_sec_param" ], [ "", "strlen" ], [ "", "asn1_encode_simple_der" ], [ "", "gnutls_pkcs12_bag_set_data" ], [ "", "ITM_registerTMCloneTable" ], [ "", "gnutls_x509_spki_get_rsa_oaep_params" ], [ "", "strtol" ], [ "", "gnutls_x509_spki_set_rsa_pss_params" ], [ "", "gnutls_psk_server_get_username2" ], [ "", "gnutls_certificate_client_get_request_status" ], [ "", "gnutls_x509_crl_set_this_update" ], [ "", "gnutls_priority_deinit" ], [ "", "gnutls_x509_crl_set_version" ], [ "", "gnutls_hash_get_len" ], [ "", "gnutls_x509_crt_set_key_purpose_oid" ], [ "", "gnutls_x509_crt_get_issuer_dn3" ], [ "", "gnutls_transport_is_ktls_enabled" ], [ "", "gnutls_x509_trust_list_add_trust_file" ], [ "", "gnutls_x509_crt_set_tlsfeatures" ], [ "", "gnutls_session_get_id" ], [ "", "inet_pton" ], [ "", "gnutls_x509_trust_list_add_system_trust" ], [ "", "gnutls_psk_client_get_hint" ], [ "", "gnutls_dh_params_export_pkcs3" ], [ "", "localtime_r" ], [ "", "gnutls_pem_base64_encode2" ], [ "", "memmem" ], [ "", "gnutls_dh_get_peers_public_bits" ], [ "", "gnutls_pubkey_deinit" ], [ "", "gnutls_srtp_get_profile_name" ], [ "", "ftello" ], [ "", "gnutls_pubkey_print" ], [ "", "gnutls_pkcs8_info" ], [ "", "gmtime_r" ], [ "", "gnutls_pkcs7_verify" ], [ "", "assert_fail" ], [ "", "gnutls_x509_crt_set_crq" ], [ "", "gnutls_x509_crt_set_proxy_dn" ], [ "", "gnutls_prf_rfc5705" ], [ "", "errno_location" ], [ "", "gnutls_privkey_import_x509_raw" ], [ "", "gnutls_x509_trust_list_add_crls" ], [ "", "optarg" ], [ "", "gnutls_x509_privkey_set_flags" ], [ "", "malloc" ], [ "", "gnutls_x509_crt_set_subject_key_id" ], [ "", "gnutls_privkey_deinit" ], [ "", "strcmp" ], [ "", "gnutls_x509_crt_set_key_usage" ], [ "", "gnutls_dh_params_import_dsa" ], [ "", "ftell" ], [ "", "gnutls_pubkey_get_key_id" ], [ "", "gnutls_x509_crt_privkey_sign" ], [ "", "getline" ] ], "sec": [ [ ".note.gnu.property", 792, 48, 1.94, "alloc" ], [ ".note.gnu.build-id", 840, 36, 4.06, "alloc" ], [ ".interp", 876, 25, 4.05, "alloc" ], [ ".gnu.hash", 904, 276, 4.37, "alloc" ], [ ".dynsym", 1184, 9936, 1.33, "alloc" ], [ ".dynstr", 11120, 9882, 4.56, "alloc" ], [ ".gnu.version", 21002, 828, 1.65, "alloc" ], [ ".gnu.version_r", 21832, 240, 3.31, "alloc" ], [ ".rela.dyn", 22072, 9960, 1.99, "alloc" ], [ ".rela.plt", 32032, 24, 1.46, "alloc,info_link" ], [ ".relr.dyn", 32056, 136, 3.53, "alloc" ], [ ".init", 32768, 3, 1.58, "alloc,executable" ], [ ".plt", 32784, 32, 3.34, "alloc,executable" ], [ ".text", 32816, 86599, 6.16, "alloc,executable" ], [ ".fini", 119415, 3, 1.58, "alloc,executable" ], [ ".rodata", 122880, 31863, 5.37, "alloc" ], [ ".eh_frame_hdr", 154744, 1884, 5.38, "alloc" ], [ ".eh_frame", 156632, 10888, 5.01, "alloc" ], [ ".init_array", 170448, 8, 1.06, "write,alloc" ], [ ".fini_array", 170456, 8, 1.06, "write,alloc" ], [ ".data.rel.ro", 170464, 5988, 2.08, "write,alloc" ], [ ".dynamic", 176456, 576, 1.54, "write,alloc" ], [ ".got", 177032, 3184, 0.02, "write,alloc" ], [ ".data", 180224, 1152, 1.81, "write,alloc" ], [ ".gnu_debuglink", 181376, 20, 3.92, "" ], [ ".shstrtab", 181396, 268, 4.2, "" ] ], "metrics": { "elf": { "bits": 64.0, "entry": 32862.0, "has_got": 1.0, "has_plt": 1.0, "has_note": 1.0, "note_count": 2.0, "nx_enabled": 1.0, "has_dt_relr": 1.0, "dynrel_count": 0.0, "dynsym_count": 414.0, "has_build_id": 1.0, "has_eh_frame": 1.0, "has_gnu_hash": 1.0, "stack_canary": 1.0, "symtab_count": 0.0, "dynrela_count": 415.0, "has_debuglink": 1.0, "little_endian": 1.0, "dt_flags_1_raw": 134217729.0, "pltreloc_count": 1.0, "build_id_length": 20.0, "dt_versym_count": 414.0, "executable_stack": 0.0, "fini_array_count": 1.0, "init_array_count": 1.0, "wx_segment_count": 0.0, "program_header_count": 13.0, "gnu_stack_section_absent": 0.0, "load_segment_max_file_size": 86650.0, "stripped_but_symtab_present": 0.0, "load_segment_max_memory_size": 86650.0, "section_relocation_group_count": 2.0, "stripped_metadata_section_count": 8.0 }, "file": { "size": 183456.0, "entropy": 5.74, "size_bytes": 183456.0 }, "binary": { "is_pie": 1.0, "has_overlay": 1.0, "is_stripped": 1.0, "code_entropy": 6.16, "data_entropy": 1.42, "overlay_size": 1792.0, "string_count": 1493.0, "overlay_ratio": 0.01, "overall_entropy": 5.74, "overlay_entropy": 1.58, "entropy_variance": 2.63, "avg_string_length": 30.27, "max_string_length": 7533.0, "peak_region_bytes": 54272.0, "code_to_data_ratio": 0.89, "peak_region_entropy": 6.17, "string_length_stddev": 196.62, "largest_section_ratio": 0.47, "sentence_string_count": 474.0, "sentence_string_ratio": 0.32, "high_entropy_string_count": 1.0 }, "exports": { "count": 23.0 }, "imports": { "count": 390.0 }, "sections": { "count": 28.0, "code_size": 86637.0, "entropy_max": 6.16, "entropy_mean": 2.94, "name_entropy": 4.15, "writable_count": 7.0, "executable_count": 4.0, "nonstandard_count": 7.0, "executable_writable_count": 0.0 }, "dependencies": { "count": 3.0 } } }, "id": 7, "mol": "O₂(AlC)H₅(CmCrF₃PoU)Md(He)", "path": "gnutls-utils-3.8.13-r0.apk!!usr/bin/certtool", "risk": 9, "sha": "20d2ecb331af94fb9da86c9422acb92ace3d43a1bb68a91b3f7e6d6d86254f3a", "size": 183456, "traits": [ { "id": "micro-behaviors/fs/chmod/modify::umask", "conf": 0.4000000059604645, "crit": 3, "desc": "Set file creation mask (umask)", "spans": [ [ 20647, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-title", "crit": 2, "desc": "Usage: label (title case)", "spans": [ [ 136019, 128 ], [ 136054, 62 ] ] }, { "id": "micro-behaviors/data/encode/payload::c-array-format", "conf": 0.6000000238418579, "crit": 3, "desc": "C array declaration format string", "spans": [ [ 129486, 9 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "crit": 2, "desc": "libc characteristic cxa finalize", "spans": [ [ 11136, 12 ] ] }, { "id": "metadata/binary/metrics/threshold::rich-sentence-strings-20pct", "conf": 0.800000011920929, "crit": 1, "desc": "Binary has many sentence-like strings", "spans": [ [ 0, 35 ] ] }, { "id": "micro-behaviors/fs/file/open::fopen", "conf": 0.6600000262260437, "crit": 3, "desc": "Open files", "spans": [ [ 11265, 5 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-begin", "conf": 0.699999988079071, "crit": 2, "desc": "PEM begin marker", "spans": [ [ 128095, 10 ] ] }, { "id": "micro-behaviors/process/tty/pty::getpass", "atk": "T1056", "conf": 0.6000000238418579, "crit": 3, "desc": "Terminal password prompt", "spans": [ [ 20639, 7 ] ] }, { "id": "micro-behaviors/ui/help::usage-title-string", "crit": 1, "desc": "Usage: label in binary strings", "spans": [ [ 136019, 128 ], [ 136054, 62 ] ] }, { "id": "micro-behaviors/communications/ip/parse::inet-pton-symbol", "conf": 0.6600000262260437, "crit": 3, "desc": "Parse IP with inet_pton", "spans": [ [ 19430, 9 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::x509-string", "conf": 0.6000000238418579, "crit": 2, "desc": "x509 string reference", "spans": [ [ 125504, 4 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write--fwrite", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files (fwrite)", "spans": [ [ 20720, 6 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::pem-end", "conf": 0.699999988079071, "crit": 2, "desc": "PEM end marker", "spans": [ [ 128118, 8 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-func", "atk": "T1005", "conf": 0.4000000059604645, "crit": 2, "desc": "Seeks to position in file", "spans": [ [ 11337, 5 ] ] }, { "id": "metadata/binary/metrics/threshold::many-imports-50", "conf": 1.0, "crit": 1, "desc": "Binary has 50+ imports", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/read::fread", "conf": 0.699999988079071, "crit": 2, "desc": "Read stream (fread)", "spans": [ [ 11156, 5 ] ] }, { "id": "micro-behaviors/fs/file/read::fread-text", "conf": 0.6200000047683716, "crit": 2, "desc": "fread API string", "spans": [ [ 11156, 5 ] ] }, { "id": "micro-behaviors/ui/help::options-title-string", "crit": 1, "desc": "Options: label in binary strings", "spans": [ [ 135693, 10 ] ] }, { "id": "micro-behaviors/crypto/certificate/usage::certificate-ref", "crit": 2, "desc": "certificate string reference", "spans": [ [ 122967, 11 ], [ 125486, 11 ], [ 127471, 11 ] ] }, { "id": "micro-behaviors/crypto/asymmetric/curve25519::x25519-key-exchange-term", "atk": "T1573", "mbc": "C0027", "conf": 0.8799999952316284, "crit": 3, "desc": "X25519 key exchange marker", "spans": [ [ 132616, 6 ] ] }, { "id": "micro-behaviors/ui/help::usage-lower", "crit": 2, "desc": "usage: label (lowercase)", "spans": [ [ 123588, 13 ] ] }, { "id": "micro-behaviors/ui/help::options-title", "crit": 2, "desc": "Options: label", "spans": [ [ 135693, 10 ] ] }, { "id": "micro-behaviors/fs/file/binary::fseek-text", "atk": "T1005", "crit": 2, "desc": "fseek API string", "spans": [ [ 11337, 5 ] ] }, { "id": "micro-behaviors/ui/help::usage-lower-string", "crit": 1, "desc": "usage: label in binary strings", "spans": [ [ 123588, 13 ] ] }, { "id": "micro-behaviors/process/create/execv::exec-variant-symbol-text", "conf": 0.75, "crit": 3, "desc": "Exec family symbol text", "spans": [ [ 20701, 6 ] ] }, { "id": "objectives/impact/ransom/encrypt/threat-text::fp-signatures-word", "conf": 0.30000001192092896, "crit": 1, "desc": "Benign context: \"signatures\" allowlist word", "spans": [ [ 132828, 10 ] ] }, { "id": "objectives/command-and-control/reverse-shell/pty::pty-dual-mode-backdoor-cond-2--inline-10027", "atk": "T1059.004", "mbc": "B0024", "conf": 0.9300000071525574, "crit": 3, "desc": "Regex component marker", "spans": [ [ 20689, 11 ] ] }, { "id": "micro-behaviors/process/create/execv::c-exec-variants", "conf": 0.800000011920929, "crit": 3, "desc": "C-style exec family functions", "spans": [ [ 20701, 6 ] ] }, { "id": "micro-behaviors/fs/file/delete::remove", "conf": 0.30000001192092896, "crit": 3, "desc": "Delete files", "spans": [ [ 20660, 6 ] ] }, { "id": "metadata/binary/metrics/threshold::high-string-count-1000", "conf": 0.699999988079071, "crit": 2, "desc": "High string count over 1000", "spans": [ [ 0, 29 ] ] }, { "id": "objectives/anti-analysis/self-modify/runtime::elf-manual-loader-cond-0--inline-10757", "conf": 0.8500000238418579, "crit": 3, "desc": "Regex component marker", "spans": [ [ 0, 22 ] ] }, { "id": "micro-behaviors/fs/file/stat::stat-core", "conf": 0.800000011920929, "crit": 3, "desc": "Read file status and metadata (core)", "spans": [ [ 20452, 5 ], [ 20453, 4 ] ] }, { "id": "metadata/hardening/missing::stripped-binary", "conf": 0.800000011920929, "crit": 3, "desc": "No full symbol table (likely stripped)", "spans": [ [ 0, 25 ] ] }, { "id": "micro-behaviors/fs/file/binary::file-read-operation", "atk": "T1005", "conf": 0.75, "crit": 1, "desc": "File read operation", "spans": [ [ 11156, 5 ] ] }, { "id": "micro-behaviors/ui/help::has-help", "conf": 0.8500000238418579, "crit": 3, "desc": "Contains help or usage information", "spans": [ [ 123588, 13 ], [ 135693, 10 ], [ 136019, 128 ], [ 136054, 62 ] ] }, { "id": "micro-behaviors/fs/file/binary::binary-read-write-ops", "atk": "T1005", "conf": 0.699999988079071, "crit": 3, "desc": "Binary file read/write operations", "spans": [ [ 11337, 5 ] ] }, { "id": "micro-behaviors/fs/file/write/direct::write", "conf": 0.6600000262260437, "crit": 2, "desc": "Write files", "spans": [ [ 20720, 6 ] ] }, { "id": "micro-behaviors/dylib/library/libc::libc-internal-functions-b", "conf": 0.699999988079071, "crit": 2, "desc": "libc internal symbols cluster B", "spans": [ [ 11136, 12 ] ] }, { "id": "micro-behaviors/ui/help::usage-label", "conf": 0.75, "crit": 1, "desc": "Command line usage text", "spans": [ [ 123588, 13 ], [ 135693, 10 ], [ 136019, 128 ], [ 136054, 62 ] ] }, { "id": "micro-behaviors/dylib/library/abi-graphics::cxx-abi-symbols-a", "conf": 0.800000011920929, "crit": 2, "desc": "C++ ABI symbols cluster A", "spans": [ [ 11136, 12 ] ] } ], "type": "elf" }, { "id": 8, "sha": "e605d29e2cc3917e87a49cb6aa507cf6f160b6347f244d96423385585083343c", "path": "gnutls-utils-3.8.13-r0.apk!!.PKGINFO", "risk": 1, "size": 878, "type": "text", "depth": 1 } ], "omitted_files": 1, "rev": "af11a", "v": "8" } }