{ "ml": { "v": "7", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000077704586, "rte": "az", "prob": 0.000077704586 }, { "cls": 0, "raw": 0.000027120113, "rte": "az/scripts", "prob": 0.000027120113 }, { "cls": 0, "raw": 0.000028252602, "rte": "az/javascript", "prob": 0.000028252602 } ], "prob": 0.000077704586, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00007770458614686504 } ], "version": "v18.18", "analyzed_at": "2026-06-10T18:42:36Z" }, "path": "client.js", "raw": { "v": "7", "tv": "055ed", "files": [ { "id": 0, "ctx": [ { "a": 0, "l": 1, "t": "const net = require('net');" }, { "a": 28, "l": 2, "n": [ { "c": 3, "d": "Node net.Socket.connect method", "i": "micro-behaviors/communications/socket/connect::net-socket-connect-method", "o": 43, "z": 15 } ], "t": "const client = new net.Socket()" }, { "a": 60, "l": 3, "t": "const uuid = require('uuid');" }, { "a": 90, "l": 4, "t": "const myUuid = uuid.v4();" }, { "a": 116, "l": 5, "t": "const os = require('os');" }, { "a": 142, "l": 6, "n": [ { "c": 3, "d": "os.hostname() call", "i": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "o": 159, "z": 11 } ], "t": "const hostname = os.hostname();" }, { "a": 174, "l": 7, "t": "" }, { "a": 175, "l": 8, "t": "const config = require('../config');" }, { "a": 355, "l": 14, "t": "client.on('data', (data) =\u003e {" }, { "a": 386, "l": 15, "t": " console.log(data.toString())" }, { "a": 419, "l": 16, "n": [ { "c": 2, "d": "JSON.parse call", "i": "micro-behaviors/data/serialize/json::json-parse-call", "o": 427, "z": 10 } ], "t": " if (JSON.parse(data.toString()).arg \u0026\u0026 JSON.parse(data.toString()).arg2){" }, { "a": 497, "l": 17, "t": "" }, { "a": 506, "l": 18, "t": " // console.log(JSON.parse(data.toString()).content+\" \"+JSON.parse(data.toString()).arg,shell)" }, { "a": 1039, "l": 30, "t": "" }, { "a": 1040, "l": 31, "t": "" }, { "a": 1041, "l": 32, "n": [ { "c": 2, "d": "JSON.stringify call", "i": "micro-behaviors/data/serialize/json::json-stringify-call", "o": 1054, "z": 14 } ], "t": "client.write(JSON.stringify({code: 'bot entered to '+config.name, message:{'uuid': myUuid, 'hostname': hostname}}));" } ], "mol": "O(C)H₂(CmOs)", "sha": "992ae16ba9af85a90a7d8bcd4a599333ffd3240e3f669724019bc40e817c5a33", "fact": { "id": "javascript", "imp": [ [ "", "net" ], [ "", "require" ], [ "", "client" ], [ "", "uuid" ], [ "", "require" ], [ "", "myUuid" ], [ "", "uuid.v4" ], [ "", "os" ], [ "", "require" ], [ "", "hostname" ], [ "", "os.hostname" ], [ "", "config" ], [ "", "require" ], [ "", "shell" ], [ "", "require" ], [ "", "client.connect" ], [ "", "console.log" ], [ "", "client.on" ], [ "", "console.log" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "shell" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "shell" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "shell" ], [ "", "JSON.parse" ], [ "", "data.toString" ], [ "", "console.log" ], [ "", "client.on" ], [ "", "console.log" ], [ "", "client.write" ], [ "", "JSON.stringify" ], [ "", "../config" ], [ "", "./shell" ], [ "", "net" ], [ "", "os" ], [ "", "uuid" ] ], "mbr": [ "JSON.parse", "JSON.parse().arg", "JSON.parse().arg2", "JSON.parse().content", "JSON.stringify", "client.connect", "client.on", "client.write", "config.name", "config.server", "config.server.ip", "config.server.port", "console.log", "data.toString", "net.Socket", "os.hostname", "uuid.v4" ], "met": { "ast": { "op.add": 9.0, "op.land": 1.0, "max_depth": 20.0, "bind_count": 8.0, "call_count": 39.0, "node_count": 559.0, "member_count": 17.0, "op_density.add": 0.02, "op_density.land": 0.0, "identifier_count": 30.0, "member_depth_max": 3.0, "string_literal_count": 15.0, "string_concat_chain_max_length": 5.0 }, "file": { "size": 1157.0, "entropy": 4.82, "size_bytes": 1157.0 }, "text": { "digit_ratio": 0.0, "space_count": 124.0, "total_lines": 32.0, "char_entropy": 4.82, "unique_chars": 47.0, "string_density": 0.47, "avg_line_length": 35.19, "max_line_length": 122.0, "empty_line_ratio": 0.16, "last_line_length": 116.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "identifier_density": 3.25, "line_length_stddev": 33.11, "normalized_string_count": 2.65, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "trailing_whitespace_lines": 2.0, "most_common_char_codepoint": 116.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 6.0 }, "binds": { "count": 8.0 }, "calls": { "count": 39.0 }, "binary": { "overall_entropy": 4.82 }, "imports": { "count": 5.0, "stdlib_count": 2.0, "stdlib_ratio": 0.4, "relative_ratio": 0.4, "unique_modules": 5.0, "relative_imports": 2.0, "third_party_count": 3.0, "third_party_ratio": 0.6 }, "members": { "count": 17.0 }, "strings": { "total": 15.0, "avg_length": 6.67, "max_length": 23.0, "path_count": 2.0, "avg_entropy": 1.79, "total_bytes": 100.0, "entropy_stddev": 1.12 }, "comments": { "chars": 91.0, "lines": 1.0, "total": 1.0, "to_code_ratio": 0.03 }, "functions": { "anonymous": 3.0, "avg_params": 0.33, "max_params": 1.0, "length_stddev": 4.71, "no_params_count": 2.0, "avg_length_lines": 6.33, "max_length_lines": 13.0, "min_length_lines": 3.0, "avg_param_name_length": 4.0, "density_per_100_lines": 9.38, "code_in_functions_ratio": 0.59 }, "identifiers": { "count": 30.0, "total": 104.0, "avg_length": 5.0, "max_length": 9.0, "min_length": 2.0, "avg_entropy": 2.02, "reuse_ratio": 0.29, "unique_count": 30.0, "length_stddev": 1.95, "has_digit_ratio": 0.07, "sequential_names": 2.0, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.03, "numeric_suffix_count": 2.0 } }, "str": [ [ 20, "u8", "net" ], [ 21, "u8", "net" ], [ 81, "u8", "uuid" ], [ 82, "u8", "uuid" ], [ 135, "u8", "os" ], [ 136, "u8", "os" ], [ 198, "u8", "../config" ], [ 199, "u8", "../config" ], [ 234, "u8", "./shell" ], [ 235, "u8", "./shell" ], [ 321, "u8", "connected to " ], [ 322, "u8", "connected to " ], [ 365, "u8", "data" ], [ 366, "u8", "data" ], [ 656, "u8", " " ], [ 657, "u8", " " ], [ 692, "u8", " " ], [ 693, "u8", " " ], [ 827, "u8", " " ], [ 828, "u8", " " ], [ 964, "u8", "close" ], [ 965, "u8", "close" ], [ 995, "u8", "connection closed with " ], [ 996, "u8", "connection closed with " ], [ 1076, "u8", "bot entered to " ], [ 1077, "u8", "bot entered to " ], [ 1116, "u8", "uuid" ], [ 1117, "u8", "uuid" ], [ 1132, "u8", "hostname" ], [ 1133, "u8", "hostname" ] ], "tgt": [ "JSON.parse", "JSON.stringify", "client.connect", "client.on", "client.write", "console.log", "data.toString", "net.Socket", "os.hostname", "require", "shell", "uuid.v4" ], "val": { "file.stem": "client", "file.basename": "client.js", "source.language": "javascript", "source.imports[0]": "../config", "source.imports[1]": "./shell", "source.imports[2]": "JSON.parse", "source.imports[3]": "JSON.stringify", "source.imports[4]": "client", "source.imports[5]": "client.connect", "source.imports[6]": "client.on", "source.imports[7]": "client.write", "source.imports[8]": "config", "source.imports[9]": "console.log", "source.strings[0]": "../config", "source.strings[1]": "./shell", "source.strings[2]": "bot entered to ", "source.strings[3]": "connected to ", "source.strings[4]": "connection closed with ", "source.strings[5]": "hostname", "source.has_imports": true, "source.imports[10]": "data.toString", "source.imports[11]": "hostname", "source.imports[12]": "myUuid", "source.imports[13]": "net", "source.imports[14]": "os", "source.imports[15]": "os.hostname", "source.imports[16]": "require", "source.imports[17]": "shell", "source.imports[18]": "uuid", "source.imports[19]": "uuid.v4", "source.functions[0]": "anonymous" } }, "find": [ { "id": "objectives/supply-chain/trojanized/library/framework::require-os", "conf": 1.0, "crit": 1, "desc": "require os" }, { "id": "micro-behaviors/communications/ftp/client::connect-call", "atk": "T1071.002", "mbc": "C0004", "conf": 0.4000000059604645, "crit": 1, "desc": ".connect() method call (any object, composite-only)" }, { "id": "micro-behaviors/data/text/keywords/lexicon::target-codebase", "conf": 0.8799999952316284, "crit": 1, "desc": "Codebase deletion target" }, { "id": "metadata/file/extension::web-asset-extension", "conf": 1.0, "crit": 1, "desc": "Web asset file extension (css/html/js/json)" }, { "id": "objectives/supply-chain/install-hook/init::top-level-require-method-call", "atk": "T1195.002", "mbc": "B0024", "conf": 0.8999999761581421, "crit": 1, "desc": "Top-level method call on require() result" }, { "id": "micro-behaviors/data/serialize/json::json-parse-call", "crit": 2, "desc": "JSON.parse call" }, { "id": "metadata/lang/scripted::js-require-binding", "conf": 0.4000000059604645, "crit": 1, "desc": "CommonJS require() binding declaration" }, { "id": "metadata/file/text/metrics::file-has-30-plus-lines", "conf": 0.8999999761581421, "crit": 1, "desc": "File has 30 or more lines" }, { "id": "metadata/lang/source::js-ts-source-basename", "conf": 0.949999988079071, "crit": 2, "desc": "JavaScript or TypeScript basename" }, { "id": "micro-behaviors/data/serialize/json::json-stringify-call", "crit": 2, "desc": "JSON.stringify call" }, { "id": "metadata/lang/scripted::require-symbol", "conf": 1.0, "crit": 1, "desc": "CommonJS require symbol" }, { "id": "micro-behaviors/communications/ipc/unix-socket::net-module-import", "conf": 0.800000011920929, "crit": 1, "desc": "Node net module import" }, { "id": "micro-behaviors/os/console/io::js-console-object", "conf": 1.0, "crit": 1, "desc": "JavaScript console object" }, { "id": "micro-behaviors/data/encode/tostring::tostring-token", "conf": 1.0, "crit": 1, "desc": "toString method token" }, { "id": "objectives/discovery/system/profile::host-profile-hostname-field", "conf": 0.4000000059604645, "crit": 1, "desc": "\"hostname\" word — composite-only fragment" }, { "id": "micro-behaviors/data/encode/tostring::tostring-call", "conf": 1.0, "crit": 1, "desc": ".toString() method call" }, { "id": "metadata/lang/encoded/unicode-escape::javascript-or-dll-basename", "conf": 1.0, "crit": 1, "desc": "JavaScript file basename" }, { "id": "micro-behaviors/communications/socket/connect::net-socket-connect-method", "conf": 0.8500000238418579, "crit": 3, "desc": "Node net.Socket.connect method" }, { "id": "objectives/command-and-control/reverse-shell/dup::new-net-socket", "atk": "T1059", "conf": 0.75, "crit": 3, "desc": "new net.Socket creation" }, { "id": "objectives/exfiltration/sensitive-data::json-stringify-creds-body", "atk": "T1041", "mbc": "B0030", "conf": 0.8600000143051147, "crit": 1, "desc": "JSON body includes credential field" }, { "id": "micro-behaviors/os/sysinfo/hostname::os-hostname-call", "atk": "T1082", "conf": 0.75, "crit": 3, "desc": "os.hostname() call" }, { "id": "objectives/command-and-control/remote-command/control::websocket-host-env-send--rx-8", "atk": "T1059.007", "conf": 0.8999999761581421, "crit": 1, "desc": "Regex component marker" }, { "id": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-3", "conf": 0.800000011920929, "crit": 1, "desc": "key=/config= followed by shell metachar" }, { "id": "objectives/supply-chain/metadata-anomaly/package/npm::require-os-dup", "conf": 0.699999988079071, "crit": 1, "desc": "require('os') import" }, { "id": "objectives/command-and-control/reverse-shell/dup::on-data-event", "atk": "T1059", "conf": 0.7799999713897705, "crit": 1, "desc": "Socket data event handler" }, { "id": "metadata/file/text/metrics::few-comment-lines", "crit": 1, "desc": "Five or fewer comment lines in file" }, { "id": "objectives/execution/lure/clipboard::ajax-message-field", "atk": "T1204.001", "conf": 0.4000000059604645, "crit": 1, "desc": "\"message:\" object key — composite-only fragment" }, { "id": "metadata/file/text/metrics::javascript-small-file-5k", "conf": 0.699999988079071, "crit": 1, "desc": "JavaScript file under 5KB" } ], "path": "client.js", "risk": 3, "size": 1157, "type": "javascript" } ] } }