{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9940488338470459, "class": 2 } ], "prob": 0.99404883, "class": 2, "oprob": 0.96714664, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T23:49:26Z" }, "path": "482878", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₀(C₉Ca₅CoDy₂P₂As₈Er₄IPr₂S)H₆(Cm₃Db₂F₂Os₅Po₅Ds)Md₄(SiBi₄Pa₂)Th₅", "x": 702, "id": 0, "is": [ "CreateFileA", "ReadFile", "CloseHandle", "WriteFile", "lstrlenA", "GlobalLock", "GlobalUnlock", "LocalFree", "LocalAlloc", "GetTickCount", "lstrcpyA", "lstrcatA", "GetFileAttributesA", "ExpandEnvironmentStringsA", "GetFileSize", "CreateFileMappingA", "MapViewOfFile", "UnmapViewOfFile", "LoadLibraryA", "GetProcAddress", "GetTempPathA", "CreateDirectoryA", "DeleteFileA", "GetCurrentProcess", "WideCharToMultiByte", "GetLastError", "lstrcmpA", "CreateToolhelp32Snapshot", "Process32First", "OpenProcess", "Process32Next", "FindFirstFileA", "lstrcmpiA", "FindNextFileA", "FindClose", "GetModuleHandleA", "GetVersionExA", "GetLocaleInfoA", "GetSystemInfo", "GetWindowsDirectoryA", "GetPrivateProfileStringA", "SetCurrentDirectoryA", "GetPrivateProfileSectionNamesA", "GetPrivateProfileIntA", "GetCurrentDirectoryA", "lstrlenW", "MultiByteToWideChar", "Sleep", "GetModuleFileNameA", "LCMapStringA", "ExitProcess", "RegOpenKeyExA", "RegQueryValueExA", "RegCloseKey", "RegOpenKeyA", "RegEnumKeyExA", "RegCreateKeyA", "RegSetValueExA", "IsTextUnicode", "RegOpenCurrentUser", "RegEnumValueA", "GetUserNameA", "CreateStreamOnHGlobal", "GetHGlobalFromStream", "CoCreateGuid", "CoTaskMemFree", "CoCreateInstance", "OleInitialize", "ShellExecuteA", "StrStrIA", "StrRChrIA", "StrToIntA", "StrStrA", "StrCmpNIA", "StrStrIW", "wsprintfA", "LoadUserProfileA", "UnloadUserProfile", "InternetCrackUrlA", "InternetCreateUrlA", "inet_addr", "gethostbyname", "socket", "connect", "closesocket", "send", "select", "recv", "setsockopt", "WSAStartup" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1545409170.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 102400.0, "timestamp_day": 21.0, "file_alignment": 512.0, "timestamp_year": 2018.0, "characteristics": 271.0, "entry_point_rva": 66669.0, "size_of_headers": 4096.0, "timestamp_month": 12.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 9.0, "computed_checksum": 138826.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "linker_major_version": 2.0, "linker_minor_version": 50.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 72192.0, "file_size": 92160.0, "entry_point": 66669.0, "code_entropy": 6.05, "data_entropy": 4.16, "import_count": 90.0, "string_count": 816.0, "section_count": 3.0, "avg_complexity": 5.06, "function_count": 433.0, "import_density": 1.28, "max_complexity": 107.0, "string_density": 11.57, "overall_entropy": 4.79, "avg_basic_blocks": 7.79, "avg_section_size": 30549.33, "dependency_count": 9.0, "entropy_variance": 1.27, "function_density": 6.14, "avg_function_size": 164.31, "avg_string_length": 14.32, "complexity_per_kb": 0.07, "max_string_length": 239.0, "wide_string_count": 1.0, "writable_sections": 1.0, "avg_string_entropy": 3.02, "code_to_data_ratio": 3.71, "data_to_file_ratio": 0.21, "entry_point_is_rva": true, "text_to_file_ratio": 0.78, "total_basic_blocks": 3373.0, "executable_sections": 1.0, "string_length_stddev": 15.6, "largest_section_ratio": 0.78, "sentence_string_count": 61.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.data" ], [ 3846, "5EHA" ], [ 8162, "PSQRWV" ], [ 8301, "VWPSQR" ], [ 64075, "UVW3" ], [ 70249, "33331" ], [ 72233, "PPSV" ], [ 72704, "aPLib v1.01 - the smaller the better :)\r\nCopyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved.\r\n\r\nMore information: h" ], [ 72708, "aPLib v1.01 - the smaller the better :)" ], [ 72751, "Copyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved." ], [ 72817, "More information: http://www.ibsensoftware.com/" ], [ 73216, "123456" ], [ 73223, "password" ], [ 73238, "qwerty" ], [ 73245, "12345" ], [ 73251, "jesus" ], [ 73266, "1234" ], [ 73271, "abc123" ], [ 73278, "letmein" ], [ 73286, "test" ], [ 73291, "love" ], [ 73300, "password1" ], [ 73310, "hello" ], [ 73316, "monkey" ], [ 73323, "dragon" ], [ 73330, "trustno1" ], [ 73346, "iloveyou" ], [ 73355, "1234567" ], [ 73363, "shadow" ], [ 73380, "christ" ], [ 73387, "sunshine" ], [ 73396, "master" ], [ 73403, "computer" ], [ 73412, "princess" ], [ 73421, "tigger" ], [ 73428, "football" ], [ 73437, "angel" ], [ 73443, "jesus1" ], [ 73450, "123123" ], [ 73457, "whatever" ], [ 73466, "freedom" ], [ 73474, "killer" ], [ 73486, "soccer" ], [ 73493, "superman" ], [ 73502, "michael" ], [ 73510, "cheese" ], [ 73517, "internet" ], [ 73526, "joshua" ], [ 73533, "fuckyou" ], [ 73541, "blessed" ], [ 73549, "baseball" ], [ 73558, "starwars" ], [ 73574, "purple" ], [ 73581, "jordan" ], [ 73588, "faith" ], [ 73594, "summer" ], [ 73601, "ashley" ], [ 73608, "buster" ], [ 73615, "heaven" ], [ 73622, "pepper" ], [ 73637, "hunter" ], [ 73644, "lovely" ], [ 73651, "andrew" ], [ 73658, "thomas" ], [ 73665, "angels" ], [ 73672, "charlie" ], [ 73680, "daniel" ], [ 73692, "jennifer" ], [ 73701, "single" ], [ 73708, "hannah" ], [ 73715, "qazwsx" ], [ 73728, "matrix" ], [ 73747, "654321" ], [ 73754, "amanda" ], [ 73761, "nothing" ], [ 73769, "ginger" ], [ 73776, "mother" ], [ 73783, "snoopy" ], [ 73790, "jessica" ], [ 73798, "welcome" ], [ 73806, "pokemon" ], [ 73814, "iloveyou1" ], [ 73830, "mustang" ], [ 73838, "helpme" ], [ 73845, "justin" ], [ 73852, "jasmine" ], [ 73860, "orange" ], [ 73867, "testing" ], [ 73875, "apple" ], [ 73881, "michelle" ], [ 73890, "peace" ], [ 73896, "secret" ], [ 73905, "grace" ], [ 73911, "william" ], [ 73919, "iloveyou2" ], [ 73929, "nicole" ], [ 73943, "muffin" ], [ 73950, "gateway" ], [ 73958, "fuckyou1" ], [ 73967, "asshole" ], [ 73975, "hahaha" ], [ 73982, "poop" ], [ 73987, "blessing" ], [ 73996, "blahblah" ], [ 74005, "myspace1" ], [ 74014, "matthew" ], [ 74022, "canada" ], [ 74029, "silver" ], [ 74036, "robert" ], [ 74043, "forever" ], [ 74051, "asdfgh" ], [ 74058, "rachel" ], [ 74065, "rainbow" ], [ 74073, "guitar" ], [ 74080, "peanut" ], [ 74087, "batman" ], [ 74094, "cookie" ], [ 74101, "bailey" ], [ 74108, "soccer1" ], [ 74116, "mickey" ], [ 74123, "biteme" ], [ 74130, "hello1" ], [ 74137, "eminem" ], [ 74144, "dakota" ], [ 74151, "samantha" ], [ 74160, "compaq" ], [ 74167, "diamond" ], [ 74175, "taylor" ], [ 74182, "forum" ], [ 74188, "john316" ], [ 74196, "richard" ], [ 74204, "blink182" ], [ 74213, "peaches" ], [ 74221, "cool" ], [ 74226, "flower" ], [ 74233, "scooter" ], [ 74241, "banana" ], [ 74248, "james" ], [ 74254, "asdfasdf" ], [ 74263, "victory" ], [ 74271, "london" ], [ 74278, "123qwe" ], [ 74285, "123321" ], [ 74292, "startrek" ], [ 74301, "george" ], [ 74308, "winner" ], [ 74315, "maggie" ], [ 74322, "trinity" ], [ 74330, "online" ], [ 74337, "123abc" ], [ 74344, "chicken" ], [ 74352, "junior" ], [ 74365, "passw0rd" ], [ 74374, "austin" ], [ 74381, "sparky" ], [ 74388, "admin" ], [ 74394, "merlin" ], [ 74401, "google" ], [ 74408, "friends" ], [ 74416, "hope" ], [ 74421, "shalom" ], [ 74428, "nintendo" ], [ 74437, "looking" ], [ 74445, "harley" ], [ 74452, "smokey" ], [ 74464, "joseph" ], [ 74477, "digital" ], [ 74487, "thunder" ], [ 74495, "spirit" ], [ 74502, "bandit" ], [ 74509, "enter" ], [ 74515, "anthony" ], [ 74523, "corvette" ], [ 74532, "hockey" ], [ 74539, "power" ], [ 74545, "benjamin" ], [ 74571, "viper" ], [ 74577, "genesis" ], [ 74585, "knight" ], [ 74592, "qwerty1" ], [ 74600, "creative" ], [ 74609, "foobar" ], [ 74616, "adidas" ], [ 74623, "rotimi" ], [ 74630, "slayer" ], [ 74637, "wisdom" ], [ 74644, "praise" ], [ 74651, "zxcvbnm" ], [ 74659, "samuel" ], [ 74666, "mike" ], [ 74671, "dallas" ], [ 74678, "green" ], [ 74684, "testtest" ], [ 74693, "maverick" ], [ 74702, "onelove" ], [ 74710, "david" ], [ 74716, "mylove" ], [ 74723, "church" ], [ 74730, "friend" ], [ 74741, "destiny" ], [ 74749, "none" ], [ 74754, "microsoft" ], [ 74771, "bubbles" ], [ 74788, "cocacola" ], [ 74797, "jordan23" ], [ 74806, "ilovegod" ], [ 74815, "football1" ], [ 74825, "loving" ], [ 74832, "nathan" ], [ 74839, "emmanuel" ], [ 74848, "scooby" ], [ 74855, "fuckoff" ], [ 74869, "maxwell" ], [ 74877, "jason" ], [ 74902, "red123" ], [ 74909, "blabla" ], [ 74916, "prince" ], [ 74929, "chelsea" ], [ 74943, "angel1" ], [ 74950, "hardcore" ], [ 74959, "dexter" ], [ 74966, "saved" ], [ 74972, "112233" ], [ 74979, "hallo" ], [ 74985, "jasper" ], [ 74992, "danielle" ], [ 75001, "kitten" ], [ 75008, "cassie" ], [ 75015, "stella" ], [ 75022, "prayer" ], [ 75029, "hotdog" ], [ 75036, "windows" ], [ 75044, "mustdie" ], [ 75052, "gates" ], [ 75058, "billgates" ], [ 75105, "http://prv.coins.me/gate.php" ], [ 75135, "http://prv.coins.me/" ], [ 75157, "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0" ], [ 75201, "68.85.1.1:19791" ], [ 75203, "MODU" ], [ 75217, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" ], [ 75269, "UninstallString" ], [ 75285, "DisplayName" ], [ 75307, ".exe" ], [ 75312, "Software\\WinRAR" ], [ 75328, "open" ], [ 75337, "kernel32.dll" ], [ 75350, "WTSGetActiveConsoleSessionId" ], [ 75379, "ProcessIdToSessionId" ], [ 75401, "netapi32.dll" ], [ 75414, "NetApiBufferFree" ], [ 75431, "NetUserEnum" ], [ 75444, "ole32.dll" ], [ 75454, "StgOpenStorage" ] ], "sz": 92160, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "c": 0.8999999761581421, "d": "Fareit Payload", "e": [ "$string1" ], "i": "third_party/CAPE/Fareit", "l": 5 }, { "c": 0.8999999761581421, "d": "Pony stealer malware", "e": [ "signons.sqlite", "signons.txt", "signons2.txt", "signons3.txt", "WininetCacheCredentials", "moz_logins", "encryptedPassword", "FlashFXP", "FlashFXP", "FlashFXP", "FlashFXP", "FlashFXP", "BulletProof", "BulletProof", "BulletProof", "BulletProof" ], "i": "third_party/BinaryAlert/Windows/Pony/Stealer", "l": 5 }, { "c": 0.8999999761581421, "d": "autogenerated rule brought to you by yara-signator", "e": [ "$sequence_0", "$sequence_1", "$sequence_2", "$sequence_3", "$sequence_4", "$sequence_5", "$sequence_6", "$sequence_7", "$sequence_8", "$sequence_9" ], "i": "third_party/Malpedia/Win/Pony/Auto", "l": 5 }, { "c": 0.8999999761581421, "d": "Detects executables referencing many file transfer clients. Observed in information stealers", "e": [ "FTPWare\\COREFTP\\Sites", "Far\\Plugins\\FTP\\", "Far2\\Plugins\\FTP\\", "Ghisler\\Total Commander", "LinasFTP\\Site Manager", "FTP Explorer\\", "FTP Explorer\\", "FTP Explorer\\", "Far\\SavedDialogHistory\\", "Far2\\SavedDialogHistory\\", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP " ], "i": "third_party/Ditekshen/INDICATOR/SUSPICIOUS/EXE/Referenfces/File/Transfer/Clients", "l": 5 }, { "c": 0.8999999761581421, "e": [ "\\Global Downloader", "wiseftpsrvs.bin", "SiteServer %d\\SFTP", "%s\\Keychain", "Connections.txt", "ftpshell.fsi", "inetcomm server passwords" ], "i": "third_party/elastic/Windows_Trojan_Pony/windows/trojan/pony", "l": 5 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims FileZilla", "e": [ "filezilla", "FileZilla", "FileZilla" ], "i": "metadata/package/tooling::tool-identity-filezilla", "l": 1 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "GET %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…", "POST %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "HTTP Connection close header", "e": [ "Connection: close" ], "i": "objectives/command-and-control/channel/http-beacon::http-connection-close-header", "l": 1, "m": "B0030" }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla sitemanager.xml config", "e": [ "\\sitemanager.xml" ], "i": "objectives/credential-access/ftp/filezilla::sitemanager-xml", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 433.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "Firefox", "Firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.02" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA", "sub.KERNEL32.DLL_GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "CONSTRAINT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla recentservers.xml config", "e": [ "\\recentservers.xml" ], "i": "objectives/credential-access/ftp/filezilla::recentservers-xml", "l": 1 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "c": 0.8999999761581421, "d": "sqlite3 string", "e": [ "sqlite3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite3-string", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 433.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "Connect", "Connect", "Connect", "Connect", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock send import", "e": [ "send" ], "i": "micro-behaviors/communications/socket/init::send-api", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "d": "Content-Type header string", "e": [ "…%lu\r\nConnection: close\r\nContent-Type: application/octet-strea…", "Content-Type: application/octet-stream" ], "i": "micro-behaviors/communications/http/request::content-type-header", "l": 1 }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry subkeys via import", "e": [ "RegEnumKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-enum-key-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.79" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Opera.HTML\\shell\\open\\command", "FTP++.Link\\shell\\open\\command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "c": 0.8500000238418579, "d": "PuTTY identity string", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/supply-chain/trojanized/application/monitor::putty-identity-string", "l": 1 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "secret" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://prv.coins.me/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-endpoint-url", "l": 1 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Java DPAPI unprotect call", "e": [ "UnprotectData" ], "i": "objectives/credential-access/discord/token::java-crypt-unprotect-data", "l": 1 }, { "a": "T1105", "c": 0.800000011920929, "d": "Numbered DAT payload filename", "e": [ "ESTdb2.dat" ], "i": "objectives/command-and-control/dropper/staging::numbered-dat-payload-name", "l": 1, "m": "B0024" }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "Task Manager process enumeration", "e": [ "Process32Next" ], "i": "micro-behaviors/process/terminate/kill::taskmgr-process-enum", "l": 3, "m": "B0001" }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 3373.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "a": "T1552.004", "c": 0.75, "d": "Remote Desktop Protocol extension", "e": [ ".rdp" ], "i": "objectives/collection/file-targeting/filter::rdp-extension", "l": 3, "m": "B0024" }, { "c": 0.8999999761581421, "d": "SQLite format header", "e": [ "SQLite format 3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite-format", "l": 3 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1071.001", "d": "Old Mozilla 4.0 User-Agent", "e": [ "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)", "…ion: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …", "…ng: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …" ], "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer.exe" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.9599999785423279, "d": "Elex Internet Explorer product resource", "e": [ "Internet Explorer" ], "i": "well-known/malware/trojan/elex/worm::elex-internet-explorer-product-resource", "l": 2 }, { "a": "T1485", "c": 0.699999988079071, "d": "Windows Shell Folders registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], "i": "objectives/impact/destroy/file-deletion::shell-folders-personal-targeting", "l": 2, "m": "C0047" }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "a": "T1555.003", "c": 0.8999999761581421, "d": "Firefox logins database", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "micro-behaviors/fs/path/sensitive/browser::firefox-logins", "l": 3 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:", "User-Agent:", "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 92160.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0", "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize Winsock library", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::wsa-startup", "l": 3 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-a-symbol", "l": 2 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.75, "d": "INI extension marker", "e": [ ".ini" ], "i": "well-known/malware/trojan/elex/lpadv::ini-extension", "l": 1 }, { "a": "T1041", "c": 0.6000000238418579, "d": "PHP gate endpoint", "e": [ "http://prv.coins.me/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-gate", "l": 4, "m": "C0002" }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "a": "T1071.001", "c": 0.6600000262260437, "d": "Accept-Encoding header", "e": [ "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConne…", "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConte…", "Accept-Encoding: identity, *;q=0" ], "i": "micro-behaviors/communications/http/headers::headers-encoding", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082" }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 102400.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext hello beacon token", "e": [ "hello" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-hello-beacon-token", "l": 1, "m": "B0025" }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.05)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "a": "T1555", "c": 0.8500000238418579, "d": "FileZilla application directory", "e": [ "Software\\FileZilla Client", "Software\\FileZilla" ], "i": "objectives/credential-access/ftp/filezilla::application-path", "l": 1 }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "c": 0.8999999761581421, "d": "High-risk token privilege name", "e": [ "SeImpersonatePrivilege", "SeTcbPrivilege", "SeAssignPrimaryTokenPrivilege" ], "i": "objectives/privilege-escalation/token-manipulation::dangerous-privilege-name", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "a": "T1036.005", "c": 0.75, "d": "C2 gate.php endpoint", "e": [ "gate.php" ], "i": "objectives/command-and-control/beacon/network::c2-gate-php-endpoint", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.79" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "binary.section_count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Suspicious PHP endpoint URL (gate/upload/etc)", "e": [ "http://prv.coins.me/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::suspicious-php-filename", "l": 4, "m": "C0002" }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox PK11SDR_Decrypt function", "e": [ "PK11SDR_Decrypt" ], "i": "objectives/credential-access/browser/firefox::pk11-decrypt", "l": 4, "m": "B0028" }, { "c": 0.8999999761581421, "d": "Winsock socket creation import", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::socket-api", "l": 3 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 816.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.0\r\nHost: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "a": "T1071.001", "c": 0.7799999713897705, "d": "HTTP POST request line", "e": [ "POST %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/post::post-request-line", "l": 3, "m": "C0002" }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla main config file", "e": [ "\\filezilla.xml" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-xml", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "a": "T1555.003", "c": 0.699999988079071, "d": "Chromium Login Data database reference", "e": [ "Login Data" ], "i": "objectives/credential-access/browser/chromium::logins-table", "l": 3 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Microsoft", "Software", "FreeSid", "CredFree", "Documents", "AppData", "Local", "Cache", "Cookies", "History", "Common", "Pictures", "Common", "Common", "Tools", "Personal" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 5.06" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1548.002", "c": 0.699999988079071, "d": "Shell Open command registry key", "e": [ "\\shell\\open\\command" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/hijack::shell-open-command-reg", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock outbound connect import", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::connect-api", "l": 3 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1545409170.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry values via import", "e": [ "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims PuTTY", "e": [ "PuTTY" ], "i": "metadata/package/tooling::tool-identity-putty", "l": 1 }, { "a": "T1036.005", "c": 0.800000011920929, "d": "explorer.exe process name", "e": [ "explorer.exe" ], "i": "objectives/evasion/masquerade/process::explorer-name", "l": 1, "m": "F0004" }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "2f 4b 41 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "d": "password keyword", "e": [ "MS IE FTP Passwords", "LastPassword", "\u003cPOP3_Password2", "_Password", "_FtpPassword", "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins", "Password", "password 51:b:", "PasswordType", "password", "\"password\" : \"", "password1", "password_value", "FTP destination password", "FtpPassword", "PassWord" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 433.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "WSAStartup import", "e": [ "WSAStartup" ], "i": "well-known/malware/trojan/hijack-gen::padodor-wsa-startup-import", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "…ntent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible…", "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)", "…q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible…" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1 }, { "c": 0.7799999713897705, "d": "HTTP URL prefix marker", "e": [ "http://" ], "i": "well-known/malware/trojan/elex/lpadv::http-prefix", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock receive import", "e": [ "recv" ], "i": "micro-behaviors/communications/socket/init::recv-api", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 90.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "My Pictures" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}", "{9EA55529-E122-4757-BC79-E4825F80732C}", "{11C1D741-A95B-11d2-8A80-0080ADB32FF4}", "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}", "{74FF1730-B1F2-4D88-926B-1568FAE61DB7}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "a": "T1546.015", "c": 0.8199999928474426, "d": "InprocServer32 registry write", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32" ], "i": "objectives/persistence/system/registry/com-hijack::inprocserver32-write", "l": 3 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 433.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1082", "c": 0.699999988079071, "d": "hwid string", "e": [ "HWID" ], "i": "objectives/discovery/system/fingerprint/machine-id::hwid-string", "l": 1 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.78" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox moz_logins SQL query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "objectives/credential-access/browser/firefox::moz-logins-sql", "l": 4, "m": "B0028" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ProcessIdToSessionId", "AllocateAndInitializeSid", "CheckTokenMembership", "ImpersonateLoggedOnUser", "ConvertSidToStringSidA", "AdjustTokenPrivileges", "CryptAcquireCertificatePrivateKey", "GetNativeSystemInfo", "WininetCacheCredentials", "WideCharToMultiByte", "GetWindowsDirectoryA", "GetPrivateProfileStringA", "SetCurrentDirectoryA", "GetPrivateProfileSectionNamesA", "GetPrivateProfileIntA", "GetCurrentDirectoryA" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 0.75, "d": "PHP URL endpoint (often used for C2)", "e": [ "http://prv.coins.me/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-url", "l": 3, "m": "C0002" }, { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "l": 3, "m": "E1057" }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "a": "T1552.004", "c": 0.800000011920929, "d": "PuTTY sessions registry reference", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/credential-access/ssh/key::putty-sessions", "l": 4 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8799999952316284, "d": "CLSID registry path manipulation", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}" ], "i": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "l": 3 }, { "c": 0.949999988079071, "d": "links user32.dll (wsprintfA)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shell32.dll (ShellExecuteA)", "e": [ "shell32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateGuid, CoTaskMemFree, CoCreateInstance, ... +1 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links wininet.dll (InternetCrackUrlA, InternetCreateUrlA)", "e": [ "wininet.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links userenv.dll (LoadUserProfileA, UnloadUserProfile)", "e": [ "userenv.dll" ], "i": "metadata/dylib::userenv/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links wsock32.dll (inet_addr, gethostbyname, socket, connect, closesocket, ... +5 more)", "e": [ "wsock32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegOpenKeyA, RegEnumKeyExA, ... +6 more)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shlwapi.dll (StrStrIA, StrRChrIA, StrToIntA, StrStrA, StrCmpNIA, ... +1 more)", "e": [ "shlwapi.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (CreateFileA, ReadFile, CloseHandle, WriteFile, lstrlenA, ... +46 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "a": "T1555", "c": 0.949999988079071, "d": "FileZilla credential stealer detected", "e": [ "Software\\FileZilla", "\\recentservers.xml", "\\filezilla.xml", "\\sitemanager.xml", "Software\\FileZilla Client" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-stealer", "l": 4 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindClose", "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "WriteFile", "GetTempPathA", "ShellExecuteA" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "c": 0.9200000166893005, "d": "Winsock client symbol lifecycle", "e": [ "socket", "connect", "recv", "send" ], "i": "micro-behaviors/communications/socket/init::winsock-client-symbol-lifecycle", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "ReadFile", "GetFileSize", "CreateFileA", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "DeleteFileA", "DeleteFileA", "GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegSetValueExA", "RegOpenKeyExA", "RegCreateKeyA", "RegOpenKeyA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyA", "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1057", "c": 0.8999999761581421, "d": "ToolHelp snapshot enumeration with process access", "e": [ "CreateToolhelp32Snapshot", "OpenProcess" ], "i": "objectives/discovery/process/targeting::toolhelp-enumeration-with-access", "l": 3, "m": "E1057" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key enumeration API chain", "e": [ "RegOpenKeyExA", "RegOpenKeyA", "RegEnumKeyExA", "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::registry-enumeration-api-chain", "l": 3 }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 } ], "sha": "9a0c64ed01cbeecb5fca29a17fd91ae38e8ce4e64588b0ecc889c1ddfa142569", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/482878", "type": "pe" } ], "tv": "2a0fe" } }