{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.8344548940658569, "class": 0 } ], "prob": 0.8344549, "class": 0, "models": [ { "m": "az", "prob": 0.8344549, "class": 0 }, { "m": "az/native", "prob": 0.07716687, "class": 0 }, { "m": "az/elf", "prob": 0.032098766, "class": 0 } ], "version": "v16.16", "thresholds": [ 0.9979839, 1.0 ], "analyzed_at": "2026-05-11T02:46:47Z" }, "path": "exec", "raw": { "v": "4", "fs": [ { "f": "H(Cm)Md(He)", "k": { "elf.relro": "partial", "elf.abi.os": "linux", "elf.comment": "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005", "build.distro": "ubuntu", "elf.rpath[0]": "/home/kod/bbn/libssh-0.7.4/build/src", "elf.needed[0]": "libssh.so.4", "elf.needed[1]": "libc.so.6", "build.username": "kod", "debug.build_id": "8f36d2f2b4dc80e4c1513516eb7f8f83d905cb01", "build.toolchain": "gcc 6.2.0", "build.user_home": "/home/kod", "elf.interpreter": "/lib64/ld-linux-x86-64.so.2", "build.build_root": "/home/kod/bbn/libssh-0.7.4/build", "elf.dt_flags.now": true, "elf.dt_flags.pie": true, "build.target_arch": "x86_64", "elf.entry_section": ".text", "elf.abi.min_kernel": "2.6.32", "elf.dt_flags.raw_1": 134217729, "elf.dt_flags_1.now": true, "elf.dt_flags_1.pie": true, "build.username_from": "byte_scan", "build.source_paths[0]": "/home/kod/bbn/libssh-0.7.4/build/src", "elf.segments[0].perms": "r-x", "elf.segments[1].perms": "r--", "elf.segments[2].perms": "r-x", "elf.segments[3].perms": "rw-", "elf.segments[4].perms": "rw-", "elf.segments[5].perms": "r--", "elf.segments[6].perms": "r--", "elf.segments[7].perms": "rw-", "elf.segments[8].perms": "r--", "build.toolchain_family": "gcc", "elf.comment_entries[0]": "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005", "elf.fini_array[0].addr": "0x1800", "elf.gnu_abi_min_kernel": "2.6.32", "elf.init_array[0].addr": "0x1840", "elf.segments[0].p_type": "PT_PHDR", "elf.segments[1].p_type": "PT_INTERP", "elf.segments[2].p_type": "PT_LOAD", "elf.segments[3].p_type": "PT_LOAD", "elf.segments[4].p_type": "PT_DYNAMIC", "elf.segments[5].p_type": "PT_NOTE", "elf.segments[6].p_type": "PT_GNU_EH_FRAME", "elf.segments[7].p_type": "PT_GNU_STACK", "elf.segments[8].p_type": "PT_GNU_RELRO", "elf.segments[0].p_memsz": 504, "elf.segments[0].p_vaddr": 64, "elf.segments[1].p_memsz": 28, "elf.segments[1].p_vaddr": 568, "elf.segments[2].p_memsz": 11300, "elf.segments[3].p_memsz": 1024, "elf.segments[3].p_vaddr": 2112536, "elf.segments[4].p_memsz": 480, "elf.segments[4].p_vaddr": 2112560, "elf.segments[5].p_memsz": 68, "elf.segments[5].p_vaddr": 596, "elf.segments[6].p_memsz": 92, "elf.segments[6].p_vaddr": 10804, "elf.segments[8].p_memsz": 1000, "elf.segments[8].p_vaddr": 2112536, "elf.dynsym_funcs[0].kind": "func", "elf.dynsym_funcs[0].name": "__cxa_finalize", "elf.dynsym_funcs[1].kind": "func", "elf.dynsym_funcs[1].name": "__errno_location", "elf.dynsym_funcs[2].kind": "func", "elf.dynsym_funcs[2].name": "__libc_start_main", "elf.dynsym_funcs[3].kind": "func", "elf.dynsym_funcs[3].name": "__stack_chk_fail", "elf.dynsym_funcs[4].kind": "func", "elf.dynsym_funcs[4].name": "fgets", "elf.dynsym_funcs[5].kind": "func", "elf.dynsym_funcs[5].name": "fprintf", "elf.dynsym_funcs[6].kind": "func", "elf.dynsym_funcs[6].name": "fputs", "elf.dynsym_funcs[7].kind": "func", "elf.dynsym_funcs[7].name": "fwrite", "elf.dynsym_funcs[8].kind": "func", "elf.dynsym_funcs[8].name": "memset", "elf.dynsym_funcs[9].kind": "func", "elf.dynsym_funcs[9].name": "printf", "elf.segments[0].p_filesz": 504, "elf.segments[0].p_offset": 64, "elf.segments[1].p_filesz": 28, "elf.segments[1].p_offset": 568, "elf.segments[2].p_filesz": 11300, "elf.segments[3].p_filesz": 1016, "elf.segments[3].p_offset": 15384, "elf.segments[4].p_filesz": 480, "elf.segments[4].p_offset": 15408, "elf.segments[5].p_filesz": 68, "elf.segments[5].p_offset": 596, "elf.segments[6].p_filesz": 92, "elf.segments[6].p_offset": 10804, "elf.segments[8].p_filesz": 1000, "elf.segments[8].p_offset": 15384, "elf.dynsym_funcs[10].kind": "func", "elf.dynsym_funcs[10].name": "puts", "elf.dynsym_funcs[11].kind": "func", "elf.dynsym_funcs[11].name": "ssh_channel_close", "elf.dynsym_funcs[12].kind": "func", "elf.dynsym_funcs[12].name": "ssh_channel_free", "elf.dynsym_funcs[13].kind": "func", "elf.dynsym_funcs[13].name": "ssh_channel_new", "elf.dynsym_funcs[14].kind": "func", "elf.dynsym_funcs[14].name": "ssh_channel_open_session", "elf.dynsym_funcs[15].kind": "func", "elf.dynsym_funcs[15].name": "ssh_channel_read", "elf.dynsym_funcs[16].kind": "func", "elf.dynsym_funcs[16].name": "ssh_channel_request_exec", "elf.dynsym_funcs[17].kind": "func", "elf.dynsym_funcs[17].name": "ssh_channel_send_eof", "elf.dynsym_funcs[18].kind": "func", "elf.dynsym_funcs[18].name": "ssh_clean_pubkey_hash", "elf.dynsym_funcs[19].kind": "func", "elf.dynsym_funcs[19].name": "ssh_connect", "elf.dynsym_funcs[20].kind": "func", "elf.dynsym_funcs[20].name": "ssh_disconnect", "elf.dynsym_funcs[21].kind": "func", "elf.dynsym_funcs[21].name": "ssh_finalize", "elf.dynsym_funcs[22].kind": "func", "elf.dynsym_funcs[22].name": "ssh_free", "elf.dynsym_funcs[23].kind": "func", "elf.dynsym_funcs[23].name": "ssh_get_error", "elf.dynsym_funcs[24].kind": "func", "elf.dynsym_funcs[24].name": "ssh_get_hexa", "elf.dynsym_funcs[25].kind": "func", "elf.dynsym_funcs[25].name": "ssh_get_issue_banner", "elf.dynsym_funcs[26].kind": "func", "elf.dynsym_funcs[26].name": "ssh_get_publickey", "elf.dynsym_funcs[27].kind": "func", "elf.dynsym_funcs[27].name": "ssh_get_publickey_hash", "elf.dynsym_funcs[28].kind": "func", "elf.dynsym_funcs[28].name": "ssh_getpass", "elf.dynsym_funcs[29].kind": "func", "elf.dynsym_funcs[29].name": "ssh_is_server_known", "elf.dynsym_funcs[30].kind": "func", "elf.dynsym_funcs[30].name": "ssh_key_free", "elf.dynsym_funcs[31].kind": "func", "elf.dynsym_funcs[31].name": "ssh_new", "elf.dynsym_funcs[32].kind": "func", "elf.dynsym_funcs[32].name": "ssh_options_set", "elf.dynsym_funcs[33].kind": "func", "elf.dynsym_funcs[33].name": "ssh_print_hexa", "elf.dynsym_funcs[34].kind": "func", "elf.dynsym_funcs[34].name": "ssh_string_free_char", "elf.dynsym_funcs[35].kind": "func", "elf.dynsym_funcs[35].name": "ssh_userauth_gssapi", "elf.dynsym_funcs[36].kind": "func", "elf.dynsym_funcs[36].name": "ssh_userauth_kbdint", "elf.dynsym_funcs[37].kind": "func", "elf.dynsym_funcs[37].name": "ssh_userauth_kbdint_getinstruction", "elf.dynsym_funcs[38].kind": "func", "elf.dynsym_funcs[38].name": "ssh_userauth_kbdint_getname", "elf.dynsym_funcs[39].kind": "func", "elf.dynsym_funcs[39].name": "ssh_userauth_kbdint_getnprompts", "elf.dynsym_funcs[40].kind": "func", "elf.dynsym_funcs[40].name": "ssh_userauth_kbdint_getprompt", "elf.dynsym_funcs[41].kind": "func", "elf.dynsym_funcs[41].name": "ssh_userauth_kbdint_setanswer", "elf.dynsym_funcs[42].kind": "func", "elf.dynsym_funcs[42].name": "ssh_userauth_list", "elf.dynsym_funcs[43].kind": "func", "elf.dynsym_funcs[43].name": "ssh_userauth_none", "elf.dynsym_funcs[44].kind": "func", "elf.dynsym_funcs[44].name": "ssh_userauth_password", "elf.dynsym_funcs[45].kind": "func", "elf.dynsym_funcs[45].name": "ssh_userauth_publickey_auto", "elf.dynsym_funcs[46].kind": "func", "elf.dynsym_funcs[46].name": "ssh_write_knownhost", "elf.dynsym_funcs[47].kind": "func", "elf.dynsym_funcs[47].name": "strchr", "elf.dynsym_funcs[48].kind": "func", "elf.dynsym_funcs[48].name": "strerror", "elf.dynsym_funcs[49].kind": "func", "elf.dynsym_funcs[49].name": "strlen", "elf.dynsym_funcs[50].kind": "func", "elf.dynsym_funcs[50].name": "strncasecmp", "elf.dynsym_funcs[51].kind": "func", "elf.dynsym_funcs[51].name": "strstr", "elf.segments[0].flags_hex": "5", "elf.segments[1].flags_hex": "4", "elf.segments[2].flags_hex": "5", "elf.segments[3].flags_hex": "6", "elf.segments[4].flags_hex": "6", "elf.segments[5].flags_hex": "4", "elf.segments[6].flags_hex": "4", "elf.segments[7].flags_hex": "6", "elf.segments[8].flags_hex": "4", "elf.needed_versions[0].lib": "libc.so.6", "elf.dynsym_funcs[0].binding": "weak", "elf.stripped_metadata_sections[0]": ".note.GNU-stack", "elf.stripped_metadata_sections[1]": ".note.gnu.property", "elf.needed_versions[0].versions[0]": "GLIBC_2.2.5", "elf.needed_versions[0].versions[1]": "GLIBC_2.4" }, "x": 5, "id": 0, "is": [ "", "ssh_connect", "ssh_get_issue_banner", "printf", "ssh_userauth_gssapi", "ssh_userauth_publickey_auto", "memset", "ssh_clean_pubkey_hash", "gmon_start__", "Jv_RegisterClasses", "puts", "ssh_userauth_kbdint", "ssh_userauth_list", "ssh_get_publickey", "libc_start_main", "ssh_finalize", "ssh_options_set", "ssh_userauth_kbdint_getprompt", "ssh_string_free_char", "ssh_write_knownhost", "fgets", "ITM_deregisterTMCloneTable", "ssh_channel_request_exec", "ssh_userauth_kbdint_getnprompts", "strlen", "ssh_getpass", "ITM_registerTMCloneTable", "ssh_print_hexa", "cxa_finalize", "ssh_channel_send_eof", "stdin", "ssh_disconnect", "ssh_channel_read", "ssh_channel_open_session", "ssh_is_server_known", "ssh_userauth_password", "strerror", "strstr", "fputs", "ssh_channel_close", "ssh_userauth_kbdint_setanswer", "ssh_get_error", "strchr", "ssh_free", "errno_location", "ssh_userauth_none", "ssh_channel_free", "strncasecmp", "stack_chk_fail", "ssh_key_free", "ssh_channel_new", "ssh_get_publickey_hash", "ssh_new", "ssh_userauth_kbdint_getinstruction", "stderr", "fwrite", "ssh_get_hexa", "ssh_userauth_kbdint_getname", "fprintf", "stdout" ], "ms": { "elf": { "entry": 5952.0, "relro": "partial", "e_type": 3.0, "needed": [ "libssh.so.4", "libc.so.6" ], "rpaths": [ "/home/kod/bbn/libssh-0.7.4/build/src" ], "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "has_rpath": true, "relacount": 3.0, "class_bits": 64.0, "dt_flags_1": 134217729.0, "note_count": 2.0, "nx_enabled": true, "needed_libs": 2.0, "rpath_count": 1.0, "dynsym_count": 76.0, "has_build_id": true, "has_eh_frame": true, "has_gnu_hash": true, "stack_canary": true, "symtab_count": 126.0, "dynrela_count": 62.0, "entry_section": ".text", "little_endian": true, "section_count": 29.0, "build_id_length": 20.0, "dt_versym_count": 76.0, "has_interpreter": true, "fini_array_count": 1.0, "init_array_count": 1.0, "gnu_abi_min_kernel": "2.6.32", "comment_entry_count": 1.0, "program_header_count": 9.0, "comment_distinct_count": 1.0, "gnu_stack_section_absent": true, "load_segment_max_p_memsz": 11300.0, "load_segment_max_p_filesz": 11300.0, "stripped_but_symtab_present": true, "section_relocation_group_count": 1.0, "stripped_metadata_section_count": 2.0 }, "file": { "size": 23272.0 }, "binary": { "code_size": 4442.0, "func_count": 66.0, "has_overlay": true, "code_entropy": 3.69, "data_entropy": 2.81, "export_count": 71.0, "func_density": 15.21, "import_count": 60.0, "overlay_size": 1863.0, "string_count": 152.0, "avg_func_size": 64.61, "overlay_ratio": 0.08, "section_count": 28.0, "avg_complexity": 2.32, "import_density": 13.83, "max_complexity": 24.0, "string_density": 35.04, "aliased_exports": 63.0, "overall_entropy": 2.84, "overlay_entropy": 1.46, "avg_basic_blocks": 3.2, "avg_section_size": 597.36, "dependency_count": 2.0, "entropy_variance": 1.62, "avg_string_length": 18.81, "complexity_per_kb": 0.53, "dynsym_func_count": 62.0, "has_provenance_id": true, "max_string_length": 171.0, "avg_string_entropy": 3.17, "code_to_data_ratio": 0.36, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.17, "total_basic_blocks": 211.0, "func_analysis_depth": 2.0, "internal_func_count": 4.0, "provenance_id_length": 20.0, "string_length_stddev": 17.48, "largest_section_ratio": 0.17, "sentence_string_count": 15.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.02, "runtime_search_path_count": 1.0 } }, "ss": [ [ 0, "printf" ], [ 568, "/lib64/ld-linux-x86-64.so.2" ], [ 2601, "libssh.so.4" ], [ 2613, "__gmon_start__" ], [ 2628, "_Jv_RegisterClasses" ], [ 2648, "_ITM_deregisterTMCloneTable" ], [ 2676, "_ITM_registerTMCloneTable" ], [ 2702, "ssh_channel_read" ], [ 2719, "ssh_channel_close" ], [ 2737, "ssh_get_publickey" ], [ 2755, "ssh_disconnect" ], [ 2770, "ssh_get_issue_banner" ], [ 2791, "ssh_userauth_password" ], [ 2813, "ssh_print_hexa" ], [ 2828, "ssh_userauth_kbdint_getnprompts" ], [ 2860, "ssh_new" ], [ 2868, "ssh_get_error" ], [ 2882, "ssh_get_publickey_hash" ], [ 2905, "ssh_connect" ], [ 2917, "ssh_userauth_list" ], [ 2935, "ssh_userauth_kbdint_getname" ], [ 2963, "ssh_userauth_publickey_auto" ], [ 2991, "ssh_options_set" ], [ 3007, "ssh_channel_open_session" ], [ 3032, "ssh_userauth_kbdint_getprompt" ], [ 3062, "ssh_is_server_known" ], [ 3082, "ssh_key_free" ], [ 3095, "ssh_channel_request_exec" ], [ 3120, "ssh_channel_free" ], [ 3137, "ssh_clean_pubkey_hash" ], [ 3159, "ssh_channel_new" ], [ 3175, "ssh_free" ], [ 3184, "ssh_string_free_char" ], [ 3205, "ssh_userauth_kbdint_setanswer" ], [ 3235, "ssh_write_knownhost" ], [ 3255, "ssh_getpass" ], [ 3267, "ssh_userauth_kbdint_getinstruction" ], [ 3302, "ssh_userauth_none" ], [ 3320, "ssh_userauth_kbdint" ], [ 3340, "ssh_channel_send_eof" ], [ 3361, "ssh_get_hexa" ], [ 3374, "ssh_finalize" ], [ 3387, "ssh_userauth_gssapi" ], [ 3417, "__stack_chk_fail" ], [ 3446, "strlen" ], [ 3453, "memset" ], [ 3467, "__errno_location" ], [ 3484, "stdout" ], [ 3497, "stderr" ], [ 3504, "strncasecmp" ], [ 3516, "fwrite" ], [ 3530, "fprintf" ], [ 3538, "__cxa_finalize" ], [ 3553, "strerror" ], [ 3562, "__libc_start_main" ], [ 3580, "_edata" ], [ 3587, "__bss_start" ], [ 3604, "/home/kod/bbn/libssh-0.7.4/build/src" ], [ 3641, "__libc_csu_fini" ], [ 3657, "authenticate_kbdint" ], [ 3677, "connect_ssh" ], [ 3689, "authenticate_console" ], [ 3710, "verify_knownhost" ], [ 3727, "_IO_stdin_used" ], [ 3742, "__data_start" ], [ 3755, "__libc_csu_init" ], [ 5952, "_start" ], [ 9956, "localhost" ], [ 9984, "Authentication failed: %s" ], [ 10024, "Host key for server changed : server's one is now :" ], [ 10077, "Public key hash" ], [ 10096, "For security reason, connection will be stopped" ], [ 10152, "The host key for this server was not found but an other type of key exists." ], [ 10232, "An attacker might change the default server key to confuse your clientinto thinking the key does not exist\nWe advise you to reru" ], [ 10339, "We advise you to rerun the client with -d or -r for more safety." ], [ 10408, "Could not find known host file. If you accept the host key here," ], [ 10480, "the file will be automatically created." ], [ 10528, "The server is unknown. Do you trust the host key ?" ], [ 10580, "Public key hash: %s" ], [ 10608, "This new key will be written on disk for further usage. do you agree ?" ], [ 10680, "error %s" ], [ 10720, "Connection failed : %s" ], [ 10744, "Authentication failed" ], [ 10768, "Error while authenticating : %s" ], [ 16400, "GCC: (Ubuntu 6.2.0-5ubuntu12) 6.2.0 20161005" ], [ 19473, "crtstuff.c" ], [ 19484, "__JCR_LIST__" ], [ 19497, "deregister_tm_clones" ], [ 19518, "__do_global_dtors_aux" ], [ 19540, "completed.7558" ], [ 19555, "__do_global_dtors_aux_fini_array_entry" ], [ 19594, "frame_dummy" ], [ 19606, "__frame_dummy_init_array_entry" ], [ 19637, "exec.c" ], [ 19644, "authentication.c" ], [ 19661, "knownhosts.c" ], [ 19674, "connect_ssh.c" ], [ 19688, "__FRAME_END__" ], [ 19702, "__JCR_END__" ], [ 19714, "__GNU_EH_FRAME_HDR" ], [ 19733, "_GLOBAL_OFFSET_TABLE_" ], [ 19755, "__TMC_END__" ], [ 19767, "__dso_handle" ], [ 19780, "__init_array_end" ], [ 19797, "__init_array_start" ], [ 19816, "_DYNAMIC" ], [ 19906, "memset@@GLIBC_2.2.5" ], [ 20087, "__libc_start_main@@GLIBC_2.2.5" ], [ 20239, "fgets@@GLIBC_2.2.5" ], [ 20375, "strlen@@GLIBC_2.2.5" ], [ 20461, "__cxa_finalize@@GLIBC_2.2.5" ], [ 20510, "stdin@@GLIBC_2.2.5" ], [ 20628, "strerror@@GLIBC_2.2.5" ], [ 20650, "strstr@@GLIBC_2.2.5" ], [ 20670, "fputs@@GLIBC_2.2.5" ], [ 20767, "strchr@@GLIBC_2.2.5" ], [ 20796, "__errno_location@@GLIBC_2.2.5" ], [ 20873, "strncasecmp@@GLIBC_2.2.5" ], [ 20898, "__stack_chk_fail@@GLIBC_2.4" ], [ 21021, "stderr@@GLIBC_2.2.5" ], [ 21041, "fwrite@@GLIBC_2.2.5" ], [ 21109, "fprintf@@GLIBC_2.2.5" ], [ 21130, "stdout@@GLIBC_2.2.5" ], [ 21150, "main" ], [ 21156, ".symtab" ], [ 21164, ".strtab" ], [ 21172, ".shstrtab" ], [ 21182, ".interp" ], [ 21190, ".note.ABI-tag" ], [ 21204, ".note.gnu.build-id" ], [ 21223, ".gnu.hash" ], [ 21233, ".dynsym" ], [ 21241, ".dynstr" ], [ 21249, ".gnu.version" ], [ 21262, ".gnu.version_r" ], [ 21277, ".rela.dyn" ], [ 21287, ".init" ], [ 21293, ".plt" ], [ 21298, ".plt.got" ], [ 21307, ".text" ], [ 21313, ".fini" ], [ 21319, ".rodata" ], [ 21327, ".eh_frame_hdr" ], [ 21341, ".eh_frame" ], [ 21351, ".init_array" ], [ 21363, ".fini_array" ], [ 21375, ".jcr" ], [ 21380, ".dynamic" ], [ 21389, ".data" ], [ 21395, ".bss" ], [ 21400, ".comment" ], [ 2113536, "data_start" ] ], "sz": 23272, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "Line-based file reading (fgets)", "e": [ "fgets" ], "i": "micro-behaviors/process/create/direct::fgets-loop", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 71.00" ], "i": "metadata/binary/symbols/exports::has-exports", "l": 1 }, { "c": 0.9399999976158142, "d": "Regex component marker", "e": [ ".so" ], "i": "objectives/evasion/kernel-hide/userspace::runtime-shared-object-compile--rx-1", "l": 1 }, { "a": "T1021.004", "d": "SSH authentication failed message", "e": [ "Authentication failed: %s", "Authentication failed" ], "i": "micro-behaviors/communications/ssh/client::auth-failed", "l": 2 }, { "c": 1.0, "d": "Binary has 9+ exports", "e": [ "binary.export_count = 71.00" ], "i": "metadata/binary/metrics/threshold::many-exports-9", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 28.00" ], "i": "metadata/binary/metrics/threshold::many-sections-20", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-50", "l": 1 }, { "c": 0.800000011920929, "d": "libc version string pattern", "e": [ "GLIBC" ], "i": "micro-behaviors/dylib/library/libc::libc-version-string", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.17" ], "i": "metadata/binary/metrics/threshold::avg-string-entropy-4-max", "l": 2 }, { "c": 0.699999988079071, "d": "ELF built with only partial RELRO", "e": [ "partial" ], "i": "metadata/binary/anomaly/provenance::partial-relro", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking/static::elf-dynamic-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "ELF symbol tables stripped from binary", "e": [ "elf.stripped_metadata_section_count = 2.00" ], "i": "metadata/binary/anomaly/provenance::stripped-symbol-tables", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 1.0, "d": "ELF GNU build-id metadata", "e": [ "8f36d2f2b4dc80e4c1513516eb7f8f83d905cb01" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many exports (\u003e10)", "e": [ "binary.export_count = 71.00" ], "i": "metadata/binary/metrics/structural::many-exports", "l": 2 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/layout::binary-format-checked", "l": 2 }, { "c": 0.699999988079071, "d": "RPATH/RUNPATH set (library injection vector)", "e": [ "elf.has_rpath = 1.00" ], "i": "metadata/hardening/mitigation::rpath-set", "l": 3 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.func_count = 66.00" ], "i": "metadata/binary/metrics/threshold::few-functions-3", "l": 1 }, { "c": 0.6000000238418579, "d": "ELF stripped with .symtab present", "e": [ "elf.stripped_but_symtab_present = 1.00" ], "i": "metadata/build/artifact::elf-stripped-but-symtab-present", "l": 3 }, { "c": 0.6000000238418579, "d": "Small ELF binary (\u003c 50KB)", "e": [ "exec" ], "i": "metadata/binary/metrics/structural::small-elf-binary", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics/structural::elf64-class", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ exports", "e": [ "binary.export_count = 71.00" ], "i": "metadata/binary/metrics/threshold::many-exports-20", "l": 1 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail@@GLIBC_2.4", "sym.imp.__stack_chk_fail", "stack_chk_fail" ], "i": "metadata/hardening/build::stack-chk-fail", "l": 2 }, { "c": 0.699999988079071, "d": "ELF .note.GNU-stack section absent", "e": [ "elf.gnu_stack_section_absent = 1.00" ], "i": "metadata/binary/anomaly/format::elf-gnu-stack-section-absent", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 2.32" ], "i": "metadata/binary/metrics/threshold::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "ELF has program interpreter", "e": [ "elf.has_interpreter = 1.00" ], "i": "metadata/binary/layout::has-interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.func_count = 66.00" ], "i": "metadata/binary/metrics/threshold::many-functions-50", "l": 1 }, { "c": 0.949999988079071, "d": "ELF declares DT_RELACOUNT (relative relocations)", "e": [ "elf.relacount = 3.00" ], "i": "metadata/binary/anomaly/format::elf-relacount-present", "l": 2 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "libssh library reference", "e": [ "libssh.so.4", "/home/kod/bbn/libssh-0.7.4/build/src" ], "i": "micro-behaviors/communications/ssh/client::libssh", "l": 3 }, { "d": "password keyword", "e": [ "ssh_userauth_password" ], "i": "micro-behaviors/data/text/keywords/lexicon::password", "l": 1 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "fwrite" ], "i": "micro-behaviors/fs/file/write/direct::write", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-20", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking/static::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "exec" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking/static::elf-interpreter-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking/static::elf-dynstr-section-name", "l": 2 }, { "c": 1.0, "d": "ELF RPATH metadata", "e": [ "[/home/kod/bbn/libssh-0.7.4/build/src]" ], "i": "metadata/binary/linking/runtime::elf-rpath", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 2.84" ], "i": "metadata/binary/metrics/threshold::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.func_count = 66.00" ], "i": "metadata/binary/metrics/structural::many-functions", "l": 2 }, { "a": "T1573", "c": 0.800000011920929, "d": "Regex component marker", "e": [ "Public key hash: %s", "ssh_get_publickey_hash", "ssh_get_publickey", "ssh_userauth_publickey_auto", "Public key hash" ], "i": "micro-behaviors/crypto/asymmetric/kem::encrypted-trailer-terms--rx-4", "l": 1, "m": "C0027" }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account ubuntu", "e": [ "ubuntu" ], "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu", "l": 1, "m": "E1110" }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "[libssh.so.4, libc.so.6]" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 60.00" ], "i": "metadata/binary/metrics/threshold::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening/missing::elf-dynsym-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening/missing::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening/missing::elf-dynamic-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening/missing::elf-interpreter-section-name", "l": 2 }, { "c": 0.75, "d": "Low average code complexity", "e": [ "binary.avg_complexity = 2.32" ], "i": "metadata/binary/metrics/structural::low-average-complexity", "l": 2 }, { "c": 0.8999999761581421, "d": "Tiny C string section ratio", "e": [ " = 0.0% of total (0 / 23272 bytes)" ], "i": "metadata/binary/section/metrics::tiny-cstring-section", "l": 1 }, { "a": "T1021.004", "c": 0.6000000238418579, "d": "SSH publickey auth method", "e": [ "ssh_get_publickey_hash", "ssh_get_publickey", "ssh_userauth_publickey_auto" ], "i": "micro-behaviors/communications/ssh/client::publickey-auth", "l": 3 }, { "a": "T1021.004", "c": 0.75, "d": "SSH client/auth library", "e": [ "ssh_userauth_publickey_auto", "libssh.so.4", "ssh_get_publickey_hash", "/home/kod/bbn/libssh-0.7.4/build/src", "ssh_get_publickey" ], "i": "micro-behaviors/communications/ssh/client::library-comp", "l": 3 }, { "a": "T1021.004", "c": 0.8500000238418579, "d": "SSH authentication implementation", "e": [ "libssh.so.4", "ssh_userauth_publickey_auto", "ssh_get_publickey", "ssh_get_publickey_hash", "Authentication failed", "Authentication failed: %s", "/home/kod/bbn/libssh-0.7.4/build/src" ], "i": "micro-behaviors/communications/ssh/client::full-implementation", "l": 3 } ], "sha": "b9ca18755787e0c67643b17a5e31e11d021dee9d071755dc9cd2d3b5a2263004", "path": "/data/samples/bad/datasets/iot-malware/busybotnet/libssh-0.7.4/build/examples/exec", "type": "elf" } ], "tv": "6a383" } }