{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.8911781907081604, "class": 0, "threshold": 0.9987763166427612 } ], "prob": 0.8911782, "class": 0, "level": 3, "models": [ { "m": "az", "prob": 0.8911782, "class": 0 }, { "m": "az/scripts", "prob": 0.48895434, "class": 0 }, { "m": "az/shell", "prob": 0.65, "class": 0 } ], "version": "v17.17", "threshold": 0.9987763, "analyzed_at": "2026-05-31T14:43:02Z" }, "path": "cacdd6e2d834895ce394ea1ea8cee6b7bf10afa60ab3edf19adb6e4038862c12.sh", "raw": { "v": "5", "fs": [ { "f": "H₂(CmPo₂)", "x": 3, "ff": { "i": [ [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "exit" ], [ "", "exit" ], [ "", "clear" ], [ "", "clear" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "./masscan" ], [ "", "./masscan" ], [ "", "rm" ], [ "", "rm" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "cat" ], [ "", "cat" ], [ "", "awk" ], [ "", "awk" ], [ "", "cat" ], [ "", "cat" ], [ "", "sort" ], [ "", "sort" ], [ "", "uniq" ], [ "", "uniq" ], [ "", "rm" ], [ "", "rm" ], [ "", "cat" ], [ "", "cat" ], [ "", "sort" ], [ "", "sort" ], [ "", "rm" ], [ "", "rm" ], [ "", "wc" ], [ "", "wc" ], [ "", "rm" ], [ "", "rm" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "./scan" ], [ "", "./scan" ], [ "", "echo" ], [ "", "echo" ], [ "", "wc" ], [ "", "wc" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "rm" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "cat" ], [ "", "cat" ], [ "", "wc" ], [ "", "wc" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "wc" ], [ "", "wc" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "wc" ], [ "", "wc" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "wc" ], [ "", "wc" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "grep" ], [ "", "wc" ], [ "", "wc" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "cat" ], [ "", "cat" ], [ "", "awk" ], [ "", "awk" ], [ "", "rm" ], [ "", "rm" ], [ "", "./brute" ], [ "", "./brute" ], [ "", "rm" ], [ "", "rm" ], [ "", "cat" ], [ "", "cat" ], [ "", "grep" ], [ "", "grep" ], [ "", "sort" ], [ "", "sort" ] ], "m": { "ast": { "max_depth": 7.0, "bind_count": 5.0, "call_count": 67.0, "node_count": 546.0, "identifier_count": 52.0, "string_literal_count": 25.0 }, "file": { "size": 1981.0, "entropy": 5.22, "size_bytes": 1981.0 }, "text": { "tab_count": 8.0, "digit_ratio": 0.1, "space_count": 303.0, "total_lines": 56.0, "char_entropy": 5.22, "unique_chars": 78.0, "string_density": 0.45, "avg_line_length": 33.38, "max_line_length": 188.0, "empty_line_ratio": 0.07, "last_line_length": 33.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.08, "identifier_density": 4.5, "line_length_stddev": 30.93, "normalized_string_count": 3.34, "repeated_char_sequences": 5.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 12.0, "most_common_char_codepoint": 101.0, "normalized_unique_identifiers": 8.95 }, "binds": { "count": 5.0 }, "calls": { "count": 67.0 }, "strings": { "total": 25.0, "avg_length": 28.4, "max_length": 69.0, "avg_entropy": 3.38, "empty_count": 1.0, "total_bytes": 710.0, "entropy_stddev": 0.98 }, "comments": { "chars": 25.0, "lines": 2.0, "total": 2.0, "to_code_ratio": 0.04 }, "identifiers": { "count": 52.0, "total": 252.0, "avg_length": 6.06, "max_length": 23.0, "min_length": 1.0, "avg_entropy": 1.97, "reuse_ratio": 0.21, "unique_count": 52.0, "length_stddev": 4.15, "has_digit_ratio": 0.19, "single_char_count": 3.0, "single_char_ratio": 0.06, "all_lowercase_ratio": 0.37, "all_uppercase_ratio": 0.02 } }, "s": [ [ 26, "10", "2" ], [ 47, "u8", "[-] \\e[31mDENIED!! exemplu: $0 \u003cviteza\u003e \u003cport\u003e \\e[0m" ], [ 48, "u8", "[-] \\e[31mDENIED!! exemplu: " ], [ 78, "u8", " \u003cviteza\u003e \u003cport\u003e \\e[0m" ], [ 113, "u8", "[-] \\e[31mATENTIE!! Scannerul functioneaza doar pe CentOS\\e[0m" ], [ 114, "u8", "[-] \\e[31mATENTIE!! Scannerul functioneaza doar pe CentOS\\e[0m" ], [ 189, "u8", "[-] \\e[31mRecomand viteza intre 1000-50000\\e[0m" ], [ 190, "u8", "[-] \\e[31mRecomand viteza intre 1000-50000\\e[0m" ], [ 280, "u8", "[+] Pornim masscan - random IPs" ], [ 281, "u8", "[+] Pornim masscan - random IPs" ], [ 323, "u8", "[+] Apasa [ CTRL + C ] pentru a opri masscanul si asteapta 10 secunde" ], [ 324, "u8", "[+] Apasa [ CTRL + C ] pentru a opri masscanul si asteapta 10 secunde" ], [ 614, "u8", "[~]" ], [ 615, "u8", "[~]" ], [ 629, "u8", "[+] Extragem IPs.." ], [ 630, "u8", "[+] Extragem IPs.." ], [ 670, "u8", "{print $6}" ], [ 829, "u8", "[~]" ], [ 830, "u8", "[~]" ], [ 844, "u8", "[+] Start Banner Grabberul :-)" ], [ 845, "u8", "[+] Start Banner Grabberul :-)" ], [ 916, "u8", "[+] Asteptam 5 secunde.." ], [ 917, "u8", "[+] Asteptam 5 secunde.." ], [ 964, "10", "5" ], [ 1007, "u8", "[+] Banner grabberul a terminat" ], [ 1008, "u8", "[+] Banner grabberul a terminat" ], [ 1050, "u8", "[~]" ], [ 1051, "u8", "[~]" ], [ 1398, "u8", "[*] Am gasit \\e[92m[$vulns]\\e[0m servere vulnerabile" ], [ 1399, "u8", "[*] Am gasit \\e[92m[" ], [ 1436, "u8", "]\\e[0m servere vulnerabile" ], [ 1473, "u8", "[*] Ubuntu: \\e[93m[$ubuntu]\\e[0m" ], [ 1474, "u8", "[*] Ubuntu: \\e[93m[" ], [ 1511, "u8", "]\\e[0m" ], [ 1528, "u8", "[*] Debian: \\e[93m[$debian]\\e[0m" ], [ 1529, "u8", "[*] Debian: \\e[93m[" ], [ 1566, "u8", "]\\e[0m" ], [ 1583, "u8", "[*] FreeBSD: \\e[93m[$freebsd]\\e[0m" ], [ 1584, "u8", "[*] FreeBSD: \\e[93m[" ], [ 1623, "u8", "]\\e[0m" ], [ 1640, "u8", "[*] Altele: \\e[93m[$altele]\\e[0m" ], [ 1641, "u8", "[*] Altele: \\e[93m[" ], [ 1678, "u8", "]\\e[0m" ], [ 1709, "u8", "{print $1}" ], [ 1760, "u8", "[~]" ], [ 1761, "u8", "[~]" ], [ 1775, "u8", "[+] Start bruteforce" ], [ 1776, "u8", "[+] Start bruteforce" ], [ 1816, "10", "3" ], [ 1818, "10", "3" ], [ 1820, "10", "100" ], [ 1861, "u8", "[+] Bruteforce-ul a terminat" ], [ 1862, "u8", "[+] Bruteforce-ul a terminat" ], [ 1901, "u8", "[~]" ], [ 1902, "u8", "[~]" ], [ 1916, "u8", "[+] Sa vedem ce am gasit.." ], [ 1917, "u8", "[+] Sa vedem ce am gasit.." ] ], "v": { "file.stem": "cacdd6e2d834895ce394ea1ea8cee6b7bf10afa60ab3edf19adb6e4038862c12", "file.basename": "cacdd6e2d834895ce394ea1ea8cee6b7bf10afa60ab3edf19adb6e4038862c12.sh", "source.shebang": "/bin/bash", "source.language": "bash", "source.imports[0]": "./brute", "source.imports[1]": "./masscan", "source.imports[2]": "./scan", "source.imports[3]": "awk", "source.imports[4]": "cat", "source.imports[5]": "clear", "source.imports[6]": "echo", "source.imports[7]": "exit", "source.imports[8]": "grep", "source.imports[9]": "rm", "source.strings[0]": " \u003cviteza\u003e \u003cport\u003e \\e[0m", "source.strings[1]": "[*] Altele: \\e[93m[", "source.strings[2]": "[*] Altele: \\e[93m[$altele]\\e[0m", "source.strings[3]": "[*] Am gasit \\e[92m[", "source.strings[4]": "[*] Am gasit \\e[92m[$vulns]\\e[0m servere vulnerabile", "source.strings[5]": "[*] Debian: \\e[93m[", "source.strings[6]": "[*] Debian: \\e[93m[$debian]\\e[0m", "source.strings[7]": "[*] FreeBSD: \\e[93m[", "source.strings[8]": "[*] FreeBSD: \\e[93m[$freebsd]\\e[0m", "source.strings[9]": "[*] Ubuntu: \\e[93m[", "source.has_imports": true, "source.imports[10]": "sleep", "source.imports[11]": "sort", "source.imports[12]": "uniq", "source.imports[13]": "wc", "source.strings[10]": "[*] Ubuntu: \\e[93m[$ubuntu]\\e[0m", "source.strings[11]": "[+] Apasa [ CTRL + C ] pentru a opri masscanul si asteapta 10 secunde", "source.strings[12]": "[+] Asteptam 5 secunde..", "source.strings[13]": "[+] Banner grabberul a terminat", "source.strings[14]": "[+] Bruteforce-ul a terminat", "source.strings[15]": "[+] Extragem IPs..", "source.strings[16]": "[+] Pornim masscan - random IPs", "source.strings[17]": "[+] Sa vedem ce am gasit..", "source.strings[18]": "[+] Start Banner Grabberul :-)", "source.strings[19]": "[+] Start bruteforce", "source.strings[20]": "[-] \\e[31mATENTIE!! Scannerul functioneaza doar pe CentOS\\e[0m", "source.strings[21]": "[-] \\e[31mDENIED!! exemplu: ", "source.strings[22]": "[-] \\e[31mDENIED!! exemplu: $0 \u003cviteza\u003e \u003cport\u003e \\e[0m", "source.strings[23]": "[-] \\e[31mRecomand viteza intre 1000-50000\\e[0m", "source.strings[24]": "]\\e[0m", "source.strings[25]": "]\\e[0m servere vulnerabile", "source.strings[26]": "{print $1}", "source.strings[27]": "{print $6}" }, "ct": [ "./brute", "./masscan", "./scan", "awk", "cat", "clear", "echo", "exit", "grep", "rm", "sleep", "sort", "uniq", "wc" ], "id": "shell" }, "id": 0, "sz": 1981, "ts": [ { "c": 0.75, "d": "Tiny multi-line text script", "e": [ "text.total_lines = 56.00" ], "i": "metadata/file/text/profile::tiny-text-script", "l": 2 }, { "c": 0.6000000238418579, "d": "rm -rf command", "e": [ "rm -rf" ], "i": "micro-behaviors/fs/directory/traverse::rm-rf-cmd", "l": 2 }, { "a": "T1110", "c": 0.8500000238418579, "d": "Brute force attack reference", "e": [ "bruteforce", "Bruteforce" ], "i": "objectives/discovery/network/scan/port::brute-force-ref", "l": 1, "m": "E1046", "el": [ "0x6ef", "0x745" ] }, { "a": "T1059.004", "c": 0.6000000238418579, "d": "./ execution pattern", "e": [ "\n./masscan" ], "i": "objectives/command-and-control/dropper/execution/pipe::execute-dot-slash", "l": 1 }, { "d": "Five or fewer comment lines in file", "e": [ "comments.lines = 2.00" ], "i": "metadata/file/text/metrics::few-comment-lines", "l": 1 }, { "c": 0.20000000298023224, "d": "tmp keyword", "e": [ "tmp" ], "i": "micro-behaviors/data/text/keywords/lexicon::tmp", "l": 1 }, { "c": 0.699999988079071, "d": "grep command keyword", "e": [ "grep" ], "i": "micro-behaviors/fs/search::grep-keyword", "l": 1 }, { "c": 0.8799999952316284, "d": "Destructive cleanup verb", "e": [ "clear" ], "i": "micro-behaviors/data/text/keywords/lexicon::cleanup-verb", "l": 1 }, { "c": 1.0, "d": "Bash shell shebang line", "e": [ "#!/bin/bash" ], "i": "metadata/lang/shebang::bash", "l": 2 }, { "c": 0.800000011920929, "d": "Bracket-star log marker", "e": [ "[*] " ], "i": "micro-behaviors/data/text/keywords/tool::hacker-tool-log-marker", "l": 2 }, { "a": "T1110.001", "c": 0.8500000238418579, "d": "Service account ubuntu", "e": [ "ubuntu" ], "i": "objectives/lateral-movement/brute-force/password::service-account-ubuntu", "l": 1, "m": "E1110" }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e /dev/null" ], "i": "micro-behaviors/process/daemonize/detach::redirect-dev-null", "l": 1 }, { "a": "T1053.003", "c": 0.6000000238418579, "d": "grep -v (inverse match/filter)", "e": [ "grep -v" ], "i": "objectives/persistence/system/cron/schedule::grep-v", "l": 1 }, { "c": 0.800000011920929, "d": "Regex component marker", "e": [ "cat ssh_vuln.log |grep -v FreeBSD |grep -v Debian |grep -v Ubuntu |" ], "i": "micro-behaviors/process/create/shell/pipeline::excessive-pipes--rx-1", "l": 1 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 56.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 0.8500000238418579, "d": "rsync exclude argument", "e": [ "--exclude" ], "i": "micro-behaviors/communications/ssh/transfer::rsync-exclude-argument", "l": 3 }, { "c": 0.699999988079071, "d": "Execution from current directory (./file)", "e": [ "./masscan" ], "i": "micro-behaviors/process/create/shell/invoke::shell-execution-current-dir", "l": 3 }, { "c": 1.0, "d": "Executes a file from current directory", "e": [ "\n./masscan" ], "i": "micro-behaviors/process/create/local-exec::local-execution", "l": 3 } ], "sha": "cacdd6e2d834895ce394ea1ea8cee6b7bf10afa60ab3edf19adb6e4038862c12", "path": "/data/samples/bad/datasets/various/datalake.abuse.ch/2025-02/cacdd6e2d834895ce394ea1ea8cee6b7bf10afa60ab3edf19adb6e4038862c12.sh", "type": "shell" } ], "tv": "52045" } }