{ "ml": { "v": "5", "fs": [ { "id": 0, "prob": 0.9545454382896423, "class": 1, "threshold": 0.8235294222831726 } ], "prob": 0.95454544, "class": 1, "level": 3, "models": [ { "m": "az", "prob": 0.87486404, "class": 0 }, { "m": "az/scripts", "prob": 0.66233766, "class": 0 }, { "m": "az/shell", "prob": 0.95454544, "class": 1 } ], "version": "v17.17", "threshold": 0.8235294, "analyzed_at": "2026-05-30T00:18:05Z" }, "path": "run.sh", "raw": { "v": "5", "fs": [ { "f": "O(As)Md", "x": 39, "ff": { "i": [ [ "", "exit" ], [ "", "exit" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "echo" ], [ "", "echo" ], [ "", "base64" ], [ "", "base64" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "printf" ], [ "", "echo" ], [ "", "echo" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "rebuild" ], [ "", "echo" ], [ "", "echo" ], [ "", "tr" ], [ "", "tr" ], [ "", "echo" ], [ "", "echo" ], [ "", "tr" ], [ "", "tr" ], [ "", "rotate_decode" ], [ "", "rotate_decode" ], [ "", "echo" ], [ "", "echo" ], [ "", "rebuild_indirect" ], [ "", "rebuild_indirect" ], [ "", "printf" ], [ "", "printf" ], [ "", "{_CMD_MKDIR}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "{_CMD_EVAL}" ], [ "", "hostname" ], [ "", "hostname" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "echo" ], [ "", "{_CMD_BASE64}" ], [ "", "{_CMD_CURL}" ], [ "", "sleep" ], [ "", "sleep" ], [ "", "date" ], [ "", "date" ], [ "", "{_CMD_BASE64}" ], [ "", "{_CMD_CURL}" ], [ "", "CMD_BASE64" ], [ "", "CMD_BASE64" ], [ "", "date" ], [ "", "date" ], [ "", "{_CMD_RM}" ] ], "m": { "ast": { "max_depth": 14.0, "bind_count": 70.0, "call_count": 64.0, "node_count": 1565.0, "identifier_count": 106.0, "string_literal_count": 81.0 }, "file": { "size": 4925.0, "entropy": 5.79, "size_bytes": 4925.0 }, "text": { "digit_ratio": 0.13, "space_count": 431.0, "total_lines": 155.0, "char_entropy": 5.79, "unique_chars": 91.0, "escape_density": 1.3, "string_density": 0.52, "avg_line_length": 30.77, "high_byte_ratio": 0.04, "max_line_length": 116.0, "non_ascii_ratio": 0.04, "empty_line_ratio": 0.13, "hex_escape_count": 64.0, "last_line_length": 47.0, "whitespace_ratio": 0.12, "most_common_ratio": 0.06, "identifier_density": 2.68, "line_length_stddev": 22.52, "encoded_string_ratio": 0.06, "normalized_string_count": 6.51, "suspicious_string_ratio": 0.04, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 95.0, "suspicious_identifier_ratio": 0.08, "normalized_unique_identifiers": 15.26 }, "binds": { "count": 70.0 }, "calls": { "count": 64.0 }, "source": { "function_count": 3.0 }, "strings": { "total": 81.0, "url_count": 2.0, "avg_length": 18.14, "max_length": 77.0, "avg_entropy": 2.97, "empty_count": 3.0, "total_bytes": 1469.0, "entropy_stddev": 1.18, "base64_candidates": 5.0, "high_entropy_count": 1.0, "shell_command_strings": 3.0, "unicode_heavy_strings": 7.0 }, "comments": { "chars": 729.0, "lines": 16.0, "total": 16.0, "to_code_ratio": 0.12 }, "functions": { "count": 3.0, "avg_params": 3.0, "max_params": 3.0, "length_stddev": 0.94, "avg_name_length": 12.0, "avg_length_lines": 6.33, "max_length_lines": 7.0, "min_length_lines": 5.0, "avg_param_name_length": 28.89, "density_per_100_lines": 1.94, "code_in_functions_ratio": 0.12 }, "identifiers": { "count": 106.0, "total": 415.0, "avg_length": 5.21, "max_length": 16.0, "min_length": 1.0, "avg_entropy": 1.88, "reuse_ratio": 0.27, "unique_count": 111.0, "length_stddev": 3.81, "has_digit_ratio": 0.37, "sequential_names": 9.0, "single_char_count": 11.0, "single_char_ratio": 0.1, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.31, "all_uppercase_ratio": 0.2, "numeric_suffix_count": 38.0, "underscore_prefix_count": 69.0 } }, "s": [ [ 49, "u8", "$HOME/.41nd98" ], [ 55, "u8", "/.41nd98" ], [ 80, "10", "1" ], [ 152, "u8", "\\x66\\x6f\\x72\\x74\\x69\\x6f\\x73" ], [ 196, "u8", "\\x2d\\x73\\x68\\x65\\x6c\\x6c" ], [ 236, "u8", "\\x2d\\x6f\\x62\\x66\\x75\\x73\\x63\\x61\\x74\\x69\\x6f\\x6e" ], [ 300, "u8", "\\x61\\x35\\x35\\x66\\x63" ], [ 336, "u8", "\\x62\\x65\\x6e\\x63\\x68\\x6d\\x61\\x72\\x6b" ], [ 388, "u8", "\\x2e\\x61\\x74\\x6f\\x6d\\x64\\x72\\x69\\x66\\x74" ], [ 444, "u8", "\\x2e\\x6f\\x72\\x67" ], [ 472, "u8", "${_A}${_B}${_C}${_D}${_F}${_G}" ], [ 575, "u8", "Y2F0IC92YXIvbG9n" ], [ 576, "u8", "Y2F0IC92YXIvbG9n" ], [ 618, "u8", "dW5hbWUgLWE=" ], [ 619, "u8", "dW5hbWUgLWE=" ], [ 657, "u8", "aWQgLWE=" ], [ 658, "u8", "aWQgLWE=" ], [ 692, "u8", "d2hvYW1p" ], [ 693, "u8", "d2hvYW1p" ], [ 727, "u8", "ZGZgLXh8Z3JlcCBmdGxz" ], [ 728, "u8", "ZGZgLXh8Z3JlcCBmdGxz" ], [ 774, "u8", "ZXRob2Fk" ], [ 775, "u8", "ZXRob2Fk" ], [ 809, "u8", "Y2F0IC9ldGMvcGFzc3dk" ], [ 810, "u8", "Y2F0IC9ldGMvcGFzc3dk" ], [ 856, "u8", "Y2F0IC9ldGMvaG9zdHM=" ], [ 857, "u8", "Y2F0IC9ldGMvaG9zdHM=" ], [ 989, "u8", "$@" ], [ 1005, "u8", "${_o}$(printf \"\\\\$(printf '%03o' \"$_c\")\")" ], [ 1020, "u8", "\\\\$(printf '%03o' \"$_c\")" ], [ 1021, "u8", "\\\\" ], [ 1032, "u8", "%03o" ], [ 1039, "u8", "$_c" ], [ 1063, "u8", "$_o" ], [ 1092, "10", "99" ], [ 1095, "10", "117" ], [ 1099, "10", "114" ], [ 1103, "10", "108" ], [ 1128, "10", "101" ], [ 1132, "10", "118" ], [ 1136, "10", "97" ], [ 1139, "10", "108" ], [ 1165, "10", "109" ], [ 1169, "10", "107" ], [ 1173, "10", "100" ], [ 1177, "10", "105" ], [ 1181, "10", "114" ], [ 1208, "10", "98" ], [ 1211, "10", "97" ], [ 1214, "10", "115" ], [ 1218, "10", "101" ], [ 1222, "10", "54" ], [ 1225, "10", "52" ], [ 1248, "10", "109" ], [ 1252, "10", "107" ], [ 1256, "10", "116" ], [ 1260, "10", "109" ], [ 1264, "10", "112" ], [ 1287, "10", "114" ], [ 1291, "10", "109" ], [ 1391, "u8", "$1" ], [ 1411, "u8", "$2" ], [ 1423, "u8", "$_in" ], [ 1435, "u8", "A-Za-z0-9+/=" ], [ 1450, "u8", "N-ZA-Mn-za-m0-9+/=" ], [ 1451, "u8", "N-ZA-Mn-za-m0-9+/=" ], [ 1498, "u8", "b2JmdXNjYXRlZCBkYXRhIGNvbGxlY3Rpb24gc2Vzc2lvbg==" ], [ 1499, "u8", "b2JmdXNjYXRlZCBkYXRhIGNvbGxlY3Rpb24gc2Vzc2lvbg==" ], [ 1554, "u8", "A-Za-z0-9+/=" ], [ 1569, "u8", "N-ZA-Mn-za-m0-9+/=" ], [ 1570, "u8", "N-ZA-Mn-za-m0-9+/=" ], [ 1624, "u8", "$_ROTATED_PAYLOAD" ], [ 1644, "10", "13" ], [ 1900, "u8", "$@" ], [ 1921, "u8", "${_result}${_map[$_key]}" ], [ 1962, "u8", "$_result" ], [ 2119, "u8", "ca" ], [ 2120, "u8", "ca" ], [ 2131, "u8", "tl" ], [ 2132, "u8", "tl" ], [ 2143, "u8", " /e" ], [ 2144, "u8", " /e" ], [ 2156, "u8", "tc/" ], [ 2157, "u8", "tc/" ], [ 2169, "u8", "os" ], [ 2170, "u8", "os" ], [ 2181, "u8", "t" ], [ 2182, "u8", "t" ], [ 2192, "u8", ".r" ], [ 2193, "u8", ".r" ], [ 2204, "u8", "e" ], [ 2205, "u8", "e" ], [ 2218, "u8", "${_frag0}${_frag1}${_frag2}${_frag3}${_frag4}${_frag5}${_frag6}${_frag7}" ], [ 2380, "u8", "\\x2f\\x74\\x6d\\x70\\x2f\\x2e\\x63\\x61\\x63\\x68\\x65" ], [ 2449, "u8", "$TARGET" ], [ 2520, "u8", "$HOME/.cache" ], [ 2526, "u8", "/.cache" ], [ 2540, "u8", "$_stage_dir" ], [ 2576, "u8", "$_stage_dir" ], [ 2602, "u8", "${_stage_dir}/.session_data" ], [ 2616, "u8", "/.session_data" ], [ 2697, "u8", "$_P1" ], [ 2737, "u8", "$_P2" ], [ 2777, "u8", "$_P3" ], [ 2817, "u8", "$_P4" ], [ 2857, "u8", "$_P5" ], [ 2897, "u8", "$_P6" ], [ 2937, "u8", "$_P7" ], [ 2977, "u8", "$_P8" ], [ 3017, "u8", "$_SYSINFO_CMD" ], [ 3067, "u8", "$_FULL_CMD" ], [ 3161, "u8", "${_payload}=== FINGERPRINT SESSION ===\\n" ], [ 3173, "u8", "=== FINGERPRINT SESSION ===\\n" ], [ 3213, "u8", "${_payload}HOST: $(hostname 2\u003e/dev/null || echo unknown)\\n" ], [ 3225, "u8", "HOST: " ], [ 3270, "u8", "\\n" ], [ 3283, "u8", "${_payload}USER: ${_fp4}\\n" ], [ 3295, "u8", "USER: " ], [ 3308, "u8", "\\n" ], [ 3321, "u8", "${_payload}ID: ${_fp3}\\n" ], [ 3333, "u8", "ID: " ], [ 3344, "u8", "\\n" ], [ 3357, "u8", "${_payload}UNAME: ${_fp2}\\n" ], [ 3369, "u8", "UNAME: " ], [ 3383, "u8", "\\n" ], [ 3396, "u8", "${_payload}SYSINFO: ${_fp9}\\n" ], [ 3408, "u8", "SYSINFO: " ], [ 3424, "u8", "\\n" ], [ 3437, "u8", "${_payload}ETHTOOL: ${_fp6}\\n" ], [ 3449, "u8", "ETHTOOL: " ], [ 3465, "u8", "\\n" ], [ 3478, "u8", "${_payload}DISKS: ${_fp5}\\n" ], [ 3490, "u8", "DISKS: " ], [ 3504, "u8", "\\n" ], [ 3517, "u8", "${_payload}OSRELEASE: ${_fp10}\\n" ], [ 3529, "u8", "OSRELEASE: " ], [ 3548, "u8", "\\n" ], [ 3561, "u8", "${_payload}PASSWD: ${_fp7}\\n" ], [ 3573, "u8", "PASSWD: " ], [ 3588, "u8", "\\n" ], [ 3601, "u8", "${_payload}HOSTS: ${_fp8}\\n" ], [ 3613, "u8", "HOSTS: " ], [ 3627, "u8", "\\n" ], [ 3640, "u8", "${_payload}LOG_TAIL: ${_fp1}\\n" ], [ 3652, "u8", "LOG_TAIL: " ], [ 3669, "u8", "\\n" ], [ 3738, "u8", "$_payload" ], [ 3853, "u8", "Content-Type: application/octet-stream" ], [ 3854, "u8", "Content-Type: application/octet-stream" ], [ 3901, "u8", "$_encoded" ], [ 3917, "u8", "http://${_SMUGGLE_HOST}/api/v1/session" ], [ 3918, "u8", "http://" ], [ 3941, "u8", "/api/v1/session" ], [ 4021, "10", "1" ], [ 4023, "10", "2" ], [ 4025, "10", "3" ], [ 4055, "10", "5" ], [ 4060, "10", "1" ], [ 4174, "u8", "X-Session-Id: $(_CMD_BASE64 \u003c\u003c\u003c \"obfuscated-session-$(date +%s)\" 2\u003e/dev/null)" ], [ 4175, "u8", "X-Session-Id: " ], [ 4203, "u8", "\u003c\u003c\u003c \"obfuscated-session-$(date +%s)" ], [ 4207, "u8", "obfuscated-session-$(date +%s)" ], [ 4208, "u8", "obfuscated-session-" ], [ 4263, "u8", "Content-Type: text/plain" ], [ 4264, "u8", "Content-Type: text/plain" ], [ 4299, "u8", "$_beacon_data" ], [ 4321, "u8", "http://${_SMUGGLE_HOST}/api/v1/beacon" ], [ 4322, "u8", "http://" ], [ 4345, "u8", "/api/v1/beacon" ], [ 4438, "u8", "$_stage_file" ], [ 140, "unicode-escape", "_A=$(printf 'fortios')" ], [ 184, "unicode-escape", "_B=$(printf '-shell')" ], [ 224, "unicode-escape", "_C=$(printf '-obfuscation')" ], [ 288, "unicode-escape", "_D=$(printf 'a55fc')" ], [ 324, "unicode-escape", "_E=$(printf 'benchmark')" ], [ 376, "unicode-escape", "_F=$(printf '.atomdrift')" ], [ 432, "unicode-escape", "_G=$(printf '.org')" ], [ 564, "base64", "cat /var/log" ], [ 716, "base64", "df`-x|grep ftls" ], [ 798, "base64", "cat /etc/passwd" ], [ 845, "base64", "cat /etc/hosts" ], [ 1474, "base64", "obfuscated data collection session" ], [ 2350, "unicode-escape", "export _SMUGGLE_PATH=$(printf '/tmp/.cache')" ] ], "v": { "file.stem": "run", "file.basename": "run.sh", "source.shebang": "/bin/bash", "source.language": "bash", "source.imports[0]": "CMD_BASE64", "source.imports[1]": "base64", "source.imports[2]": "date", "source.imports[3]": "echo", "source.imports[4]": "exit", "source.imports[5]": "hostname", "source.imports[6]": "printf", "source.imports[7]": "rebuild", "source.imports[8]": "rebuild_indirect", "source.imports[9]": "rotate_decode", "source.strings[0]": "$HOME/.41nd98", "source.strings[1]": "$HOME/.cache", "source.strings[2]": "$TARGET", "source.strings[3]": "$_FULL_CMD", "source.strings[4]": "$_ROTATED_PAYLOAD", "source.strings[5]": "$_SYSINFO_CMD", "source.strings[6]": "$_beacon_data", "source.strings[7]": "$_encoded", "source.strings[8]": "$_payload", "source.strings[9]": "$_result", "source.has_imports": true, "source.imports[10]": "sleep", "source.imports[11]": "tr", "source.imports[12]": "{_CMD_BASE64}", "source.imports[13]": "{_CMD_CURL}", "source.imports[14]": "{_CMD_EVAL}", "source.imports[15]": "{_CMD_MKDIR}", "source.imports[16]": "{_CMD_RM}", "source.strings[10]": "$_stage_dir", "source.strings[11]": "$_stage_file", "source.strings[12]": "${_A}${_B}${_C}${_D}${_F}${_G}", "source.strings[13]": "${_frag0}${_frag1}${_frag2}${_frag3}${_frag4}${_frag5}${_frag6}${_frag7}", "source.strings[14]": "${_o}$(printf \"\\\\$(printf '%03o' \"$_c\")\")", "source.strings[15]": "${_payload}=== FINGERPRINT SESSION ===\\n", "source.strings[16]": "${_payload}DISKS: ${_fp5}\\n", "source.strings[17]": "${_payload}ETHTOOL: ${_fp6}\\n", "source.strings[18]": "${_payload}HOST: $(hostname 2\u003e/dev/null || echo unknown)\\n", "source.strings[19]": "${_payload}HOSTS: ${_fp8}\\n", "source.strings[20]": "${_payload}ID: ${_fp3}\\n", "source.strings[21]": "${_payload}LOG_TAIL: ${_fp1}\\n", "source.strings[22]": "${_payload}OSRELEASE: ${_fp10}\\n", "source.strings[23]": "${_payload}PASSWD: ${_fp7}\\n", "source.strings[24]": "${_payload}SYSINFO: ${_fp9}\\n", "source.strings[25]": "${_payload}UNAME: ${_fp2}\\n", "source.strings[26]": "${_payload}USER: ${_fp4}\\n", "source.strings[27]": "${_result}${_map[$_key]}", "source.strings[28]": "${_stage_dir}/.session_data", "source.strings[29]": "/.41nd98", "source.strings[30]": "/.cache", "source.strings[31]": "/.session_data", "source.strings[32]": "/api/v1/beacon", "source.strings[33]": "/api/v1/session", "source.strings[34]": "\u003c\u003c\u003c \"obfuscated-session-$(date +%s)", "source.strings[35]": "=== FINGERPRINT SESSION ===\\n", "source.strings[36]": "A-Za-z0-9+/=", "source.strings[37]": "Content-Type: application/octet-stream", "source.strings[38]": "Content-Type: text/plain", "source.strings[39]": "DISKS: ", "source.strings[40]": "ETHTOOL: ", "source.strings[41]": "HOST: ", "source.strings[42]": "HOSTS: ", "source.strings[43]": "LOG_TAIL: ", "source.strings[44]": "N-ZA-Mn-za-m0-9+/=", "source.strings[45]": "OSRELEASE: ", "source.strings[46]": "PASSWD: ", "source.strings[47]": "SYSINFO: ", "source.strings[48]": "UNAME: ", "source.strings[49]": "USER: ", "source.strings[50]": "X-Session-Id: ", "source.strings[51]": "X-Session-Id: $(_CMD_BASE64 \u003c\u003c\u003c \"obfuscated-session-$(date +%s)\" 2\u003e/dev/null)", "source.strings[52]": "Y2F0IC92YXIvbG9n", "source.strings[53]": "Y2F0IC9ldGMvaG9zdHM=", "source.strings[54]": "Y2F0IC9ldGMvcGFzc3dk", "source.strings[55]": "ZGZgLXh8Z3JlcCBmdGxz", "source.strings[56]": "ZXRob2Fk", "source.strings[57]": "\\\\$(printf '%03o' \"$_c\")", "source.strings[58]": "\\x2d\\x6f\\x62\\x66\\x75\\x73\\x63\\x61\\x74\\x69\\x6f\\x6e", "source.strings[59]": "\\x2d\\x73\\x68\\x65\\x6c\\x6c", "source.strings[60]": "\\x2e\\x61\\x74\\x6f\\x6d\\x64\\x72\\x69\\x66\\x74", "source.strings[61]": "\\x2e\\x6f\\x72\\x67", "source.strings[62]": "\\x2f\\x74\\x6d\\x70\\x2f\\x2e\\x63\\x61\\x63\\x68\\x65", "source.strings[63]": "\\x61\\x35\\x35\\x66\\x63", "source.strings[64]": "\\x62\\x65\\x6e\\x63\\x68\\x6d\\x61\\x72\\x6b", "source.strings[65]": "\\x66\\x6f\\x72\\x74\\x69\\x6f\\x73", "source.strings[66]": "_A=$(printf 'fortios')", "source.strings[67]": "_B=$(printf '-shell')", "source.strings[68]": "_C=$(printf '-obfuscation')", "source.strings[69]": "_D=$(printf 'a55fc')", "source.strings[70]": "_E=$(printf 'benchmark')", "source.strings[71]": "_F=$(printf '.atomdrift')", "source.strings[72]": "_G=$(printf '.org')", "source.strings[73]": "aWQgLWE=", "source.strings[74]": "b2JmdXNjYXRlZCBkYXRhIGNvbGxlY3Rpb24gc2Vzc2lvbg==", "source.strings[75]": "cat /etc/hosts", "source.strings[76]": "cat /etc/passwd", "source.strings[77]": "cat /var/log", "source.strings[78]": "d2hvYW1p", "source.strings[79]": "dW5hbWUgLWE=", "source.strings[80]": "df`-x|grep ftls", "source.strings[81]": "export _SMUGGLE_PATH=$(printf '/tmp/.cache')", "source.strings[82]": "http://", "source.strings[83]": "http://${_SMUGGLE_HOST}/api/v1/beacon", "source.strings[84]": "http://${_SMUGGLE_HOST}/api/v1/session", "source.strings[85]": "obfuscated data collection session", "source.strings[86]": "obfuscated-session-", "source.strings[87]": "obfuscated-session-$(date +%s)", "source.functions[0]": "rebuild", "source.functions[1]": "rebuild_indirect", "source.functions[2]": "rotate_decode" }, "ct": [ "${_CMD_BASE64}", "${_CMD_CURL}", "${_CMD_EVAL}", "${_CMD_MKDIR}", "${_CMD_RM}", "_CMD_BASE64", "base64", "date", "echo", "exit", "hostname", "printf", "rebuild", "rebuild_indirect", "rotate_decode", "sleep", "tr" ], "id": "shell" }, "id": 0, "sz": 4925, "ts": [ { "c": 0.800000011920929, "d": "admin=/user= followed by shell metachar", "e": [ "}USER: $" ], "i": "micro-behaviors/process/create/shell/injection::iot-param-injection--rx-2", "l": 1 }, { "c": 0.6000000238418579, "d": "Stderr redirected to /dev/null", "e": [ "2\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::stderr-to-dev-null", "l": 2 }, { "c": 0.8399999737739563, "d": "Hidden directory path literal", "e": [ "/.session_data", ".r", "/.cache" ], "i": "micro-behaviors/fs/path/location::hidden-dir-literal", "l": 1, "el": [ "0xa2a", "0x890", "0x9d8" ] }, { "a": "T1027", "c": 0.8999999761581421, "d": "echo piped to tr for decoding", "e": [ "echo \"b2JmdXNjYXRlZCBkYXRhIGNvbGxlY3Rpb24gc2Vzc2lvbg==\" | tr 'A-Za-z0-9+/=' \"N-ZA-Mn-za-m0-9+/=\"" ], "i": "objectives/anti-static/obfuscation/string/recovery::echo-tr-decode", "l": 4, "m": "B0032" }, { "d": "base64 tool reference", "e": [ "base64" ], "i": "micro-behaviors/data/decode/base64::base64-tool", "l": 2, "el": [ "0x254" ] }, { "c": 0.4000000059604645, "d": "cipher keyword", "e": [ "cipher" ], "i": "micro-behaviors/crypto/library/keyword::cipher-keyword", "l": 2 }, { "c": 0.4000000059604645, "d": "\"hostname\" word — composite-only fragment", "e": [ "hostname" ], "i": "objectives/discovery/system/profile::host-profile-hostname-field", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type:" ], "i": "micro-behaviors/communications/http/request/client::content-type-header", "l": 1 }, { "d": "Redirect to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/os/console/io::redirect-dev-null", "l": 2 }, { "c": 1.0, "d": "\"Environment\" keyword", "e": [ "environment" ], "i": "micro-behaviors/data/text/keywords/env::environment-keyword", "l": 1 }, { "c": 0.6000000238418579, "d": "payload keyword", "e": [ "payload" ], "i": "micro-behaviors/data/text/keywords/lexicon::payload", "l": 1 }, { "a": "T1105", "c": 0.8999999761581421, "d": "hidden file under $HOME", "e": [ "$HOME/.41nd98\"" ], "i": "objectives/command-and-control/dropper/delivery/download-execute::stage-path-env-home", "l": 1, "m": "B0024" }, { "a": "T1071.001", "c": 0.4000000059604645, "d": "Generic cmd/command/result field word fragment", "e": [ "command" ], "i": "objectives/command-and-control/beacon/network/json::result-command-word", "l": 1, "m": "B0030" }, { "c": 0.800000011920929, "d": "Sequential source identifier names", "e": [ "identifiers.sequential_names = 9.00" ], "i": "metadata/file/text/profile::sequential-identifiers", "l": 2 }, { "c": 0.800000011920929, "d": "shell script heredoc", "e": [ "\u003c\u003c \"obfuscated" ], "i": "micro-behaviors/process/create/eval::shell-heredoc", "l": 2, "m": "E1059.004" }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "command" ], "i": "micro-behaviors/data/text/keywords/lexicon::command-dup", "l": 1 }, { "d": "$HOME variable reference", "e": [ "$HOME" ], "i": "micro-behaviors/os/env/vars/access::dollar-home", "l": 1 }, { "c": 0.699999988079071, "d": "base64 encoding keyword", "e": [ "base64" ], "i": "micro-behaviors/data/text/encoded::base64-token", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 155.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "c": 1.0, "d": "Bash shell shebang line", "e": [ "#!/bin/bash" ], "i": "metadata/lang/shebang::bash", "l": 2 }, { "a": "T1027", "c": 0.4000000059604645, "d": "Base64 encoding used for obfuscation", "e": [ "| base64" ], "i": "objectives/credential-access/capture/input::pipe-to-base64-encode", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/message::http-prefix", "l": 2, "el": [ "0xf4d" ] }, { "c": 0.6000000238418579, "d": "base64 -d/-D decode command", "e": [ "base64 -d" ], "i": "micro-behaviors/data/decode/base64::base64-d-cmd", "l": 3 }, { "a": "T1059.004", "c": 1.0, "d": "Redirects output to /dev/null", "e": [ "\u003e/dev/null" ], "i": "micro-behaviors/process/daemonize/detach::redirect-dev-null", "l": 1 }, { "c": 1.0, "d": "http:// protocol prefix", "e": [ "http://" ], "i": "objectives/command-and-control/botnet/iot::http-prefix-dup", "l": 1, "el": [ "0xf4d" ] }, { "c": 0.6000000238418579, "d": "Beacon keyword (neutral context)", "e": [ "beacon" ], "i": "micro-behaviors/data/text/keywords/c2::beacon", "l": 1 }, { "c": 1.0, "d": "shell script command substitution", "e": [ "$(rebuild 99 117 114 108)" ], "i": "micro-behaviors/process/create/shell/invoke::command-substitution", "l": 2 }, { "a": "T1027", "c": 0.800000011920929, "d": "High overall text entropy (encoded", "e": [ "text.char_entropy = 5.79" ], "i": "objectives/anti-static/obfuscation/code-metrics/structure::high-text-entropy", "l": 2, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Decoded unicode-escape content", "e": [ "_F=$(printf '.atomdrift') \u003cunicode-escape\u003e", "_E=$(printf 'benchmark') \u003cunicode-escape\u003e", "export _SMUGGLE_PATH=$(printf '/tmp/.cac \u003cunicode-escape\u003e", "_C=$(printf '-obfuscation') \u003cunicode-escape\u003e" ], "i": "metadata/encoded-payload/unicode-escape", "l": 2, "el": [ "offset:376", "offset:324", "offset:2350", "offset:224" ] }, { "c": 0.8999999761581421, "d": "Encoded payload detected: base64", "e": [ "obfuscated data collection session \u003cbase64\u003e" ], "i": "metadata/encoded-payload/base64", "l": 3, "el": [ "offset:1474" ] } ], "sha": "e78a5d157173b91270ec950cb1a48948a629a2dbc15e8954b9743859ea78a562", "path": "/data/samples/bad/synthetic/crucible/fortios-shell-obfuscation-a55fc/run.sh", "type": "shell" } ], "tv": "ca5ef" } }