{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9815003871917725, "class": 1 }, { "id": 1, "prob": 0.8715249300003052, "class": 0 } ], "prob": 0.9815004, "class": 1, "oprob": 0.9037814, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-01T19:25:11Z" }, "path": "822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25.zip", "raw": { "v": "4", "fs": [ { "f": "O₅(C₂I₆AlAsCa)H₃(Os₂Po₂Db)Md₂(Bi₂Pa)", "x": 115, "id": 0, "ss": [ [ 191307, "https://www.torproject.org/ (Tor Browser is not related to us)" ], [ 213488, "1.3.101.110" ], [ 213500, "1.3.101.112" ] ], "sz": 122451, "ts": [ { "d": "Binary exports symbols", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": ".onion domain reference", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/infrastructure/domain::onion-domain", "l": 3, "m": "C0002" }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "remove" ], "i": "micro-behaviors/fs/file/delete::remove", "l": 3 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "c": 0.949999988079071, "d": "ESXi-targeted ransomware attack chain", "e": [ "/vmfs/volumes/", "vmsvc/power.off", "power.off" ], "i": "objectives/impact/ransom/esxi::full-attack", "l": 4 }, { "c": 1.0, "d": "ELF GNU build-id note present", "e": [ "9a3806ab139e3a10231daa5b76db84a3684791e7" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x2eef0" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.8999999761581421, "d": "Reference to VMware VMFS volumes path", "e": [ "/vmfs/volumes/" ], "i": "micro-behaviors/os/sysinfo/vmware::vmfs-path", "l": 3 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files (legacy 64-bit)", "e": [ "open64" ], "i": "micro-behaviors/fs/file/open::open64", "l": 2 }, { "d": "pthread threading library", "e": [ "pthread_create" ], "i": "micro-behaviors/process/threading/operations::pthread", "l": 2 }, { "c": 0.6000000238418579, "d": "xargs command usage", "e": [ "xargs", "xargs" ], "i": "objectives/impact/wipe/disk::xargs-cmd", "l": 1 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "a": "T1486", "c": 0.699999988079071, "d": "Readme ransom note filename", "e": [ "HOW_TO_DECRYPT.txt" ], "i": "objectives/impact/ransom/native::readme-note-file", "l": 3, "m": "C0027" }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.09" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8500000238418579, "d": "vim-cmd vmsvc command", "e": [ "vim-cmd vmsvc" ], "i": "objectives/impact/ransom/esxi::vim-cmd-vmsvc", "l": 1 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/operations::x509-string", "l": 2 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 600.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "power.off command", "e": [ "power.off" ], "i": "objectives/impact/ransom/esxi::power-off-cmd", "l": 1 }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2 }, { "a": "T1489", "c": 0.8999999761581421, "d": "VMware VM enumeration", "e": [ "vmsvc/getallvms" ], "i": "objectives/impact/services/stop::vmsvc-getallvms", "l": 4 }, { "c": 0.6600000262260437, "d": "Rename files", "e": [ "rename" ], "i": "micro-behaviors/fs/file/rename::rename-base", "l": 2 }, { "c": 0.8999999761581421, "d": "VMware vim-cmd tool", "e": [ "vim-cmd" ], "i": "objectives/impact/ransom/esxi::vim-cmd-tool", "l": 3 }, { "c": 0.800000011920929, "d": "Ransom note filename (HOW_TO/README pattern)", "e": [ "HOW_TO_DECRYPT." ], "i": "objectives/impact/ransom/markers::ultimatum-filename-a", "l": 3 }, { "c": 0.8999999761581421, "d": "system() function call", "e": [ "system" ], "i": "micro-behaviors/process/create/shell::system-fn", "l": 3 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "d": ".so extension reference", "e": [ ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v2 onion address (deprecated)", "e": [ "yrrpdp57zoq3ooqd.onion", "y6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v2", "l": 3, "m": "C0026" }, { "c": 0.7200000286102295, "d": "cBPF load ICMP sequence field", "e": [ "28 00 00 00 28 00 00 00", "28 00 00 00 28 00 00 00", "28 00 00 00 28 00 00 00" ], "i": "micro-behaviors/os/bpf/program/icmp::cbpf-load-icmp-seq-ethernet", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "a": "T1497.003", "d": "Timing measurement with delays (sandbox/VM", "e": [ "usleep", "gettimeofday" ], "i": "objectives/anti-analysis/timing/evasion::timing-evasion", "l": 3, "m": "B0003.005" }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 0.699999988079071, "d": "/dev/random access", "e": [ "/dev/random" ], "i": "micro-behaviors/os/random/operations::dev-random", "l": 2 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/", "http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "ELF overall entropy is low", "e": [ "binary.overall_entropy = 3.22" ], "i": "metadata/binary/metrics::firmware-overall-entropy-low", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "d": "password keyword", "e": [ "… Login: %s\n Password: %s\n\nTo get an access t…", "Password: %s" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 1.0, "d": "torproject.org domain", "e": [ "https://www.torproject.org/ (Tor Browser is not related to us)", "…wser at:\n https://www.torproject.org/ (Tor Browser is not re…" ], "i": "objectives/impact/ransom/encrypt::torproject-domain", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "+notify /etc/motd", "/etc/motd" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.22" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libpthread.so.0" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "a": "T1027.007", "c": 0.800000011920929, "d": "ROR13 hash algorithm constant", "e": [ "cd", "cf", "ce", "ce", "ce", "ce", "ce", "ce", "cf", "cf", "cf", "cf", "cf", "cd", "cd", "cd" ], "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": ".onion address pattern", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/impact/ransom/encrypt::onion-address", "l": 1 }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "a": "T1057", "d": "Dev app vim", "e": [ "vim" ], "i": "micro-behaviors/process/enumerate/apps::dev-apps-vim", "l": 3, "m": "E1592" }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 1b d3 ff ff", "ba 42 d3 ff ff", "bc 6c 85 ff ff", "ba 35 38 00 00", "ba ac e5 fe ff", "be e5 03 00 00", "ba 01 48 63 f8", "be b1 a9 00 00", "be bc fb ff ff", "bd 72 b7 ff ff", "ba 1b 8a fd ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 0.8999999761581421, "d": "vmsvc/power.off command", "e": [ "vmsvc/power.off" ], "i": "objectives/impact/ransom/esxi::vmsvc-power-off", "l": 1 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1025.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt", "encrypt", "Encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "/dev/urandom" ], "i": "micro-behaviors/os/random::urandom", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.92" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 26.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libpthread.so.0", "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 252392.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v3 onion address", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v3", "l": 4, "m": "C0026" }, { "c": 0.30000001192092896, "d": "Sleep for microsecond duration", "e": [ "usleep" ], "i": "micro-behaviors/time/query::usleep-func", "l": 2 }, { "a": "T1566", "c": 0.8500000238418579, "d": "Cordova config allows external domain origin", "e": [ "https://www.torproject.org/" ], "i": "objectives/credential-access/phishing/workflow::cordova-external-origin", "l": 1 } ], "sha": "e9bbe41c57496ce01e956cf59d300467e6bbb625e6539800a5a5d800f9a7ea57", "path": "/data/samples/bad/datasets/malware-souk/corpus/Hive/samples/822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25.zip", "type": "zip" }, { "f": "O₄(C₂I₆AlAs)H₃(Os₂Po₂Db)Md₂(Bi₂Pa)", "x": 115, "dp": 1, "id": 1, "is": [ "", "memcpy", "free", "pthread_create", "abort", "errno_location", "remove", "strncmp", "ITM_deregisterTMCloneTable", "strcpy", "pthread_cond_broadcast", "puts", "sigaction", "fread", "write", "pthread_cond_wait", "clock", "fclose", "opendir", "strlen", "stack_chk_fail", "printf", "pthread_mutex_destroy", "snprintf", "gettimeofday", "memset", "close", "closedir", "regcomp", "system", "read", "libc_start_main", "memcmp", "pthread_cond_signal", "calloc", "strcmp", "fprintf", "gmon_start__", "pthread_cond_init", "readdir", "pthread_mutex_unlock", "malloc", "regexec", "realloc", "setvbuf", "open64", "creat64", "pthread_cond_destroy", "open", "access", "fopen", "pthread_join", "rename", "strcat", "lseek64", "ITM_registerTMCloneTable", "pthread_mutex_init", "get_nprocs", "pthread_mutex_lock", "usleep", "cxa_finalize" ], "ms": { "elf": { "relro": "partial", "e_type": 3.0, "has_got": true, "has_plt": true, "has_note": true, "e_machine": 62.0, "class_bits": 64.0, "note_count": 2.0, "nx_enabled": true, "entry_point": 13392.0, "needed_libs": 2.0, "dynsym_count": 62.0, "has_eh_frame": true, "stack_canary": true, "dynrela_count": 164.0, "entry_section": ".text", "little_endian": true, "pltreloc_count": 55.0, "build_id_length": 20.0, "has_interpreter": true, "build_id_present": true, "fini_array_count": 1.0, "gnu_hash_present": true, "init_array_count": 1.0, "program_header_count": 11.0, "section_header_count": 28.0, "load_segment_max_p_memsz": 164949.0, "load_segment_max_p_filesz": 164949.0, "section_relocation_group_count": 2.0 }, "binary": { "code_size": 164933.0, "file_size": 252392.0, "entry_point": 13392.0, "has_overlay": true, "code_entropy": 4.23, "data_entropy": 4.03, "export_count": 1.0, "import_count": 61.0, "overlay_size": 1796.0, "string_count": 354.0, "overlay_ratio": 0.01, "section_count": 26.0, "avg_complexity": 4.92, "function_count": 132.0, "import_density": 0.38, "max_complexity": 88.0, "string_density": 2.2, "overall_entropy": 3.22, "overlay_entropy": 1.55, "avg_basic_blocks": 7.77, "avg_section_size": 9235.92, "dependency_count": 2.0, "entropy_variance": 1.64, "function_density": 0.82, "avg_function_size": 379.11, "avg_string_length": 24.38, "complexity_per_kb": 0.03, "max_string_length": 1234.0, "avg_string_entropy": 3.09, "code_to_data_ratio": 2.19, "data_to_file_ratio": 0.0, "text_to_file_ratio": 0.65, "total_basic_blocks": 1025.0, "provenance_id_length": 20.0, "string_length_stddev": 67.28, "largest_section_ratio": 0.65, "provenance_id_present": true, "sentence_string_count": 35.0, "sentence_string_ratio": 0.1, "behavioral_import_ratio": 0.08, "function_analysis_depth": 1.0, "high_complexity_functions": 2.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 0, "printf" ], [ 680, "/lib64/ld-linux-x86-64.so.2" ], [ 2305, "libpthread.so.0" ], [ 2321, "free" ], [ 2326, "abort" ], [ 2332, "_ITM_deregisterTMCloneTable" ], [ 2360, "fclose" ], [ 2367, "strlen" ], [ 2374, "__stack_chk_fail" ], [ 2391, "memset" ], [ 2398, "calloc" ], [ 2412, "malloc" ], [ 2419, "realloc" ], [ 2427, "fopen" ], [ 2433, "_ITM_registerTMCloneTable" ], [ 2459, "write" ], [ 2465, "__errno_location" ], [ 2482, "system" ], [ 2489, "pthread_mutex_destroy" ], [ 2511, "pthread_join" ], [ 2524, "pthread_cond_wait" ], [ 2542, "pthread_create" ], [ 2557, "open64" ], [ 2564, "pthread_cond_broadcast" ], [ 2587, "pthread_cond_signal" ], [ 2607, "pthread_mutex_lock" ], [ 2626, "pthread_mutex_unlock" ], [ 2647, "pthread_cond_init" ], [ 2665, "pthread_cond_destroy" ], [ 2686, "lseek64" ], [ 2694, "sigaction" ], [ 2704, "pthread_mutex_init" ], [ 2740, "readdir" ], [ 2748, "strncmp" ], [ 2756, "regexec" ], [ 2764, "closedir" ], [ 2784, "creat64" ], [ 2792, "memcmp" ], [ 2799, "memcpy" ], [ 2806, "strcat" ], [ 2813, "remove" ], [ 2820, "opendir" ], [ 2828, "regcomp" ], [ 2836, "stderr" ], [ 2843, "usleep" ], [ 2850, "fread" ], [ 2856, "gettimeofday" ], [ 2869, "rename" ], [ 2876, "fprintf" ], [ 2884, "__cxa_finalize" ], [ 2899, "get_nprocs" ], [ 2910, "setvbuf" ], [ 2918, "access" ], [ 2925, "__libc_start_main" ], [ 2943, "snprintf" ], [ 2998, "__gmon_start__" ], [ 18215, "AVAUATSH" ], [ 19403, "AWAVAUATH" ], [ 21391, "AWAVATSH" ], [ 25648, "AWAVAUATUSH" ], [ 26252, "OPH1" ], [ 28080, "ATUSH" ], [ 28912, "AVAUATU1" ], [ 29344, "AWAVAUATU1" ], [ 30816, "ATSH" ], [ 36752, "AUATUSH" ], [ 42368, "AVAUATUSH" ], [ 44736, "AVAUATUH" ], [ 55024, "AWAVAUATUH" ], [ 55734, "AUATA" ], [ 56381, "O8PH" ], [ 56468, "ATUH" ], [ 57179, "AVAUUSH" ], [ 58022, "AVE1" ], [ 62352, "AWAVI" ], [ 62688, "AUATUH" ], [ 65453, "AVAU" ], [ 66121, "RHE1" ], [ 67984, "AWE1" ], [ 78125, "/w0D" ], [ 79787, "/wYA" ], [ 84727, "AVAUATU" ], [ 89415, "S E1" ], [ 112448, "AUATI" ], [ 115056, "ATE1" ], [ 115061, "USH9" ], [ 115281, "VUUUH" ], [ 119716, "AVAUI" ], [ 124215, "AUATU" ], [ 126144, "AWAVAUATI" ], [ 129571, "AUATE1" ], [ 130560, "H9J A" ], [ 130586, "H9J0H" ], [ 137920, "AWAVAUI" ], [ 139957, ")T$(D" ], [ 147738, "\\$(I)" ], [ 157221, "AVAUATI" ], [ 163461, "|$()" ], [ 166096, "AVAUATUS" ], [ 167120, "u.H9H u(H9H(u\"H9H0u" ], [ 171237, "AUUH" ], [ 171792, "AWAVAUATUS" ], [ 172736, "AWAVA" ], [ 180228, "-no-stop" ], [ 180237, "-low-cpu" ], [ 180246, "invalid argument: %s" ], [ 180268, "Error occurred" ], [ 180283, "!encrypt %s" ], [ 180296, "+encrypt %s" ], [ 180314, "Encrypting files" ], [ 181013, "9URB" ], [ 181106, "Avhr" ], [ 185918, "Yfbo" ], [ 188608, "V8FN" ], [ 188901, "O3LO" ], [ 190196, "5ojk" ], [ 190574, "Exporting key" ], [ 190588, "%s.key.%s" ], [ 190598, "! export %s" ], [ 190611, "+ export %s" ], [ 190630, "FqRAvHSSJR6Z" ], [ 190643, "fWqzu3Kqd31FWKUvb5rq" ], [ 190664, "HOW_TO_DECRYPT.txt" ], [ 190688, "http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/" ], [ 190760, "http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/" ], [ 190872, "Your network has been breached and all data were encrypted.\nPersonal data, financial reports and important documents are ready t" ], [ 190932, "Personal data, financial reports and important documents are ready to disclose." ], [ 191013, "To decrypt all the data and to prevent exfiltrated files to be disclosed at" ], [ 191093, "you will need to purchase our decryption software." ], [ 191145, "Please contact our sales department at:" ], [ 191195, "Login: %s" ], [ 191214, "Password: %s" ], [ 191234, "To get an access to .onion websites download and install Tor Browser at:" ], [ 191307, "https://www.torproject.org/ (Tor Browser is not related to us)" ], [ 191375, "Follow the guidelines below to avoid losing your data:" ], [ 191431, "- Do not delete or reinstall VMs. There will be nothing to decrypt." ], [ 191500, "- Do not modify, rename or delete *.key.%s files. Your data will be" ], [ 191570, "undecryptable." ], [ 191588, "- Do not modify or rename encrypted files. You will lose them." ], [ 191652, "- Do not report to the Police, FBI, etc. They don't care about your business." ], [ 191731, "They simply won't allow you to pay. As a result you will lose everything." ], [ 191808, "- Do not hire a recovery company. They can't decrypt without the key." ], [ 191880, "They also don't care about your business. They believe that they are" ], [ 191953, "good negotiators, but it is not. They usually fail. So speak for yourself." ], [ 192031, "- Do not reject to purchase. Exfiltrated files will be publicly disclosed." ], [ 192125, "/etc/motd" ], [ 192135, "+notify /etc/motd" ], [ 192153, "Notifying" ], [ 192163, "/vmfs/volumes/" ], [ 192183, "Prenotifying" ], [ 192196, "+ prenotify %s" ], [ 192216, "Preprocess" ], [ 192227, "Stopping VMs" ], [ 192240, "vim-cmd vmsvc/getallvms | grep -o -E '^[0-9]+' | xargs -r -n 1 vim-cmd vmsvc/power.off" ], [ 192327, "Export failed" ], [ 192361, "%s.%s.%s" ], [ 192376, "sha512-256" ], [ 192387, "/dev/urandom" ], [ 192400, "src/hashes/sha2/sha512.c" ], [ 192447, "out != NULL" ], [ 192459, "SHA512" ], [ 192470, "sha512" ], [ 192480, "abcdefghbcdefghicdefghijdefghijkefghijklfghijklmghijklmnhijklmnoijklmnopjklmnopqklmnopqrlmnopqrsmnopqrstnopqrstu" ], [ 193328, "src/hashes/sha2/sha512_256.c" ], [ 193357, "SHA512-265" ], [ 193472, "src/math/ltm_desc.c" ], [ 193536, "src/misc/base64/base64_decode.c" ], [ 193568, "outlen != NULL" ], [ 194112, "src/misc/base64/base64_encode.c" ], [ 194144, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], [ 194216, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" ], [ 194288, "LTC_ARGCHK '%s' failure on line %d of file %s" ], [ 194336, "src/misc/crypt/crypt_find_hash.c" ], [ 194376, "src/misc/crypt/crypt_find_prng.c" ], [ 194416, "src/misc/crypt/crypt_register_hash.c" ], [ 194453, "hash != NULL" ], [ 194472, "src/misc/crypt/crypt_register_prng.c" ], [ 194509, "prng != NULL" ], [ 194522, "src/pk/ecc/ltc_ecc_map.c" ], [ 194557, "modulus != NULL" ], [ 194584, "src/pk/ecc/ltc_ecc_mul2add.c" ], [ 194648, "src/pk/ecc/ltc_ecc_mulmod_timing.c" ], [ 194704, "src/pk/ecc/ltc_ecc_projective_add_point.c" ], [ 194760, "src/pk/ecc/ltc_ecc_projective_dbl_point.c" ], [ 194802, "src/pk/rsa/rsa_encrypt_key.c" ], [ 194831, "src/pk/rsa/rsa_exptmod.c" ], [ 194856, "src/pk/rsa/rsa_get_size.c" ], [ 194882, "src/pk/rsa/rsa_import.c" ], [ 194906, "ltc_mp.name != NULL" ], [ 194926, "src/pk/rsa/rsa_key.c" ], [ 194947, "src/pk/rsa/rsa_make_key.c" ], [ 194973, "size \u003e 0" ], [ 194982, "src/prngs/fortuna.c" ], [ 195002, "inlen \u003e 0" ], [ 195012, "source \u003c= 255" ], [ 195026, "pool \u003c LTC_FORTUNA_POOLS" ], [ 195051, "fortuna" ], [ 195059, "src/prngs/sprng.c" ], [ 195083, "src/ciphers/aes/aes.c" ], [ 195127, "skey != NULL" ], [ 195140, "keysize != NULL" ], [ 195156, "AES Encrypt" ], [ 195168, "AES Decrypt" ], [ 195184, "rijndael" ], [ 207186, "PPxD\u003c\u003c%" ], [ 207618, "aaj_55" ], [ 209236, "\u003c\u003cxD" ], [ 209928, "CCCCDDDD" ], [ 210060, "IIIImmmm" ], [ 210076, "%%%%rrrr" ], [ 210144, "llllppppHHHHPPPP" ], [ 210184, "FFFFWWWW" ], [ 210348, "AAAAOOOOgggg" ], [ 210460, "nnnnGGGG" ], [ 210532, "VVVV\u003e\u003e\u003e\u003eKKKK" ], [ 210652, "____````QQQQ" ], [ 210828, "ccccUUUU!!!!" ], [ 212308, "D\u003c\u003cx" ], [ 212895, ",src/hashes/sha2/sha256.c" ], [ 212921, "SHA256" ], [ 212928, "sha256" ], [ 212936, "abcdbcdecdefdefgefghfghighijhijkijkljklmklmnlmnomnopnopq" ], [ 213039, "[src/math/rand_prime.c" ], [ 213072, "src/misc/zeromem.c" ], [ 213096, "src/pk/asn1/der/sequence/der_decode_sequence_multi.c" ], [ 213152, "src/pk/asn1/x509/x509_decode_subject_public_key_info.c" ], [ 213218, "public_key_len != NULL" ], [ 213248, "src/pk/pkcs1/pkcs_1_oaep_encode.c" ], [ 213282, "msg != NULL" ], [ 213294, "src/prngs/rng_get_bytes.c" ], [ 213336, "/dev/random" ], [ 213352, "src/hashes/helper/hash_memory.c" ], [ 213384, "src/pk/asn1/oid/pk_get_oid.c" ], [ 213488, "1.3.101.110" ], [ 213500, "1.3.101.112" ], [ 213512, "src/pk/asn1/oid/pk_oid_str.c" ], [ 213541, "oidlen != NULL" ], [ 213556, "oid != NULL" ], [ 213568, "OID != NULL" ], [ 213580, "src/pk/pkcs1/pkcs_1_mgf1.c" ], [ 213607, "seed != NULL" ], [ 213620, "mask != NULL" ], [ 213640, "src/pk/asn1/der/custom_type/der_decode_custom_type.c" ], [ 213693, "list != NULL" ], [ 213706, "root != NULL" ], [ 213800, "src/pk/asn1/der/custom_type/der_length_custom_type.c" ], [ 214224, "Reserved for use by the encoding rules" ], [ 214264, "External type and Instance-of type" ], [ 214304, "Relative object identifier type" ], [ 214336, "Reserved for future editions of this Recommendation | International Standard" ], [ 214416, "Sequence and Sequence-of types" ], [ 214448, "TeletexString (T61String) type" ], [ 214480, "VisibleString (ISO646String) type" ], [ 214520, "UnrestrictedCharacterString type" ], [ 214560, "OID internationalized resource identifier type" ], [ 214608, "Relative OID internationalized resource identifier type" ] ], "sz": 252392, "ts": [ { "c": 1.0, "d": "ELF program interpreter present", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking::elf-interpreter", "l": 2 }, { "c": 1.0, "d": "ELF needed library", "e": [ "libpthread.so.0", "libc.so.6" ], "i": "metadata/binary/linking::elf-needed-lib", "l": 2 }, { "c": 1.0, "d": "ELF GNU build-id note present", "e": [ "9a3806ab139e3a10231daa5b76db84a3684791e7" ], "i": "metadata/build/reproducible::elf-build-id", "l": 2 }, { "c": 0.6000000238418579, "d": "xargs command usage", "e": [ "xargs", "xargs" ], "i": "objectives/impact/wipe/disk::xargs-cmd", "l": 1 }, { "c": 0.8500000238418579, "d": "vim-cmd vmsvc command", "e": [ "vim-cmd vmsvc" ], "i": "objectives/impact/ransom/esxi::vim-cmd-vmsvc", "l": 1 }, { "c": 0.8999999761581421, "d": "VMware vim-cmd tool", "e": [ "vim-cmd" ], "i": "objectives/impact/ransom/esxi::vim-cmd-tool", "l": 3 }, { "c": 0.800000011920929, "d": "Very short file (under 12 lines)", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-under-12-lines", "l": 1 }, { "c": 0.949999988079071, "d": "File is a one-liner", "e": [ "text.total_lines = 1.00" ], "i": "metadata/package/metrics::file-one-liner", "l": 1 }, { "c": 0.699999988079071, "d": "power.off command", "e": [ "power.off" ], "i": "objectives/impact/ransom/esxi::power-off-cmd", "l": 1 }, { "a": "T1489", "c": 0.8999999761581421, "d": "VMware VM enumeration", "e": [ "vmsvc/getallvms" ], "i": "objectives/impact/services/stop::vmsvc-getallvms", "l": 4 }, { "c": 0.8999999761581421, "d": "vmsvc/power.off command", "e": [ "vmsvc/power.off" ], "i": "objectives/impact/ransom/esxi::vmsvc-power-off", "l": 1 }, { "c": 0.800000011920929, "d": "High density of shell commands", "e": [ "text.import_density = 600.00" ], "i": "metadata/binary/metrics::shell-high-import-density", "l": 2 }, { "c": 1.0, "d": "shell code embedded in string", "e": [ "Detected shell at offset 0x2eef0" ], "i": "metadata/lang/embedded::shell", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 2 }, { "a": "T1057", "d": "Dev app vim", "e": [ "vim" ], "i": "micro-behaviors/process/enumerate/apps::dev-apps-vim", "l": 3, "m": "E1592" }, { "c": 0.699999988079071, "d": "/dev/random access", "e": [ "/dev/random" ], "i": "micro-behaviors/os/random/operations::dev-random", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ sections (installer/packer)", "e": [ "binary.section_count = 26.00" ], "i": "metadata/binary/metrics::many-sections-20", "l": 1 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 1025.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.09" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "open" ], "i": "micro-behaviors/fs/file/open::open-base", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF overall entropy is low", "e": [ "binary.overall_entropy = 3.22" ], "i": "metadata/binary/metrics::firmware-overall-entropy-low", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/binary/linking::elf-interpreter-section-name", "l": 2 }, { "c": 0.30000001192092896, "d": "Sleep for microsecond duration", "e": [ "usleep" ], "i": "micro-behaviors/time/query::usleep-func", "l": 2 }, { "c": 0.30000001192092896, "d": "Delete files", "e": [ "remove" ], "i": "micro-behaviors/fs/file/delete::remove", "l": 3 }, { "d": "password keyword", "e": [ "… Login: %s\n Password: %s\n\nTo get an access t…", "Password: %s" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses closedir", "e": [ "closedir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-closedir", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "d": "Characteristic system library export __cxa_finalize", "e": [ "cxa_finalize" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-cxa-finalize", "l": 2 }, { "c": 0.6600000262260437, "d": "Rename files", "e": [ "rename" ], "i": "micro-behaviors/fs/file/rename::rename-base", "l": 2 }, { "a": "T1124", "c": 0.30000001192092896, "d": "Get current time with microsecond precision", "e": [ "gettimeofday" ], "i": "micro-behaviors/time/query::gettimeofday", "l": 2, "m": "T1124" }, { "a": "T1027.007", "c": 0.800000011920929, "d": "ROR13 hash algorithm constant", "e": [ "cd", "cf", "ce", "ce", "ce", "ce", "ce", "ce", "cf", "cf", "cf", "cf", "cf", "cd", "cd", "cd" ], "i": "objectives/anti-static/obfuscation/imports::ror13-hash-seed", "l": 1, "m": "B0032.014" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 132.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 1.0, "d": "torproject.org domain", "e": [ "https://www.torproject.org/ (Tor Browser is not related to us)", "…wser at:\n https://www.torproject.org/ (Tor Browser is not re…" ], "i": "objectives/impact/ransom/encrypt::torproject-domain", "l": 1 }, { "c": 0.8999999761581421, "d": "__stack_chk_fail function", "e": [ "stack_chk_fail", "sym.imp.__stack_chk_fail" ], "i": "metadata/hardening::stack-chk-fail", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": ".onion domain reference", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/infrastructure/domain::onion-domain", "l": 3, "m": "C0002" }, { "c": 0.6600000262260437, "d": "Uses opendir", "e": [ "opendir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-opendir", "l": 2 }, { "c": 0.8999999761581421, "d": "Abort program execution", "e": [ "abort" ], "i": "micro-behaviors/os/signal/handler::abort", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "a": "T1055", "c": 0.25, "d": "Repeated 0x07 code constant (possible PROT_RWX)", "e": [ "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00", "07 00 00 00" ], "i": "micro-behaviors/mem/protect/modify::rwx-prot-bytes", "l": 1 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.92" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "d": ".so extension reference", "e": [ ".so", ".so" ], "i": "micro-behaviors/fs/path/extension::so", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /etc configuration files", "e": [ "+notify /etc/motd", "/etc/motd" ], "i": "micro-behaviors/fs/path/config::config-etc", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.7200000286102295, "d": "cBPF load ICMP sequence field", "e": [ "28 00 00 00 28 00 00 00", "28 00 00 00 28 00 00 00", "28 00 00 00 28 00 00 00" ], "i": "micro-behaviors/os/bpf/program/icmp::cbpf-load-icmp-seq-ethernet", "l": 1 }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 1.0, "d": "Access /dev/urandom", "e": [ "/dev/urandom" ], "i": "micro-behaviors/os/random::urandom", "l": 2 }, { "c": 0.8999999761581421, "d": "Install signal handler (POSIX sigaction)", "e": [ "sigaction" ], "i": "micro-behaviors/os/signal/handler::sigaction", "l": 2 }, { "d": "Characteristic system library exports", "e": [ "libc_start_main" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-symbols", "l": 2 }, { "c": 0.6600000262260437, "d": "Reference to /lib64", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "micro-behaviors/fs/path/system::system-lib64", "l": 2 }, { "c": 0.6600000262260437, "d": "Uses readdir", "e": [ "readdir" ], "i": "micro-behaviors/fs/directory/readdir::readdir-readdir", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.22" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/binary/linking::elf-dynstr-section-name", "l": 2 }, { "a": "T1027.010", "d": "Hardcoded standard base64 alphabet", "e": [ "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" ], "i": "micro-behaviors/data/encode/base64::alphabet-standard", "l": 2, "m": "B0032.001" }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v2 onion address (deprecated)", "e": [ "yrrpdp57zoq3ooqd.onion", "y6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v2", "l": 3, "m": "C0026" }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/binary/linking::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 61.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "d": "pthread threading library", "e": [ "pthread_create" ], "i": "micro-behaviors/process/threading/operations::pthread", "l": 2 }, { "a": "T1090.003", "c": 0.8500000238418579, "d": "Tor v3 onion address", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/command-and-control/channel/tor::onion-address-v3", "l": 4, "m": "C0026" }, { "a": "T1486", "c": 0.75, "d": "flock LOCK_EX call bytecode pattern", "e": [ "be 1b d3 ff ff", "ba 42 d3 ff ff", "bc 6c 85 ff ff", "ba 35 38 00 00", "ba ac e5 fe ff", "be e5 03 00 00", "ba 01 48 63 f8", "be b1 a9 00 00", "be bc fb ff ff", "bd 72 b7 ff ff", "ba 1b 8a fd ff" ], "i": "objectives/impact/ransom/esxi::flock-lockex", "l": 1, "m": "C0027" }, { "c": 0.4000000059604645, "d": "encrypt function", "e": [ "encrypt", "encrypt", "Encrypt" ], "i": "micro-behaviors/crypto/library::encrypt-fn", "l": 2 }, { "d": "Characteristic system library export __errno_location", "e": [ "errno_location" ], "i": "micro-behaviors/dylib/library/libc::libc-characteristic-errno", "l": 2 }, { "a": "T1071.001", "c": 0.699999988079071, "d": "Network URL with domain name (binary)", "e": [ "http://hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion/", "http://hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion/" ], "i": "objectives/command-and-control/infrastructure/domain::http-url-binary", "l": 3, "m": "C0002" }, { "c": 1.0, "d": "Binary format is identified", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary::binary-format-checked", "l": 2 }, { "d": "Binary exports symbols", "e": [ "binary.export_count = 1.00" ], "i": "metadata/binary/symbols::has-exports", "l": 1 }, { "c": 0.699999988079071, "d": "Read file descriptor (read/pread)", "e": [ "read" ], "i": "micro-behaviors/fs/file/read::read", "l": 2 }, { "c": 0.6600000262260437, "d": "Write files", "e": [ "write" ], "i": "micro-behaviors/fs/file/write::write", "l": 2 }, { "c": 0.6600000262260437, "d": "Open files", "e": [ "fopen" ], "i": "micro-behaviors/fs/file/open::fopen", "l": 2 }, { "c": 1.0, "d": ".onion address pattern", "e": [ "hivecust6vhekztbqgdnkks64ucehqacge3dij3gyrrpdp57zoq3ooqd.onion", "hiveleakdbtnp76ulyhi52eag6c6tyc3xw7ez7iqy6wc34gd2nekazyd.onion" ], "i": "objectives/impact/ransom/encrypt::onion-address", "l": 1 }, { "a": "T1486", "c": 0.699999988079071, "d": "Readme ransom note filename", "e": [ "HOW_TO_DECRYPT.txt" ], "i": "objectives/impact/ransom/native::readme-note-file", "l": 3, "m": "C0027" }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/binary/linking::elf-dynsym-section-name", "l": 2 }, { "c": 0.6600000262260437, "d": "Check if file exists", "e": [ "access" ], "i": "micro-behaviors/fs/file/stat::stat-exists", "l": 2 }, { "c": 0.800000011920929, "d": "Ransom note filename (HOW_TO/README pattern)", "e": [ "HOW_TO_DECRYPT." ], "i": "objectives/impact/ransom/markers::ultimatum-filename-a", "l": 3 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 252392.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "Reference to VMware VMFS volumes path", "e": [ "/vmfs/volumes/" ], "i": "micro-behaviors/os/sysinfo/vmware::vmfs-path", "l": 3 }, { "c": 0.6000000238418579, "d": "x509 string reference", "e": [ "x509" ], "i": "micro-behaviors/crypto/certificate/operations::x509-string", "l": 2 }, { "c": 0.8999999761581421, "d": "system() function call", "e": [ "system" ], "i": "micro-behaviors/process/create/shell::system-fn", "l": 3 }, { "c": 1.0, "d": "ELF64 class marker", "e": [ "elf.class_bits = 64.00" ], "i": "metadata/binary/metrics::elf64-class", "l": 1 }, { "c": 0.6600000262260437, "d": "Open files (legacy 64-bit)", "e": [ "open64" ], "i": "micro-behaviors/fs/file/open::open64", "l": 2 }, { "c": 0.699999988079071, "d": "Read stream (fread)", "e": [ "fread" ], "i": "micro-behaviors/fs/file/read::fread", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynamic section name", "e": [ ".dynamic" ], "i": "metadata/hardening::elf-dynamic-section-name", "l": 2 }, { "c": 1.0, "d": "ELF needed library metadata", "e": [ "libpthread.so.0", "libc.so.6" ], "i": "metadata/binary/linking/runtime::needed-lib", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF interpreter section name", "e": [ ".interp" ], "i": "metadata/hardening::elf-interpreter-section-name", "l": 2 }, { "c": 1.0, "d": "ELF program interpreter metadata", "e": [ "/lib64/ld-linux-x86-64.so.2" ], "i": "metadata/binary/linking/runtime::interpreter", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynstr section name", "e": [ ".dynstr" ], "i": "metadata/hardening::elf-dynstr-section-name", "l": 2 }, { "c": 0.8999999761581421, "d": "ELF dynsym section name", "e": [ ".dynsym" ], "i": "metadata/hardening::elf-dynsym-section-name", "l": 2 }, { "c": 0.949999988079071, "d": "ESXi-targeted ransomware attack chain", "e": [ "/vmfs/volumes/", "vmsvc/power.off", "power.off" ], "i": "objectives/impact/ransom/esxi::full-attack", "l": 4 }, { "a": "T1497.003", "d": "Timing measurement with delays (sandbox/VM", "e": [ "usleep", "gettimeofday" ], "i": "objectives/anti-analysis/timing/evasion::timing-evasion", "l": 3, "m": "B0003.005" } ], "sha": "822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25", "path": "/data/samples/bad/datasets/malware-souk/corpus/Hive/samples/822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25.zip!!822d89e7917d41a90f5f65bee75cad31fe13995e43f47ea9ea536862884efc25", "type": "elf" } ], "tv": "2a0fe" } }