{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9940488338470459, "class": 2 }, { "id": 1, "prob": 0.9069790244102478, "class": 0 } ], "prob": 0.99404883, "class": 2, "oprob": 0.968995, "oclass": 0, "version": "v16.16", "thresholds": [ 0.9815004, 0.99404883 ], "analyzed_at": "2026-05-02T05:57:15Z" }, "path": "507081", "raw": { "v": "4", "fs": [ { "f": "K₂O₁₂(Al₃C₁₂Ca₆SAs₉Co₄P₂Dy₂Er₃I₂Pr₂Xe)H₆(Cm₃Db₂F₃HfOs₅Po)Md₆(Bi₄SiPaPt)Th₄", "x": 672, "id": 0, "is": [ "DeleteCriticalSection", "LeaveCriticalSection", "EnterCriticalSection", "InitializeCriticalSection", "VirtualFree", "VirtualAlloc", "LocalFree", "LocalAlloc", "GetVersion", "GetCurrentThreadId", "InterlockedDecrement", "InterlockedIncrement", "VirtualQuery", "WideCharToMultiByte", "MultiByteToWideChar", "lstrlenA", "lstrcpynA", "LoadLibraryExA", "GetThreadLocale", "GetStartupInfoA", "GetProcAddress", "GetModuleHandleA", "GetModuleFileNameA", "GetLocaleInfoA", "GetLastError", "GetCommandLineA", "FreeLibrary", "FindFirstFileA", "FindClose", "ExitProcess", "WriteFile", "UnhandledExceptionFilter", "SetFilePointer", "SetEndOfFile", "RtlUnwind", "ReadFile", "RaiseException", "GetStdHandle", "GetFileSize", "GetFileType", "CreateFileA", "CloseHandle", "GetKeyboardType", "LoadStringA", "MessageBoxA", "CharNextA", "RegQueryValueExA", "RegOpenKeyExA", "RegCloseKey", "SysFreeString", "SysReAllocStringLen", "SysAllocStringLen", "TlsSetValue", "TlsGetValue", "LocalAlloc", "GetModuleHandleA", "RegQueryValueExA", "RegOpenKeyExA", "RegCloseKey", "lstrcpyA", "WritePrivateProfileStringA", "WriteFile", "WaitForSingleObject", "VirtualQuery", "VirtualAlloc", "Sleep", "SizeofResource", "SetThreadLocale", "SetFilePointer", "SetEvent", "SetErrorMode", "SetEndOfFile", "ResetEvent", "ReadFile", "MulDiv", "LockResource", "LoadResource", "LoadLibraryA", "LeaveCriticalSection", "InitializeCriticalSection", "GlobalUnlock", "GlobalSize", "GlobalReAlloc", "GlobalHandle", "GlobalLock", "GlobalFree", "GlobalFindAtomA", "GlobalDeleteAtom", "GlobalAlloc", "GlobalAddAtomA", "GetVersionExA", "GetVersion", "GetTickCount", "GetThreadLocale", "GetSystemInfo", "GetStringTypeExA", "GetStdHandle", "GetProfileStringA", "GetProfileIntA", "GetProcAddress", "GetPrivateProfileStringA", "GetModuleHandleA", "GetModuleFileNameA", "GetLocaleInfoA", "GetLocalTime", "GetLastError", "GetFullPathNameA", "GetDiskFreeSpaceA", "GetDateFormatA", "GetCurrentThreadId", "GetCurrentProcessId", "GetCPInfo", "GetACP", "FreeResource", "InterlockedExchange", "FreeLibrary", "FormatMessageA", "FindResourceA", "FindFirstFileA", "FindClose", "FileTimeToLocalFileTime", "FileTimeToDosDateTime", "ExitProcess", "EnumCalendarInfoA", "EnterCriticalSection", "DeleteCriticalSection", "CreateThread", "CreateFileA", "CreateEventA", "CopyFileA", "CompareStringA", "CloseHandle", "VerQueryValueA", "GetFileVersionInfoSizeA", "GetFileVersionInfoA", "UnrealizeObject", "TextOutA", "StretchBlt", "StartPage", "StartDocA", "SetWindowOrgEx", "SetWinMetaFileBits", "SetViewportOrgEx", "SetTextColor", "SetStretchBltMode", "SetROP2", "SetPixel", "SetEnhMetaFileBits", "SetDIBColorTable", "SetBrushOrgEx", "SetBkMode", "SetBkColor", "SetAbortProc", "SelectPalette", "SelectObject", "SaveDC", "RestoreDC", "RectVisible", "RealizePalette", "PlayEnhMetaFile", "PatBlt", "MoveToEx", "MaskBlt", "LineTo", "IntersectClipRect", "GetWindowOrgEx", "GetWinMetaFileBits", "GetTextMetricsA", "GetTextExtentPointA", "GetTextExtentPoint32A", "GetSystemPaletteEntries", "GetStockObject", "GetPixel", "GetPaletteEntries", "GetObjectA", "GetEnhMetaFilePaletteEntries", "GetEnhMetaFileHeader", "GetEnhMetaFileBits", "GetDeviceCaps", "GetDIBits", "GetDIBColorTable", "GetDCOrgEx", "GetDCPenColor", "GetCurrentPositionEx", "GetClipBox", "GetBrushOrgEx", "GetBitmapBits", "ExcludeClipRect", "EndPage", "EndDoc", "DeleteObject", "DeleteEnhMetaFile", "DeleteDC", "CreateSolidBrush", "CreatePenIndirect", "CreatePalette", "CreateICA", "CreateHalftonePalette", "CreateFontIndirectA", "CreateDIBitmap", "CreateDIBSection", "CreateDCA", "CreateCompatibleDC", "CreateCompatibleBitmap", "CreateBrushIndirect", "CreateBitmap", "CopyEnhMetaFileA", "BitBlt", "CreateWindowExA", "WindowFromPoint", "WinHelpA", "WaitMessage", "UpdateWindow", "UnregisterClassA", "UnhookWindowsHookEx", "TranslateMessage", "TranslateMDISysAccel", "TrackPopupMenu", "SystemParametersInfoA", "ShowWindow", "ShowScrollBar", "ShowOwnedPopups", "ShowCursor", "SetWindowsHookExA", "SetWindowTextA", "SetWindowPos", "SetWindowPlacement", "SetWindowLongA", "SetTimer", "SetScrollRange", "SetScrollPos", "SetScrollInfo", "SetRect", "SetPropA", "SetParent", "SetMenuItemInfoA", "SetMenu", "SetForegroundWindow", "SetFocus", "SetCursor", "SetClipboardData", "SetClassLongA", "SetCapture", "SetActiveWindow", "SendMessageA", "SendDlgItemMessageA", "ScrollWindow", "ScreenToClient", "RemovePropA", "RemoveMenu", "ReleaseDC", "ReleaseCapture", "RegisterWindowMessageA", "RegisterClipboardFormatA", "RegisterClassA", "RedrawWindow", "PtInRect", "PostQuitMessage", "PostMessageA", "PeekMessageA", "OpenClipboard", "OffsetRect", "OemToCharA", "MessageBoxA", "MessageBeep", "MapWindowPoints", "MapVirtualKeyA", "LoadStringA", "LoadKeyboardLayoutA", "LoadIconA", "LoadCursorA", "LoadBitmapA", "KillTimer", "IsZoomed", "IsWindowVisible", "IsWindowEnabled", "IsWindow", "IsRectEmpty", "IsIconic", "IsDialogMessageA", "IsClipboardFormatAvailable", "IsChild", "InvalidateRect", "IntersectRect", "InsertMenuItemA", "InsertMenuA", "InflateRect", "GetWindowThreadProcessId", "GetWindowTextA", "GetWindowRect", "GetWindowPlacement", "GetWindowLongA", "GetWindowDC", "GetTopWindow", "GetSystemMetrics", "GetSystemMenu", "GetSysColorBrush", "GetSysColor", "GetSubMenu", "GetScrollRange", "GetScrollPos", "GetScrollInfo", "GetPropA", "GetParent", "GetWindow", "GetMenuStringA", "GetMenuState", "GetMenuItemInfoA", "GetMenuItemID", "GetMenuItemCount", "GetMenu", "GetLastActivePopup", "GetKeyboardState", "GetKeyboardLayoutList", "GetKeyboardLayout", "GetKeyState", "GetKeyNameTextA", "GetIconInfo", "GetForegroundWindow", "GetFocus", "GetDlgItem", "GetDesktopWindow", "GetDCEx", "GetDC", "GetCursorPos", "GetCursor", "GetClipboardData", "GetClientRect", "GetClassNameA", "GetClassInfoA", "GetCapture", "GetActiveWindow", "FrameRect", "FindWindowA", "FillRect", "EqualRect", "EnumWindows", "EnumThreadWindows", "EnumClipboardFormats", "EndPaint", "EnableWindow", "EnableScrollBar", "EnableMenuItem", "EmptyClipboard", "DrawTextA", "DrawMenuBar", "DrawIconEx", "DrawIcon", "DrawFrameControl", "DrawFocusRect", "DrawEdge", "DispatchMessageA", "DestroyWindow", "DestroyMenu", "DestroyIcon", "DestroyCursor", "DeleteMenu", "DefWindowProcA", "DefMDIChildProcA", "DefFrameProcA", "CreatePopupMenu", "CreateMenu", "CreateIcon", "CloseClipboard", "ClientToScreen", "CheckMenuItem", "CallWindowProcA", "CallNextHookEx", "BringWindowToTop", "BeginPaint", "CharPrevA", "CharNextA", "CharLowerBuffA", "CharLowerA", "CharToOemA", "AdjustWindowRectEx", "ActivateKeyboardLayout", "Sleep", "SafeArrayPtrOfIndex", "SafeArrayGetUBound", "SafeArrayGetLBound", "SafeArrayCreate", "VariantChangeType", "VariantCopy", "VariantClear", "VariantInit", "ImageList_SetIconSize", "ImageList_GetIconSize", "ImageList_Write", "ImageList_Read", "ImageList_GetDragImage", "ImageList_DragShowNolock", "ImageList_SetDragCursorImage", "ImageList_DragMove", "ImageList_DragLeave", "ImageList_DragEnter", "ImageList_EndDrag", "ImageList_BeginDrag", "ImageList_Remove", "ImageList_DrawEx", "ImageList_Replace", "ImageList_Draw", "ImageList_GetBkColor", "ImageList_SetBkColor", "ImageList_ReplaceIcon", "ImageList_Add", "ImageList_SetImageCount", "ImageList_GetImageCount", "ImageList_Destroy", "ImageList_Create", "InitCommonControls", "OpenPrinterA", "EnumPrintersA", "DocumentPropertiesA", "ClosePrinter", "DragQueryFileA", "DragFinish", "DragAcceptFiles", "PageSetupDlgA", "PrintDlgA", "ChooseFontA", "ReplaceTextA", "FindTextA", "GetSaveFileNameA", "GetOpenFileNameA", "SHGetFolderPathA" ], "ms": { "pe": { "machine": 332.0, "checksum": 2045491.0, "rsrc_size": 1395712.0, "subsystem": 2.0, "timestamp": 708992537.0, "icon_count": 2.0, "image_base": 4194304.0, "rsrc_entropy": 5.1, "entry_section": "CODE", "size_of_image": 1912832.0, "timestamp_day": 19.0, "file_alignment": 512.0, "resource_count": 5.0, "timestamp_year": 1992.0, "characteristics": 33166.0, "entry_point_rva": 446964.0, "size_of_headers": 1024.0, "timestamp_month": 6.0, "checksum_present": true, "export_timestamp": 0.0, "import_dll_count": 11.0, "checksum_mismatch": true, "computed_checksum": 2286755.0, "dos_stub_modified": true, "section_alignment": 4096.0, "number_of_sections": 8.0, "resource_timestamp": 0.0, "timestamp_pre_2000": true, "linker_major_version": 2.0, "linker_minor_version": 25.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 443392.0, "file_size": 2261052.0, "entry_point": 446964.0, "has_overlay": true, "code_entropy": 6.53, "data_entropy": 3.1, "import_count": 426.0, "overlay_size": 372796.0, "string_count": 2906.0, "overlay_ratio": 0.16, "section_count": 8.0, "avg_complexity": 4.28, "function_count": 1553.0, "import_density": 0.98, "max_complexity": 106.0, "string_density": 6.71, "overall_entropy": 3.45, "overlay_entropy": 7.42, "avg_basic_blocks": 6.44, "avg_section_size": 235904.0, "dependency_count": 11.0, "entropy_variance": 2.73, "function_density": 3.59, "avg_function_size": 154.97, "avg_string_length": 473.29, "complexity_per_kb": 0.01, "max_string_length": 1336543.0, "wide_string_count": 29.0, "writable_sections": 4.0, "avg_string_entropy": 3.07, "code_to_data_ratio": 0.31, "entry_point_is_rva": true, "rsrc_to_file_ratio": 0.62, "total_basic_blocks": 10005.0, "embedded_file_count": 1.0, "executable_sections": 1.0, "string_length_stddev": 24789.19, "embedded_binary_count": 1.0, "largest_section_ratio": 0.62, "sentence_string_count": 68.0, "sentence_string_ratio": 0.02, "behavioral_import_ratio": 0.01, "function_analysis_depth": 2.0, "high_complexity_functions": 8.0, "nonstandard_section_name_count": 1.0 } }, "ss": [ [ 80, "This program must be run under Win32\r\n$7" ], [ 504, "CODE" ], [ 624, ".idata" ], [ 664, ".tls" ], [ 704, ".rdata" ], [ 743, "P.reloc" ], [ 783, "P.rsrc" ], [ 1178, "Cardinal" ], [ 1316, "System" ], [ 1329, "IInterface" ], [ 1529, "TInterfacedObject" ], [ 2276, "SVWU" ], [ 11824, "SOFTWARE\\Borland\\Delphi\\RTL" ], [ 11852, "FPUMaskValue" ], [ 12254, "SVW3" ], [ 12732, "SVW1" ], [ 13206, "YYZX" ], [ 13465, "SPRQ" ], [ 14034, "ZTUWVSPRTj" ], [ 14269, "r6t0" ], [ 15316, "SVWUQ" ], [ 16460, "SVWRP" ], [ 18321, "PSVW" ], [ 19864, "SVWQ" ], [ 20416, "kernel32.dll" ], [ 20432, "GetLongPathNameA" ], [ 21032, "Software\\Borland\\Locales" ], [ 21060, "Software\\Borland\\Delphi\\Locales" ], [ 23746, "odSelected" ], [ 23757, "odGrayed" ], [ 23766, "odDisabled\todChecked\todFocused\todDefault" ], [ 23807, "odHotLight" ], [ 23818, "odInactive\todNoAccel" ], [ 23839, "odNoFocusRect" ], [ 23853, "odReserved1" ], [ 23865, "odReserved2" ], [ 23877, "odComboBoxEdit" ], [ 23892, "Windows" ], [ 26683, "QSVW" ], [ 27012, "Magellan MSWHEEL" ], [ 27040, "MSWHEEL_ROLLMSG" ], [ 27056, "MSH_WHEELSUPPORT_MSG" ], [ 27080, "MSH_SCROLL_LINES_MSG" ], [ 28053, "TFileName" ], [ 28158, "Exception\fz@" ], [ 28194, "SysUtils" ], [ 28281, "EHeapException" ], [ 28373, "EOutOfMemory" ], [ 28552, "EExternal" ], [ 28641, "EExternalException" ], [ 28736, "EIntError" ], [ 28913, "ERangeErrorH}@" ], [ 29001, "EIntOverflow" ], [ 29093, "EMathError" ], [ 29181, "EInvalidOp" ], [ 29269, "EZeroDivide" ], [ 29356, "EOverflow" ], [ 29445, "EUnderflow" ], [ 29533, "EInvalidPointer" ], [ 29625, "EInvalidCast" ], [ 29717, "EConvertError" ], [ 29809, "EAccessViolation" ], [ 29905, "EPrivilege" ], [ 29993, "EStackOverflow" ], [ 30084, "EControlC" ], [ 30173, "EVariantError" ], [ 30265, "EAssertionFailed" ], [ 30361, "EAbstractError" ], [ 30453, "EIntfCastError" ], [ 30545, "EOSError" ], [ 30633, "ESafecallException" ], [ 30813, "TThreadLocalCounter" ], [ 31032, "$TMultiReadExclusiveWriteSynchronizer" ], [ 33120, "True" ], [ 33136, "False" ], [ 33584, "PWVS" ], [ 36700, "INFNAN" ], [ 42432, "AMPM" ], [ 45313, "QQQQQQSVW3" ], [ 45961, "QQQQQSVW" ], [ 47541, "TErrorRec" ], [ 47670, "TExceptRec" ], [ 48067, "r3t7" ], [ 52356, "mmmm d, yyyy" ], [ 52820, "GetDiskFreeSpaceExA" ], [ 57268, "oleaut32.dll" ], [ 57284, "VariantChangeTypeEx" ], [ 57352, "VarIdiv" ], [ 57400, "VarI4FromStr" ], [ 57416, "VarR4FromStr" ], [ 57432, "VarR8FromStr" ], [ 57448, "VarDateFromStr" ], [ 57464, "VarCyFromStr" ], [ 57480, "VarBoolFromStr" ], [ 57496, "VarBstrFromCy" ], [ 57512, "VarBstrFromDate" ], [ 57528, "VarBstrFromBool" ], [ 57825, "TCustomVariantType" ], [ 57879, "Variants" ], [ 57969, "EVariantInvalidOpError" ], [ 58069, "EVariantTypeCastError" ], [ 58169, "EVariantOverflowError" ], [ 58269, "EVariantInvalidArgError" ], [ 58369, "EVariantBadVarTypeErrord" ], [ 58469, "EVariantBadIndexError" ], [ 58569, "EVariantArrayLockedError" ], [ 58673, "EVariantArrayCreateError" ], [ 58777, "EVariantNotImplError" ], [ 58877, "EVariantOutOfMemoryError" ], [ 58981, "EVariantUnexpectedError" ], [ 59081, "EVariantDispatchError" ], [ 62089, "QQQQSV" ], [ 66252, "Empty" ], [ 66268, "Null" ], [ 66284, "Smallint" ], [ 66304, "Integer" ], [ 66320, "Single" ], [ 66336, "Double" ], [ 66352, "Currency" ], [ 66372, "Date" ], [ 66404, "Dispatch" ], [ 66424, "Error" ], [ 66440, "Boolean" ], [ 66456, "Variant" ], [ 66472, "Unknown" ], [ 66488, "Decimal" ], [ 66516, "ShortInt" ], [ 66536, "Byte" ], [ 66552, "Word" ], [ 66568, "LongWord" ], [ 66912, "String" ], [ 66940, "Array" ], [ 70930, "TAlignment" ], [ 70954, "taLeftJustify" ], [ 70968, "taRightJustify" ], [ 70983, "taCenter" ], [ 71029, "bdLeftToRight" ], [ 71043, "bdRightToLeft" ], [ 71057, "bdRightToLeftNoAlign" ], [ 71078, "bdRightToLeftReadingOnly" ], [ 71134, "ssShift" ], [ 71162, "ssRight" ], [ 71170, "ssMiddle" ], [ 71179, "ssDouble" ], [ 71226, "THelpContext" ], [ 71253, "THelpType" ], [ 71276, "htKeyword\thtContext" ], [ 71309, "TShortCut" ], [ 71333, "TNotifyEvent" ], [ 71350, "Sender" ], [ 71357, "TObject" ], [ 71449, "EStreamError" ], [ 71541, "EFileStreamError" ], [ 71637, "EFCreateError" ], [ 71729, "EFOpenError" ], [ 71817, "EFilerError" ], [ 71905, "EReadError" ], [ 71993, "EWriteError" ], [ 72081, "EClassNotFound" ], [ 72173, "EResNotFound" ], [ 72265, "EListError" ], [ 72353, "EBitsError" ], [ 72441, "EStringListError" ], [ 72537, "EComponentError" ], [ 72629, "EOutOfResources" ], [ 72721, "EInvalidOperation" ], [ 72917, "TThreadList,)A" ], [ 73115, "TPersistent" ], [ 73156, "Classes" ], [ 73363, "TInterfacedPersistent" ], [ 73390, "TInterfacedPersistentp*A" ], [ 73555, "TCollectionItem" ], [ 73578, "TCollectionItem$+A" ], [ 73777, "TCollection@,A" ], [ 73794, "TCollection" ], [ 73834, "IStringsAdapter," ], [ 74107, "TStrings" ], [ 74158, "TStringItem" ], [ 74417, "TStringList" ], [ 74573, "TStream" ], [ 74685, "THandleStream" ], [ 74805, "TFileStream" ], [ 74921, "TCustomMemoryStream" ], [ 75049, "TMemoryStream" ], [ 75169, "TResourceStream" ], [ 75581, "TStreamAdapter" ], [ 75673, "TClassFinder" ], [ 75923, "TReader" ], [ 76009, "EThread" ], [ 76022, "TComponentName" ], [ 76042, "IDesignerNotify," ], [ 76501, "TComponent" ], [ 76517, "TComponent06A" ], [ 76721, "TBasicActionLink" ], [ 76897, "TBasicAction" ], [ 76958, "TIdentMapEntry" ], [ 77204, "TRegGroup" ], [ 77293, "TRegGroups" ], [ 80540, "TIntConst" ], [ 83673, "PRQB" ], [ 85116, "%s[%d]" ], [ 87144, "Strings" ], [ 94551, "TPropFixup" ], [ 94645, "TPropIntfFixup" ], [ 95200, "Owner" ], [ 101465, "QQQQ3" ], [ 105969, "QQQQQQQS" ], [ 108676, "Left" ], [ 112164, "TPUtilWindow" ], [ 113573, "EInvalidGraphic" ], [ 113665, "EInvalidGraphicOperation" ], [ 113698, "TFontPitch" ], [ 113721, "fpDefault" ], [ 113732, "fpVariable" ], [ 113743, "fpFixed" ], [ 113765, "TFontName" ], [ 113782, "TFontCharset" ], [ 113810, "TFontStyle" ], [ 113841, "fsItalic" ], [ 113850, "fsUnderline" ], [ 113862, "fsStrikeOut" ], [ 113890, "TFontStyles" ], [ 113913, "TPenStyle" ], [ 113937, "psSolid" ], [ 113952, "psDot\tpsDashDot" ], [ 113968, "psDashDotDot" ], [ 113981, "psClear" ], [ 113989, "psInsideFrame" ], [ 114018, "TPenMode" ], [ 114040, "pmBlack" ], [ 114048, "pmWhite" ], [ 114068, "pmCopy\tpmNotCopy" ], [ 114085, "pmMergePenNot" ], [ 114099, "pmMaskPenNot" ], [ 114112, "pmMergeNotPen" ], [ 114126, "pmMaskNotPen" ], [ 114139, "pmMerge" ], [ 114147, "pmNotMerge" ], [ 114158, "pmMask\tpmNotMask" ], [ 114181, "pmNotXor" ], [ 114206, "TBrushStyle" ], [ 114231, "bsSolid" ], [ 114239, "bsClear" ], [ 114247, "bsHorizontal" ], [ 114260, "bsVertical" ], [ 114271, "bsFDiagonal" ], [ 114283, "bsBDiagonal" ], [ 114295, "bsCross" ], [ 114303, "bsDiagCross" ], [ 114421, "TGraphicsObject" ], [ 114468, "Graphics" ], [ 114486, "IChangeNotifier," ], [ 114814, "Name" ], [ 114877, "Size" ], [ 114908, "Style" ], [ 115102, "Mode" ] ], "sz": 2261052, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "Embedded PE binary at file offset 0x1d49a0 (~102400 bytes)", "e": [ "kind=Pe32 estimated_size=102400" ], "i": "binary/embedded/pe", "l": 3 }, { "c": 0.8999999761581421, "d": "Fareit Payload", "e": [ "$string1" ], "i": "third_party/CAPE/Fareit", "l": 5 }, { "c": 0.8999999761581421, "d": "Pony stealer malware", "e": [ "signons.sqlite", "signons.txt", "signons2.txt", "signons3.txt", "WininetCacheCredentials", "moz_logins", "encryptedPassword", "FlashFXP", "FlashFXP", "FlashFXP", "FlashFXP", "FlashFXP", "BulletProof", "BulletProof", "BulletProof", "BulletProof" ], "i": "third_party/BinaryAlert/Windows/Pony/Stealer", "l": 5 }, { "c": 0.8999999761581421, "d": "Detects executables referencing many file transfer clients. Observed in information stealers", "e": [ "FTPWare\\COREFTP\\Sites", "Far\\Plugins\\FTP\\", "Far2\\Plugins\\FTP\\", "Ghisler\\Total Commander", "LinasFTP\\Site Manager", "FTP Explorer\\", "FTP Explorer\\", "FTP Explorer\\", "Far\\SavedDialogHistory\\", "Far2\\SavedDialogHistory\\", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP ", "GlobalSCAPE\\CuteFTP " ], "i": "third_party/Ditekshen/INDICATOR/SUSPICIOUS/EXE/Referenfces/File/Transfer/Clients", "l": 5 }, { "c": 0.8999999761581421, "e": [ "\\Global Downloader", "wiseftpsrvs.bin", "SiteServer %d\\SFTP", "%s\\Keychain", "Connections.txt", "ftpshell.fsi", "inetcomm server passwords" ], "i": "third_party/elastic/Windows_Trojan_Pony/windows/trojan/pony", "l": 5 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext hello beacon token", "e": [ "hello" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-hello-beacon-token", "l": 1, "m": "B0025" }, { "c": 0.800000011920929, "d": "Resolve special folder path via Shell32 ANSI", "e": [ "SHGetFolderPathA" ], "i": "micro-behaviors/fs/shell-ops/commands::shell-get-folder-path-a", "l": 2 }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "c": 0.699999988079071, "d": "Send message to window (ANSI)", "e": [ "SendMessageA" ], "i": "micro-behaviors/ui/window/manage::send-message-a", "l": 2 }, { "c": 0.8999999761581421, "d": "sqlite3 string", "e": [ "sqlite3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite3-string", "l": 2 }, { "c": 0.8999999761581421, "d": "Get standard I/O handle", "e": [ "GetStdHandle", "GetStdHandle" ], "i": "micro-behaviors/fs/file/operations::get-std-handle", "l": 2 }, { "c": 0.75, "d": "Find window by class/title (ANSI)", "e": [ "FindWindowA" ], "i": "micro-behaviors/ui/window/manage::find-window-a-import", "l": 2 }, { "a": "T1027.003", "c": 0.9900000095367432, "d": "PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/container::pe-checksum-mismatch-png", "l": 1, "m": "F0001.006" }, { "c": 0.8999999761581421, "d": "Tool identity claims FileZilla", "e": [ "filezilla", "FileZilla", "FileZilla" ], "i": "metadata/package/tooling::tool-identity-filezilla", "l": 1 }, { "c": 0.699999988079071, "d": "Query system metrics", "e": [ "GetSystemMetrics" ], "i": "micro-behaviors/ui/controls/widget::get-system-metrics", "l": 2 }, { "c": 0.8999999761581421, "d": "Thread-local storage retrieval", "e": [ "TlsGetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-get-value", "l": 2 }, { "c": 0.75, "d": "Get window device context", "e": [ "GetWindowDC" ], "i": "micro-behaviors/ui/window/manage::get-window-dc", "l": 2 }, { "c": 0.8500000238418579, "d": "Peek message (ANSI)", "e": [ "PeekMessageA" ], "i": "micro-behaviors/os/message/queue::peek-message-a", "l": 2 }, { "c": 0.8399999737739563, "d": "Invoke unhandled exception filter", "e": [ "UnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::unhandled-exception-filter-import", "l": 2 }, { "c": 0.6499999761581421, "d": "Get dialog control handle", "e": [ "GetDlgItem" ], "i": "micro-behaviors/ui/dialog/prompt::get-dialog-item", "l": 2 }, { "c": 0.800000011920929, "d": "Borland CODE section name", "e": [ "CODE (perms: r-x)" ], "i": "metadata/lang/compiler/managed::borland-section-code", "l": 1 }, { "c": 0.6399999856948853, "d": "System Action delegate token", "e": [ "Action" ], "i": "objectives/anti-static/obfuscation/reflection/invoke::action-delegate-token", "l": 1 }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.0\r\nHost: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "c": 0.699999988079071, "d": "Show or hide window", "e": [ "ShowWindow" ], "i": "micro-behaviors/ui/window/manage::show-window", "l": 2 }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla recentservers.xml config", "e": [ "\\recentservers.xml" ], "i": "objectives/credential-access/ftp/filezilla::recentservers-xml", "l": 1 }, { "c": 0.6600000262260437, "d": "Copy files (Windows API ANSI)", "e": [ "CopyFileA" ], "i": "micro-behaviors/fs/file/copy::copyfile-a", "l": 3 }, { "c": 0.800000011920929, "d": "Set event object state", "e": [ "SetEvent" ], "i": "micro-behaviors/process/sync/event::set-event", "l": 2, "m": "C0039" }, { "a": "T1113", "c": 0.800000011920929, "d": "Desktop window handle access", "e": [ "GetDesktopWindow" ], "i": "micro-behaviors/hardware/display/screen::get-desktop-window", "l": 2, "m": "C0014" }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082" }, { "c": 0.9900000095367432, "d": "ANSI window style update API", "e": [ "SetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::set-window-long-ansi", "l": 1 }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:", "User-Agent:", "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox PK11SDR_Decrypt function", "e": [ "PK11SDR_Decrypt" ], "i": "objectives/credential-access/browser/firefox::pk11-decrypt", "l": 4, "m": "B0028" }, { "c": 0.800000011920929, "d": "Read active window title text", "e": [ "GetWindowTextA" ], "i": "micro-behaviors/ui/window/manage::get-window-text", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy image list", "e": [ "ImageList_Destroy" ], "i": "micro-behaviors/ui/controls/widget::image-list-destroy", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.800000011920929, "d": "Reset event object state", "e": [ "ResetEvent" ], "i": "micro-behaviors/process/sync/event::reset-event", "l": 2, "m": "C0039" }, { "c": 0.8999999761581421, "d": "GUI import cluster GetActiveWindow", "e": [ "GetActiveWindow" ], "i": "metadata/binary/symbols::gui-import-cluster-getactivewindow", "l": 1 }, { "c": 0.8500000238418579, "d": "Runtime library unwind operation", "e": [ "RtlUnwind" ], "i": "micro-behaviors/os/exception/error-handling::rtl-unwind", "l": 2 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Suspicious PHP endpoint URL (gate/upload/etc)", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::suspicious-php-filename", "l": 4, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile", "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Wait for process/object", "e": [ "WaitForSingleObject" ], "i": "micro-behaviors/process/create/spawn::wait-for-single-object", "l": 2 }, { "c": 0.800000011920929, "d": "SaveToFile string fragment (veTo)", "e": [ "MoveToEx" ], "i": "objectives/execution/interpreter/script/wsh-fragments::save-to-file-fragment-veto", "l": 1 }, { "c": 0.8999999761581421, "d": "Thread-local storage assignment", "e": [ "TlsSetValue" ], "i": "micro-behaviors/process/tls/fiber::tls-set-value", "l": 2 }, { "c": 0.8999999761581421, "d": "Get local time", "e": [ "GetLocalTime" ], "i": "micro-behaviors/time/query::get-local-time", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.8999999761581421, "d": "Get file handle type", "e": [ "GetFileType" ], "i": "micro-behaviors/fs/file/operations::get-file-type", "l": 2 }, { "c": 0.8500000238418579, "d": "Post message to window", "e": [ "PostMessageA" ], "i": "micro-behaviors/os/message/queue::post-message", "l": 2 }, { "c": 0.8999999761581421, "d": "Set file position", "e": [ "SetFilePointer", "SetFilePointer" ], "i": "micro-behaviors/fs/file/operations::set-file-pointer", "l": 2 }, { "c": 0.8500000238418579, "d": "Get window thread and process ID", "e": [ "GetWindowThreadProcessId" ], "i": "micro-behaviors/ui/window/manage::get-window-thread-process-id", "l": 2 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "c": 0.800000011920929, "d": "Suppress error dialogs", "e": [ "SetErrorMode" ], "i": "micro-behaviors/os/exception/error-handling::set-error-mode", "l": 2 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA", "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.699999988079071, "d": "Create image list", "e": [ "ImageList_Create" ], "i": "micro-behaviors/ui/controls/widget::image-list-create", "l": 2 }, { "c": 0.949999988079071, "d": "Overlay size at least 64 KiB", "e": [ "binary.overlay_size = 372796.00" ], "i": "metadata/binary/layout::large-overlay-64k", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section (\u003e150KB)", "e": [ ".rsrc (size: 1395712)" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-pe-resource-section", "l": 1 }, { "c": 0.699999988079071, "d": "Select GDI object", "e": [ "SelectObject" ], "i": "micro-behaviors/ui/graphics/draw::select-object", "l": 2 }, { "c": 0.699999988079071, "d": "Bring window to foreground", "e": [ "SetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::set-foreground-window", "l": 2 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA", "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "Register window class", "e": [ "RegisterClassA" ], "i": "micro-behaviors/ui/window/manage::register-class", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is enabled", "e": [ "IsWindowEnabled" ], "i": "micro-behaviors/ui/window/manage::is-window-enabled", "l": 2 }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 1553.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Copy COM automation variant", "e": [ "VariantCopy" ], "i": "micro-behaviors/os/com/invoke::variant-copy", "l": 2 }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla main config file", "e": [ "\\filezilla.xml" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-xml", "l": 1 }, { "a": "T1071.001", "c": 0.6600000262260437, "d": "Accept-Encoding header", "e": [ "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConte…", "Accept-Encoding: identity, *;q=0", "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConne…" ], "i": "micro-behaviors/communications/http/headers::headers-encoding", "l": 2, "m": "C0002" }, { "c": 0.699999988079071, "d": "Create window timer", "e": [ "SetTimer" ], "i": "micro-behaviors/ui/window/manage::set-timer", "l": 2 }, { "c": 0.8199999928474426, "d": "Query current process command line", "e": [ "GetCommandLineA" ], "i": "micro-behaviors/process/info/commandline::get-command-line", "l": 2 }, { "c": 0.9900000095367432, "d": "ANSI window style query API", "e": [ "GetWindowLongA" ], "i": "well-known/malware/trojan/shellobject/hijack::get-window-long-ansi", "l": 1 }, { "c": 0.8999999761581421, "d": "version.dll sideloading target", "e": [ "version.dll" ], "i": "objectives/command-and-control/dropper/sideload::sideload-target-version", "l": 1 }, { "c": 0.699999988079071, "d": "Convert screen to client coordinates", "e": [ "ScreenToClient" ], "i": "micro-behaviors/ui/window/manage::screen-to-client", "l": 2 }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 1553.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Set background color", "e": [ "SetBkColor" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-color", "l": 2 }, { "a": "T1548.002", "c": 0.699999988079071, "d": "Shell Open command registry key", "e": [ "\\shell\\open\\command" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/hijack::shell-open-command-reg", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep", "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Post quit message", "e": [ "PostQuitMessage" ], "i": "micro-behaviors/ui/window/manage::post-quit-message", "l": 2 }, { "c": 0.699999988079071, "d": "Enable/disable menu item", "e": [ "EnableMenuItem" ], "i": "micro-behaviors/ui/menu/popup::enable-menu-item", "l": 2 }, { "c": 0.699999988079071, "d": "Read startup info via GetStartupInfoA", "e": [ "GetStartupInfoA" ], "i": "micro-behaviors/os/sysinfo/process::get-startup-info-a", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Access PE resource data pointer", "e": [ "LockResource" ], "i": "micro-behaviors/data/embedded/payload::lock-resource", "l": 2 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "HTTP Connection close header", "e": [ "Connection: close" ], "i": "objectives/command-and-control/channel/http-beacon::http-connection-close-header", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "PE TLS section", "e": [ ".tls" ], "i": "metadata/binary/section/names::pe-tls-section", "l": 1 }, { "c": 0.699999988079071, "d": "Delete GDI object", "e": [ "DeleteObject" ], "i": "micro-behaviors/ui/graphics/draw::delete-object", "l": 2 }, { "c": 0.699999988079071, "d": "Get device context", "e": [ "GetDC" ], "i": "micro-behaviors/ui/window/manage::get-dc", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI BitBlt screen blit API", "e": [ "BitBlt" ], "i": "micro-behaviors/hardware/display/screen::gdi-bitblt", "l": 2, "m": "C0014" }, { "a": "T1552.004", "c": 0.75, "d": "Remote Desktop Protocol extension", "e": [ ".rdp" ], "i": "objectives/collection/file-targeting/filter::rdp-extension", "l": 3, "m": "B0024" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "Get current thread ID", "e": [ "GetCurrentThreadId", "GetCurrentThreadId" ], "i": "micro-behaviors/process/info/thread::get-current-thread-id", "l": 2 }, { "c": 0.699999988079071, "d": "Change window position/size", "e": [ "SetWindowPos" ], "i": "micro-behaviors/ui/window/manage::set-window-pos", "l": 2 }, { "c": 0.8999999761581421, "d": "PE file larger than 2 MiB", "e": [ "binary.file_size = 2261052.00" ], "i": "metadata/binary/layout::file-over-2mb", "l": 1 }, { "c": 0.8999999761581421, "d": "Valid PE/MZ binary found embedded in file", "e": [ "4D 5A 90 00" ], "i": "metadata/binary/layout::pe-embedded", "l": 2 }, { "c": 0.8999999761581421, "d": "High-risk token privilege name", "e": [ "SeImpersonatePrivilege", "SeTcbPrivilege", "SeAssignPrimaryTokenPrivilege" ], "i": "objectives/privilege-escalation/token-manipulation::dangerous-privilege-name", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 2261052.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata", ".reloc" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "Initialize common controls library", "e": [ "InitCommonControls" ], "i": "micro-behaviors/ui/controls/widget::init-common-controls", "l": 2 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-endpoint-url", "l": 1 }, { "c": 0.800000011920929, "d": "Enumerate top-level windows", "e": [ "EnumWindows" ], "i": "micro-behaviors/ui/window/manage::enum-windows", "l": 2 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Giant embedded string blob metric", "e": [ "binary.max_string_length = 1336543.00" ], "i": "objectives/impact/wipe/disk::giant-string-blob-metric", "l": 1 }, { "a": "T1056.001", "c": 0.800000011920929, "d": "MapVirtualKey P/Invoke string reference", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key-str", "l": 3, "m": "E1056.001" }, { "a": "T1083", "c": 0.6600000262260437, "d": "C:\\\\Windows\\\\ directory path", "e": [ "C:\\Windows\\Microsoft" ], "i": "micro-behaviors/fs/path/system::windows-root", "l": 2, "m": "E1083" }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Java DPAPI unprotect call", "e": [ "UnprotectData" ], "i": "objectives/credential-access/discord/token::java-crypt-unprotect-data", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "Firefox", "Firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Create popup/context menu", "e": [ "CreatePopupMenu" ], "i": "micro-behaviors/ui/menu/popup::create-popup-menu", "l": 2 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.07" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile", "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "QQQQQSVW", "QQQQQQQS", "MDICLIENT", "MAINICON", "MAINICON", "CONSTRAINT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "c": 0.699999988079071, "d": "Invalidate window region", "e": [ "InvalidateRect" ], "i": "micro-behaviors/ui/window/manage::invalidate-rect", "l": 2 }, { "c": 0.8399999737739563, "d": "High PE import count", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/section/metrics::high-import-count-pe", "l": 1 }, { "c": 0.699999988079071, "d": "Set text color", "e": [ "SetTextColor" ], "i": "micro-behaviors/ui/graphics/draw::set-text-color", "l": 2 }, { "a": "T1485", "c": 0.699999988079071, "d": "Windows Shell Folders registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], "i": "objectives/impact/destroy/file-deletion::shell-folders-personal-targeting", "l": 2, "m": "C0047" }, { "c": 0.8999999761581421, "d": "Tool identity claims PuTTY", "e": [ "PuTTY" ], "i": "metadata/package/tooling::tool-identity-putty", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "PE resource section", "e": [ ".rsrc" ], "i": "metadata/binary/section/names::pe-resource-section", "l": 1 }, { "c": 0.7799999713897705, "d": "Read legacy profile string", "e": [ "GetProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-profile-string-ansi", "l": 2 }, { "a": "T1027", "c": 0.8799999952316284, "d": "Large PE imports over 120", "e": [ "binary.import_count = 426.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::import-count-over-120", "l": 1, "m": "B0032" }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Get window rectangle", "e": [ "GetWindowRect" ], "i": "micro-behaviors/ui/window/manage::get-window-rect", "l": 2 }, { "c": 1.0, "d": "Binary has 1000 or more strings", "e": [ "binary.string_count = 2906.00" ], "i": "metadata/binary/metrics::string-count-1000-plus", "l": 2 }, { "c": 0.699999988079071, "d": "Get window system menu", "e": [ "GetSystemMenu" ], "i": "micro-behaviors/ui/menu/popup::get-system-menu", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1555.003", "c": 0.8999999761581421, "d": "Firefox logins database", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "micro-behaviors/fs/path/sensitive/browser::firefox-logins", "l": 3 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 2906.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 1.0, "d": "Overrides WndProc method", "e": [ "WndProcPtr%.8X%.8X" ], "i": "objectives/collection/clipboard/monitor::wndproc-override", "l": 1 }, { "c": 0.75, "d": "Clear clipboard contents", "e": [ "EmptyClipboard" ], "i": "micro-behaviors/os/clipboard/access::empty-clipboard", "l": 2 }, { "c": 0.6499999761581421, "d": "Close clipboard", "e": [ "CloseClipboard" ], "i": "micro-behaviors/os/clipboard/access::close-clipboard", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA", "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1 }, { "c": 0.8500000238418579, "d": "PuTTY identity string", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/supply-chain/trojanized/application/monitor::putty-identity-string", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type: application/octet-stream", "…%lu\r\nConnection: close\r\nContent-Type: application/octet-strea…" ], "i": "micro-behaviors/communications/http/request::content-type-header", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.800000011920929, "d": "Large PE resource section", "e": [ "pe.rsrc_size = 1395712.00" ], "i": "metadata/binary/framework::large-rsrc-section", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 708992537.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "c": 0.699999988079071, "d": "Display message box (ANSI)", "e": [ "MessageBoxA", "MessageBoxA" ], "i": "micro-behaviors/ui/dialog/prompt::message-box-a", "l": 2 }, { "c": 0.699999988079071, "d": "Display popup menu", "e": [ "TrackPopupMenu" ], "i": "micro-behaviors/ui/menu/popup::track-popup-menu", "l": 2 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI DIB section creation for BMP capture", "e": [ "CreateDIBSection" ], "i": "micro-behaviors/hardware/display/screen::create-dib-section", "l": 2, "m": "C0014" }, { "c": 0.699999988079071, "d": "Create brush object", "e": [ "CreateBrushIndirect" ], "i": "micro-behaviors/ui/graphics/draw::create-brush-indirect", "l": 2 }, { "d": "password keyword", "e": [ "LastPassword", "\"password\" : \"", "_Password", "_FtpPassword", "password_value", "password 51:b:", "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins", "Password", "FtpPassword", "PassWord", "PasswordType", "password", "MS IE FTP Passwords", "\u003cPOP3_Password2", "password1", "FTP destination password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "a": "T1071.001", "c": 0.7799999713897705, "d": "HTTP POST request line", "e": [ "POST %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/post::post-request-line", "l": 3, "m": "C0002" }, { "c": 0.7799999713897705, "d": "Register custom clipboard format", "e": [ "RegisterClipboardFormatA" ], "i": "micro-behaviors/os/clipboard/access::register-clipboard-format-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.28" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "a": "T1587.001", "c": 0.8999999761581421, "d": "Allocate virtual memory", "e": [ "VirtualAlloc", "VirtualAlloc" ], "i": "micro-behaviors/mem/protect/modify::virtual-alloc", "l": 2 }, { "c": 0.8999999761581421, "d": "SQLite format header", "e": [ "SQLite format 3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite-format", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query disk free space", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/hardware::get-disk-space", "l": 3 }, { "c": 0.8999999761581421, "d": "Delete critical section", "e": [ "DeleteCriticalSection", "DeleteCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-delete", "l": 2 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Large-section binary with many imports", "e": [ "binary.import_count = 426.00" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-import-rich", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "…ntent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible…", "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)", "…q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible…" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Convert OLE automation variant", "e": [ "VariantChangeType" ], "i": "micro-behaviors/os/com/object::variant-change-type", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer.exe", "explorerbar" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "a": "T1129", "c": 0.949999988079071, "d": "Create thread in current process", "e": [ "CreateThread" ], "i": "micro-behaviors/process/thread/create::create-thread", "l": 2 }, { "c": 0.8999999761581421, "d": "Get current process ID", "e": [ "GetCurrentProcessId" ], "i": "micro-behaviors/process/info/thread::get-current-process-id", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0", "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError", "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 1553.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 1.0, "d": "Binary file larger than 1MB", "e": [ "507081" ], "i": "metadata/binary/metrics::large-binary-1mb", "l": 2 }, { "c": 0.8999999761581421, "d": "Initialize critical section", "e": [ "InitializeCriticalSection", "InitializeCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-init", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window is visible", "e": [ "IsWindowVisible" ], "i": "micro-behaviors/ui/window/manage::is-window-visible", "l": 2 }, { "a": "T1082", "d": "Disk free space query", "e": [ "GetDiskFreeSpaceExA", "GetDiskFreeSpaceA" ], "i": "micro-behaviors/os/sysinfo/disk::freespace", "l": 2 }, { "a": "T1113", "c": 0.699999988079071, "d": "System.Drawing.Bitmap class reference", "e": [ "Bitmap" ], "i": "micro-behaviors/hardware/display/screen::bitmap-fromscratch-str", "l": 1, "m": "C0014" }, { "c": 0.699999988079071, "d": "Query device capabilities", "e": [ "GetDeviceCaps" ], "i": "micro-behaviors/ui/graphics/draw::get-device-caps", "l": 2 }, { "c": 1.0, "d": "Binary is 500KB+", "e": [ "binary.file_size = 2261052.00" ], "i": "metadata/binary/metrics::large-binary-500k", "l": 1 }, { "c": 0.8500000238418579, "d": "Raise structured exception", "e": [ "RaiseException" ], "i": "micro-behaviors/os/exception/raise::raise-exception", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 0.21)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "c": 0.8999999761581421, "d": "Truncate file via SetEndOfFile", "e": [ "SetEndOfFile", "SetEndOfFile" ], "i": "micro-behaviors/fs/file/truncate::set-end-of-file-win", "l": 2 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "POST %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…", "GET %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "a": "T1027.003", "c": 0.7799999713897705, "d": ".NET resource manager reference", "e": [ "TResourceManager" ], "i": "micro-behaviors/data/embedded/payload::dotnet-resource-manager-token", "l": 1, "m": "F0001.006" }, { "a": "T1055", "c": 0.699999988079071, "d": "Query virtual memory info (VirtualQuery)", "e": [ "VirtualQuery", "VirtualQuery" ], "i": "micro-behaviors/mem/query/info::virtualquery", "l": 2 }, { "a": "T1036.005", "c": 0.75, "d": "C2 gate.php endpoint", "e": [ "gate.php" ], "i": "objectives/command-and-control/beacon/network::c2-gate-php-endpoint", "l": 1, "m": "B0030" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Load PE resource payload", "e": [ "LoadResource" ], "i": "micro-behaviors/data/embedded/payload::load-resource", "l": 2 }, { "c": 0.8999999761581421, "d": "PE .reloc section presence", "e": [ ".reloc" ], "i": "metadata/binary/section/names::reloc-section-presence", "l": 2 }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc", "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "c": 0.699999988079071, "d": "Check if window exists", "e": [ "IsWindow" ], "i": "micro-behaviors/ui/window/manage::is-window", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "a": "T1555.003", "c": 0.699999988079071, "d": "Chromium Login Data database reference", "e": [ "Login Data" ], "i": "objectives/credential-access/browser/chromium::logins-table", "l": 3 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess", "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "a": "T1614", "c": 0.800000011920929, "d": "CIS country code cluster (ISO 3166-1 alpha-2)", "e": [ "Ru+0e8/llt/Fd/2miB1/Ru/md" ], "i": "objectives/anti-analysis/geofencing/location::cis-country-codes", "l": 1, "m": "B0007.003" }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "Connect", "Connect", "Connect", "Connect", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "c": 0.800000011920929, "d": "Query current foreground window", "e": [ "GetForegroundWindow" ], "i": "micro-behaviors/ui/window/manage::get-foreground-window", "l": 2 }, { "a": "T1105", "c": 0.800000011920929, "d": "Numbered DAT payload filename", "e": [ "ESTdb2.dat" ], "i": "objectives/command-and-control/dropper/staging::numbered-dat-payload-name", "l": 1, "m": "B0024" }, { "c": 0.699999988079071, "d": "Destroy window", "e": [ "DestroyWindow" ], "i": "micro-behaviors/ui/window/manage::destroy-window", "l": 2 }, { "a": "T1036.005", "c": 0.800000011920929, "d": "explorer.exe process name", "e": [ "explorer.exe" ], "i": "objectives/evasion/masquerade/process::explorer-name", "l": 1, "m": "F0004" }, { "a": "T1105", "c": 0.9399999976158142, "d": "Embedded stage screen capture APIs", "e": [ "CreateDIBSection" ], "i": "objectives/command-and-control/dropper/staging/signed-bundle::embedded-stage-screen-capture", "l": 1, "m": "B0024" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll virtual key state", "e": [ "GetKeyState" ], "i": "micro-behaviors/hardware/input/keyboard::get-key-state", "l": 2, "m": "E1056.001" }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "c": 0.699999988079071, "d": "Unload dynamic library", "e": [ "FreeLibrary", "FreeLibrary" ], "i": "micro-behaviors/os/module/load::free-library", "l": 2 }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "c": 1.0, "d": "Binary has 2000+ strings", "e": [ "binary.string_count = 2906.00" ], "i": "metadata/binary/metrics::many-strings-2000", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible device context", "e": [ "CreateCompatibleDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-dc", "l": 2, "m": "C0014" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "c": 0.7200000286102295, "d": "Write INI string value", "e": [ "WritePrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::write-private-profile-ansi", "l": 2 }, { "c": 0.8999999761581421, "d": "Leave critical section", "e": [ "LeaveCriticalSection", "LeaveCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-leave", "l": 2 }, { "c": 0.75, "d": "Read data from clipboard", "e": [ "GetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::get-clipboard-data", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 3.45" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.9599999785423279, "d": "Elex Internet Explorer product resource", "e": [ "Internet Explorer" ], "i": "well-known/malware/trojan/elex/worm::elex-internet-explorer-product-resource", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.30000001192092896, "d": "xz compression reference", "e": [ "xz", "xz", "xz", "xz" ], "i": "micro-behaviors/dylib/library::xz-ref", "l": 2 }, { "c": 0.8500000238418579, "d": "Create named event object", "e": [ "CreateEventA" ], "i": "micro-behaviors/process/sync/event::create-event", "l": 2, "m": "C0039" }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Opera.HTML\\shell\\open\\command", "FTP++.Link\\shell\\open\\command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "a": "T1113", "c": 0.8999999761581421, "d": "GDI GetDIBits pixel readback", "e": [ "GetDIBits" ], "i": "micro-behaviors/hardware/display/screen::gdi-getdibits", "l": 2, "m": "C0014" }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla sitemanager.xml config", "e": [ "\\sitemanager.xml" ], "i": "objectives/credential-access/ftp/filezilla::sitemanager-xml", "l": 1 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 10005.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1041", "c": 0.6000000238418579, "d": "PHP gate endpoint", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-gate", "l": 4, "m": "C0002" }, { "c": 0.8799999952316284, "d": "Native runtime binary is large", "e": [ "binary.file_size = 2261052.00" ], "i": "metadata/lang/compiler/aot::native-runtime-large-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Free virtual memory", "e": [ "VirtualFree" ], "i": "micro-behaviors/mem/protect/modify::virtual-free", "l": 2 }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "c": 0.699999988079071, "d": "Set cursor", "e": [ "SetCursor" ], "i": "micro-behaviors/ui/controls/widget::set-cursor", "l": 2 }, { "a": "T1555", "c": 0.8500000238418579, "d": "FileZilla application directory", "e": [ "Software\\FileZilla Client", "Software\\FileZilla" ], "i": "objectives/credential-access/ftp/filezilla::application-path", "l": 1 }, { "c": 1.0, "d": "Binary has 100+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-100", "l": 1 }, { "a": "T1113", "c": 0.8500000238418579, "d": "GDI compatible bitmap allocation", "e": [ "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-create-compatible-bitmap", "l": 2, "m": "C0014" }, { "c": 0.75, "d": "Open clipboard access", "e": [ "OpenClipboard" ], "i": "micro-behaviors/os/clipboard/access::open-clipboard", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA", "GetModuleHandleA", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.699999988079071, "d": "Destroy window timer", "e": [ "KillTimer" ], "i": "micro-behaviors/ui/window/manage::kill-timer", "l": 2 }, { "c": 0.699999988079071, "d": "Release device context", "e": [ "ReleaseDC" ], "i": "micro-behaviors/ui/window/manage::release-dc", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Map virtual key code", "e": [ "MapVirtualKeyA" ], "i": "micro-behaviors/hardware/input/keyboard::map-virtual-key", "l": 2, "m": "E1056.001" }, { "c": 0.8999999761581421, "d": "Enter critical section", "e": [ "EnterCriticalSection", "EnterCriticalSection" ], "i": "micro-behaviors/process/sync/critical-section::critical-section-enter", "l": 2 }, { "c": 0.800000011920929, "d": "Write data to clipboard", "e": [ "SetClipboardData" ], "i": "micro-behaviors/os/clipboard/access::set-clipboard-data", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.699999988079071, "d": "Enable/disable window", "e": [ "EnableWindow" ], "i": "micro-behaviors/ui/window/manage::enable-window", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (string)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-string", "l": 1 }, { "c": 0.800000011920929, "d": "Multiple embedded MZ headers", "e": [ "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A", "4D 5A" ], "i": "metadata/binary/layout::multiple-pe-embedded-loose", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey", "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "c": 0.8999999761581421, "d": "GUI import cluster BeginPaint", "e": [ "BeginPaint" ], "i": "metadata/binary/symbols::gui-import-cluster-beginpaint", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Size PE resource payload", "e": [ "SizeofResource" ], "i": "micro-behaviors/data/embedded/payload::sizeof-resource", "l": 2 }, { "c": 0.30000001192092896, "d": "zlib compression reference", "e": [ "zliB" ], "i": "micro-behaviors/dylib/library::zlib-ref", "l": 2 }, { "d": "Windows directory path reference", "e": [ "C:\\Windows" ], "i": "micro-behaviors/fs/path/system::windows-dir", "l": 2 }, { "a": "T1071.001", "d": "Old Mozilla 4.0 User-Agent", "e": [ "…ion: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …", "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)", "…ng: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …" ], "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 1.0, "d": "Query/set system parameters (symbol)", "e": [ "SystemParametersInfoA" ], "i": "micro-behaviors/ui/controls/widget::system-parameters-info-symbol", "l": 1 }, { "c": 0.800000011920929, "d": "Low ratio of sentence-like strings", "e": [ "binary.sentence_string_ratio = 0.02" ], "i": "metadata/binary/metrics/pe-details::low-sentence-string-ratio", "l": 2 }, { "c": 0.8999999761581421, "d": "MAPI message send call", "e": [ "MAPISendMail" ], "i": "objectives/collection/email-harvest::mapi-send-mail", "l": 3 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 426.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Clipboard string", "e": [ "CloseClipboard", "EnumClipboardFormats", "TClipboardFormats", "OpenClipboard", "RegisterClipboardFormatA", "GetClipboardData", "IsClipboardFormatAvailable", "SetClipboardData", "EmptyClipboard", "TClipboard" ], "i": "objectives/collection/clipboard/capture::str-clipboard", "l": 1 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "secret" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Locate PE resource entry (ANSI)", "e": [ "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::find-resource-a", "l": 2 }, { "c": 0.699999988079071, "d": "Set background mode (opaque/transparent)", "e": [ "SetBkMode" ], "i": "micro-behaviors/ui/graphics/draw::set-bk-mode", "l": 2 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.949999988079071, "d": "PE checksum mismatch (modified binary)", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::pe-checksum-mismatch", "l": 3 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "GetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-getpixel", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1546.015", "c": 0.8199999928474426, "d": "InprocServer32 registry write", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32" ], "i": "objectives/persistence/system/registry/com-hijack::inprocserver32-write", "l": 3 }, { "a": "T1027", "c": 0.699999988079071, "d": "Overlay large enough to contain payload", "e": [ "binary.overlay_size = 372796.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-overlay-size", "l": 1, "m": "B0032" }, { "a": "T1071", "c": 0.75, "d": "PHP URL endpoint (often used for C2)", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-url", "l": 3, "m": "C0002" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Remove Windows input hook", "e": [ "UnhookWindowsHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::unhook-windows-hook", "l": 2, "m": "E1056.001" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "a": "T1027", "c": 1.0, "d": "Binary is 1MB or larger", "e": [ "binary.file_size = 2261052.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::file-size-1m-plus", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 5.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "c": 0.8500000238418579, "d": "Create window (extended)", "e": [ "CreateWindowExA" ], "i": "micro-behaviors/ui/window/manage::create-window-ex", "l": 2 }, { "c": 0.8999999761581421, "d": "Binary has many functions", "e": [ "binary.function_count = 1553.00" ], "i": "objectives/anti-static/pack/entropy::large-function-surface", "l": 1 }, { "c": 0.800000011920929, "d": "Pixel operation symbols family A", "e": [ "SetPixel" ], "i": "micro-behaviors/data/encode/image::pixel-access-setpixel", "l": 2 }, { "a": "T1552.004", "c": 0.800000011920929, "d": "PuTTY sessions registry reference", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/credential-access/ssh/key::putty-sessions", "l": 4 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "GetKeyboardState P/Invoke string reference", "e": [ "GetKeyboardState" ], "i": "micro-behaviors/hardware/input/keyboard::get-keyboard-state-str", "l": 2, "m": "E1056.001" }, { "a": "T1027", "c": 0.7200000286102295, "d": "Overlay large enough for stage data", "e": [ "binary.overlay_size = 372796.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::medium-overlay-size", "l": 1, "m": "B0032" }, { "c": 0.699999988079071, "d": "High string count over 1000", "e": [ "binary.string_count = 2906.00" ], "i": "metadata/binary/metrics::high-string-count-1000", "l": 2 }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1620", "c": 0.8999999761581421, "d": "VirtualAlloc loader API string", "e": [ "VirtualAlloc" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-virtualalloc-string", "l": 1, "m": "B0030" }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 1553.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Poll mouse cursor position", "e": [ "GetCursorPos" ], "i": "micro-behaviors/hardware/input/keyboard::get-cursor-pos", "l": 2, "m": "E1056.001" }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "InitCommonControlsEx", "DrawThemeBackground", "GetThemeBackgroundContentRect", "HitTestThemeBackground", "GetThemeSysColorBrush", "EnableThemeDialogTexture", "GetThemeAppProperties", "SetThemeAppProperties", "GetCurrentThemeName", "DrawThemeParentBackground", "SecondaryShortCuts", "TransparentColorValuehDC", "SetLayeredWindowAttributes", "InitializeCriticalSection", "InterlockedDecrement", "InterlockedIncrement" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1027", "c": 1.0, "d": "Binary has 1000 or more functions", "e": [ "binary.function_count = 1553.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::function-count-1000-plus", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "Signed PE checksum mismatch", "e": [ "pe.checksum_mismatch = 1.00" ], "i": "metadata/binary/layout::signed-pe-checksum-mismatch", "l": 1 }, { "a": "T1070.006", "c": 0.7799999713897705, "d": "PE header timestamp predates 2000", "e": [ "pe.timestamp_pre_2000 = 1.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2000", "l": 1 }, { "a": "T1574.002", "c": 0.949999988079071, "d": "Extended dynamic library loading (ANSI)", "e": [ "LoadLibraryExA" ], "i": "micro-behaviors/dylib/load::load-library-ex-a", "l": 2 }, { "a": "T1082", "c": 0.699999988079071, "d": "hwid string", "e": [ "HWID" ], "i": "objectives/discovery/system/fingerprint/machine-id::hwid-string", "l": 1 }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "My Pictures" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1 }, { "a": "T1056.001", "c": 0.8999999761581421, "d": "Install global Windows input hook", "e": [ "SetWindowsHookExA" ], "i": "micro-behaviors/hardware/input/keyboard::set-windows-hook", "l": 2, "m": "E1056.001" }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1056.001", "c": 0.800000011920929, "d": "Forward events in Windows hook chain", "e": [ "CallNextHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::call-next-hook-ex", "l": 2, "m": "E1056.001" }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "c": 0.8799999952316284, "d": "CLSID registry path manipulation", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}" ], "i": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "l": 3 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}", "{9EA55529-E122-4757-BC79-E4825F80732C}", "{11C1D741-A95B-11d2-8A80-0080ADB32FF4}", "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}", "{74FF1730-B1F2-4D88-926B-1568FAE61DB7}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "c": 0.8399999737739563, "d": "Resource-heavy PE with large .rsrc", "e": [ ".rsrc (size: 1395712)" ], "i": "metadata/binary/resource::resource-heavy-rsrc", "l": 3 }, { "c": 0.8199999928474426, "d": "Oversized PE resource section", "e": [ ".rsrc (size: 1395712)" ], "i": "metadata/binary/resource::oversized-rsrc", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "High entropy overlay data", "e": [ "binary.overlay_entropy = 7.42" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay-raw", "l": 1, "m": "B0032" }, { "c": 0.800000011920929, "d": "Five or more PE sections", "e": [ "binary.section_count = 8.00" ], "i": "objectives/anti-static/obfuscation/imports::five-plus-sections-pe", "l": 1 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox moz_logins SQL query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "objectives/credential-access/browser/firefox::moz-logins-sql", "l": 4, "m": "B0028" }, { "a": "T1027", "d": "Binary has overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::has-overlay", "l": 1, "m": "B0032" }, { "c": 0.949999988079071, "d": "links shell32.dll (DragQueryFileA, DragFinish, DragAcceptFiles)", "e": [ "shell32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shfolder.dll (SHGetFolderPathA)", "e": [ "shfolder.dll" ], "i": "metadata/dylib::shfolder/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comdlg32.dll (PageSetupDlgA, PrintDlgA, ChooseFontA, ReplaceTextA, FindTextA, ... +2 more)", "e": [ "comdlg32.dll" ], "i": "metadata/dylib::comdlg32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links kernel32.dll (DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, ... +115 more)", "e": [ "kernel32.dll" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links oleaut32.dll (SysFreeString, SysReAllocStringLen, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, ... +6 more)", "e": [ "oleaut32.dll" ], "i": "metadata/dylib::oleaut32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links winspool.drv (OpenPrinterA, EnumPrintersA, DocumentPropertiesA, ClosePrinter)", "e": [ "winspool.drv" ], "i": "metadata/dylib::winspool/drv", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (GetKeyboardType, LoadStringA, MessageBoxA, CharNextA, CreateWindowExA, ... +168 more)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links gdi32.dll (UnrealizeObject, TextOutA, StretchBlt, StartPage, StartDocA, ... +68 more)", "e": [ "gdi32.dll" ], "i": "metadata/dylib::gdi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links comctl32.dll (ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ... +20 more)", "e": [ "comctl32.dll" ], "i": "metadata/dylib::comctl32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links version.dll (VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA)", "e": [ "version.dll" ], "i": "metadata/dylib::version/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegQueryValueExA, RegOpenKeyExA, RegCloseKey, RegQueryValueExA, RegOpenKeyExA, ... +1 more)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "a": "T1113", "c": 0.9300000071525574, "d": "Windows GDI screenshot primitives", "e": [ "GetDesktopWindow", "CreateCompatibleDC", "BitBlt", "GetDIBits", "CreateCompatibleBitmap" ], "i": "micro-behaviors/hardware/display/screen::gdi-screen-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1497", "c": 0.8999999761581421, "d": "Input and foreground window check for sandbox evasion", "e": [ "GetKeyState", "GetForegroundWindow" ], "i": "objectives/anti-analysis/sandbox-detect/input::input-foreground-sandbox-gate", "l": 4 }, { "c": 0.800000011920929, "d": "Thread synchronization via message queue", "e": [ "CreateThread", "PeekMessageA" ], "i": "micro-behaviors/process/threading/async::thread-message-sync", "l": 2 }, { "a": "T1555", "c": 0.949999988079071, "d": "FileZilla credential stealer detected", "e": [ "Software\\FileZilla", "\\recentservers.xml", "\\filezilla.xml", "Software\\FileZilla Client", "\\sitemanager.xml" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-stealer", "l": 4 }, { "a": "T1113", "c": 0.9399999976158142, "d": "Windows GDI active window capture primitives", "e": [ "CreateCompatibleDC", "CreateCompatibleBitmap", "BitBlt", "GetWindowDC", "GetDesktopWindow", "GetDC" ], "i": "micro-behaviors/hardware/display/screen::gdi-window-capture-primitives", "l": 2, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileA", "GetModuleFileNameA", "ReadFile", "GetFileSize" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "a": "T1056.001", "c": 0.8500000238418579, "d": "Windows hook install and chain-management APIs", "e": [ "CallNextHookEx", "SetWindowsHookExA", "UnhookWindowsHookEx" ], "i": "micro-behaviors/hardware/input/keyboard::windows-hook-lifecycle", "l": 2, "m": "E1056.001" }, { "c": 0.8199999928474426, "d": "Reads and writes INI via ANSI", "e": [ "WritePrivateProfileStringA", "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::ini-read-write-cycle-ansi", "l": 3 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetProcAddress", "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1115", "c": 0.800000011920929, "d": "Clipboard read and write APIs", "e": [ "GetClipboardData", "SetClipboardData" ], "i": "objectives/credential-access/clipboard/crypto::clipboard-rw", "l": 1, "m": "E1510" }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource extraction API chain", "e": [ "SizeofResource", "LoadResource", "FindResourceA", "LoadLibraryExA" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-loader-api-chain", "l": 1 }, { "a": "T1027.009", "c": 0.8999999761581421, "d": "PE resource load and data pointer chain", "e": [ "LoadResource", "LockResource", "FindResourceA" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-load-lock-chain", "l": 2 }, { "a": "T1027.009", "c": 0.949999988079071, "d": "Complete PE resource extraction with data access", "e": [ "SizeofResource", "FindResourceA", "LoadResource", "LockResource" ], "i": "micro-behaviors/data/embedded/payload::pe-resource-full-extraction", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyExA", "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1027", "c": 0.8999999761581421, "d": "Large binary with low average complexity", "e": [ "binary.string_count = 2906.00", "binary.file_size = 2261052.00", "binary.function_count = 1553.00", "binary.avg_complexity = 4.28", "binary.overall_entropy = 3.45" ], "i": "objectives/anti-static/obfuscation/binary-metrics::large-binary-low-average-complexity", "l": 2, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Resource extraction to temp directory", "e": [ "LockResource", "SizeofResource", "LoadResource", "FindResourceA", "GetTempPathA" ], "i": "objectives/command-and-control/dropper/staging/embedded::pe-resource-temp-stager-persistence-chain", "l": 1 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI window capture with screen context", "e": [ "BitBlt", "GetDesktopWindow", "GetWindowDC", "GetForegroundWindow", "GetWindowTextA", "GetDC", "CreateCompatibleDC", "CreateCompatibleBitmap" ], "i": "objectives/collection/screenshot/capture::gdi-window-capture", "l": 2, "m": "C0014" }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading API chain", "e": [ "GetModuleFileNameA", "ReadFile", "GetFileSize", "CreateFileA", "binary.has_overlay = 1.00" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-chain", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Large export PE with low overall entropy", "e": [ "binary.function_count = 1553.00", "binary.overall_entropy = 3.45" ], "i": "objectives/anti-static/pack/entropy::high-entropy-data-pe-lib-context", "l": 1 }, { "a": "T1010", "c": 0.8500000238418579, "d": "Process discovery via window enumeration", "e": [ "EnumWindows", "GetWindowTextA", "GetWindowThreadProcessId" ], "i": "objectives/discovery/process/window::window-process-discovery", "l": 1 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "Large high-entropy overlay", "e": [ "binary.overlay_entropy = 7.42", "binary.overlay_size = 372796.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::high-entropy-overlay", "l": 3, "m": "B0032" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegOpenKeyExA", "RegSetValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1497.001", "c": 0.8500000238418579, "d": "Sandbox hardware fingerprint cluster (CPU/RAM/disk/uptime/screen)", "e": [ "GetDiskFreeSpaceA", "GetSystemInfo", "GetSystemMetrics", "GetTickCount", "GetDiskFreeSpaceExA" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::hardware-fingerprint-cluster", "l": 2, "m": "B0007" }, { "a": "T1497.003", "c": 0.9100000262260437, "d": "Timer-gated key polling anti-analysis", "e": [ "GetProcAddress", "KillTimer", "SetTimer", "GetKeyState" ], "i": "objectives/anti-analysis/timing/evasion::ui-timer-keypoll-gate", "l": 2, "m": "B0003.003" }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "a": "T1497.001", "c": 0.8799999952316284, "d": "User-interaction trigger APIs (mouse/keyboard/window monitoring)", "e": [ "EnumWindows", "GetForegroundWindow", "GetKeyState", "GetCursorPos" ], "i": "objectives/anti-analysis/sandbox-detect/heuristics::user-interaction-trigger-cluster", "l": 3 }, { "a": "T1113", "c": 0.9200000166893005, "d": "GDI screen capture via DIB section (BMP format)", "e": [ "CreateDIBSection", "BitBlt" ], "i": "objectives/collection/screenshot/capture::gdi-dib-capture", "l": 2, "m": "C0014" }, { "c": 0.8799999952316284, "d": "Clipboard read or write transfer behavior", "e": [ "EnumClipboardFormats", "TClipboard", "CloseClipboard", "OpenClipboard", "GetClipboardData", "RegisterClipboardFormatA", "EmptyClipboard", "GetClipboardData", "TClipboardFormats", "SetClipboardData", "SetClipboardData", "IsClipboardFormatAvailable" ], "i": "objectives/collection/clipboard/capture::clipboard-session-transfer", "l": 1 }, { "c": 0.8999999761581421, "d": "High-entropy overlay with large resource section", "e": [ "binary.overlay_entropy = 7.42", ".rsrc (size: 1395712)", "binary.has_overlay = 1.00", "binary.overall_entropy = 3.45" ], "i": "objectives/anti-static/obfuscation/binary-metrics::highly-entropic-overlay-large-rsrc-low-entropy", "l": 3 }, { "a": "T1027.009", "c": 0.8500000238418579, "d": "Binary with encrypted overlay payload", "e": [ "binary.has_overlay = 1.00", "binary.overlay_size = 372796.00", "binary.overlay_entropy = 7.42" ], "i": "objectives/anti-static/obfuscation/binary-metrics::binary-encrypted-overlay", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "PuTTY", "binary.has_overlay = 1.00", "FileZilla", "filezilla", "WinRAR" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 }, { "a": "T1027.009", "c": 0.9200000166893005, "d": "PE high-entropy overlay with loader APIs", "e": [ "GetModuleFileNameA", "binary.has_overlay = 1.00", "GetFileSize", "CreateFileA", "ReadFile", "binary.overlay_entropy = 7.42", "binary.overlay_size = 372796.00" ], "i": "objectives/anti-static/obfuscation/binary-metrics::pe-encrypted-overlay-dropper", "l": 3, "m": "B0032" }, { "c": 0.8999999761581421, "d": "Encoded payload detected: xor", "e": [ "tHuLu@uDuXu\\uPuTuhulu`uduxu|uputu \u003cxor\u003e" ], "i": "metadata/encoded-payload/xor", "l": 3 } ], "sha": "f405d4bdf70cdcda3eb125861891c2ef6a1e6d0af8b4ba237274a1e71fcbb774", "path": "/data/samples/bad/datasets/pe-machine-learning-dataset/507081", "type": "pe" }, { "f": "K₂O₁₀(C₉Ca₅SCoDy₂P₂As₈Er₄IPr₂)H₆(Cm₃Db₂F₂Os₅Po₅Ds)Md₄(SiBi₄Pa₂)", "x": 198, "dp": 1, "id": 1, "is": [ "CreateFileA", "ReadFile", "CloseHandle", "WriteFile", "lstrlenA", "GlobalLock", "GlobalUnlock", "LocalFree", "LocalAlloc", "GetTickCount", "lstrcpyA", "lstrcatA", "GetFileAttributesA", "ExpandEnvironmentStringsA", "GetFileSize", "CreateFileMappingA", "MapViewOfFile", "UnmapViewOfFile", "LoadLibraryA", "GetProcAddress", "GetTempPathA", "CreateDirectoryA", "DeleteFileA", "GetCurrentProcess", "WideCharToMultiByte", "GetLastError", "lstrcmpA", "CreateToolhelp32Snapshot", "Process32First", "OpenProcess", "Process32Next", "FindFirstFileA", "lstrcmpiA", "FindNextFileA", "FindClose", "GetModuleHandleA", "GetVersionExA", "GetLocaleInfoA", "GetSystemInfo", "GetWindowsDirectoryA", "GetPrivateProfileStringA", "SetCurrentDirectoryA", "GetPrivateProfileSectionNamesA", "GetPrivateProfileIntA", "GetCurrentDirectoryA", "lstrlenW", "MultiByteToWideChar", "Sleep", "GetModuleFileNameA", "LCMapStringA", "ExitProcess", "SetUnhandledExceptionFilter", "RegOpenKeyExA", "RegQueryValueExA", "RegCloseKey", "RegOpenKeyA", "RegEnumKeyExA", "RegCreateKeyA", "RegSetValueExA", "IsTextUnicode", "RegOpenCurrentUser", "RegEnumValueA", "GetUserNameA", "CreateStreamOnHGlobal", "GetHGlobalFromStream", "CoCreateGuid", "CoTaskMemFree", "CoCreateInstance", "OleInitialize", "ShellExecuteA", "StrStrIA", "StrRChrIA", "StrToIntA", "StrStrA", "StrCmpNIA", "StrStrIW", "wsprintfA", "LoadUserProfileA", "UnloadUserProfile", "InternetCrackUrlA", "InternetCreateUrlA", "inet_addr", "gethostbyname", "socket", "connect", "closesocket", "send", "select", "recv", "setsockopt", "WSAStartup" ], "ms": { "pe": { "machine": 332.0, "checksum": 0.0, "subsystem": 2.0, "timestamp": 1442649594.0, "image_base": 4194304.0, "entry_section": ".text", "size_of_image": 102400.0, "timestamp_day": 19.0, "file_alignment": 512.0, "timestamp_year": 2015.0, "characteristics": 271.0, "entry_point_rva": 67105.0, "size_of_headers": 4096.0, "timestamp_month": 9.0, "checksum_missing": true, "checksum_present": false, "export_timestamp": 0.0, "import_dll_count": 9.0, "computed_checksum": 115527.0, "section_alignment": 4096.0, "number_of_sections": 3.0, "resource_timestamp": 0.0, "linker_major_version": 2.0, "linker_minor_version": 50.0, "api_hashing_indicators": 1.0, "export_timestamp_present": false, "resource_timestamp_present": false }, "binary": { "code_size": 72704.0, "file_size": 102400.0, "entry_point": 67105.0, "has_overlay": true, "code_entropy": 6.06, "data_entropy": 4.12, "import_count": 91.0, "overlay_size": 9728.0, "string_count": 841.0, "overlay_ratio": 0.09, "section_count": 3.0, "avg_complexity": 4.97, "function_count": 441.0, "import_density": 1.28, "max_complexity": 107.0, "string_density": 11.85, "overall_entropy": 4.77, "overlay_entropy": 7.16, "avg_basic_blocks": 7.55, "avg_section_size": 30720.0, "dependency_count": 9.0, "entropy_variance": 1.27, "function_density": 6.21, "avg_function_size": 158.38, "avg_string_length": 14.35, "complexity_per_kb": 0.07, "max_string_length": 243.0, "wide_string_count": 1.0, "writable_sections": 1.0, "avg_string_entropy": 3.03, "code_to_data_ratio": 3.74, "data_to_file_ratio": 0.19, "entry_point_is_rva": true, "text_to_file_ratio": 0.71, "total_basic_blocks": 3329.0, "executable_sections": 1.0, "string_length_stddev": 15.65, "largest_section_ratio": 0.71, "sentence_string_count": 61.0, "sentence_string_ratio": 0.07, "behavioral_import_ratio": 0.08, "function_analysis_depth": 2.0, "high_complexity_functions": 1.0 } }, "ss": [ [ 77, "!This program cannot be run in DOS mode." ], [ 376, ".text" ], [ 455, "@.data" ], [ 5521, "5KHA" ], [ 8312, "PSQRWV" ], [ 8451, "VWPSQR" ], [ 64539, "UVW3" ], [ 70713, "33331" ], [ 72697, "PPSV" ], [ 73216, "\r\n\r\naPLib v1.01 - the smaller the better :)\r\nCopyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved.\r\n\r\nMore informatio" ], [ 73220, "aPLib v1.01 - the smaller the better :)" ], [ 73263, "Copyright (c) 1998-2009 by Joergen Ibsen, All Rights Reserved." ], [ 73329, "More information: http://www.ibsensoftware.com/" ], [ 73728, "123456" ], [ 73735, "password" ], [ 73750, "qwerty" ], [ 73757, "12345" ], [ 73763, "jesus" ], [ 73778, "1234" ], [ 73783, "abc123" ], [ 73790, "letmein" ], [ 73798, "test" ], [ 73803, "love" ], [ 73812, "password1" ], [ 73822, "hello" ], [ 73828, "monkey" ], [ 73835, "dragon" ], [ 73842, "trustno1" ], [ 73858, "iloveyou" ], [ 73867, "1234567" ], [ 73875, "shadow" ], [ 73892, "christ" ], [ 73899, "sunshine" ], [ 73908, "master" ], [ 73915, "computer" ], [ 73924, "princess" ], [ 73933, "tigger" ], [ 73940, "football" ], [ 73949, "angel" ], [ 73955, "jesus1" ], [ 73962, "123123" ], [ 73969, "whatever" ], [ 73978, "freedom" ], [ 73986, "killer" ], [ 73998, "soccer" ], [ 74005, "superman" ], [ 74014, "michael" ], [ 74022, "cheese" ], [ 74029, "internet" ], [ 74038, "joshua" ], [ 74045, "fuckyou" ], [ 74053, "blessed" ], [ 74061, "baseball" ], [ 74070, "starwars" ], [ 74086, "purple" ], [ 74093, "jordan" ], [ 74100, "faith" ], [ 74106, "summer" ], [ 74113, "ashley" ], [ 74120, "buster" ], [ 74127, "heaven" ], [ 74134, "pepper" ], [ 74149, "hunter" ], [ 74156, "lovely" ], [ 74163, "andrew" ], [ 74170, "thomas" ], [ 74177, "angels" ], [ 74184, "charlie" ], [ 74192, "daniel" ], [ 74204, "jennifer" ], [ 74213, "single" ], [ 74220, "hannah" ], [ 74227, "qazwsx" ], [ 74240, "matrix" ], [ 74259, "654321" ], [ 74266, "amanda" ], [ 74273, "nothing" ], [ 74281, "ginger" ], [ 74288, "mother" ], [ 74295, "snoopy" ], [ 74302, "jessica" ], [ 74310, "welcome" ], [ 74318, "pokemon" ], [ 74326, "iloveyou1" ], [ 74342, "mustang" ], [ 74350, "helpme" ], [ 74357, "justin" ], [ 74364, "jasmine" ], [ 74372, "orange" ], [ 74379, "testing" ], [ 74387, "apple" ], [ 74393, "michelle" ], [ 74402, "peace" ], [ 74408, "secret" ], [ 74417, "grace" ], [ 74423, "william" ], [ 74431, "iloveyou2" ], [ 74441, "nicole" ], [ 74455, "muffin" ], [ 74462, "gateway" ], [ 74470, "fuckyou1" ], [ 74479, "asshole" ], [ 74487, "hahaha" ], [ 74494, "poop" ], [ 74499, "blessing" ], [ 74508, "blahblah" ], [ 74517, "myspace1" ], [ 74526, "matthew" ], [ 74534, "canada" ], [ 74541, "silver" ], [ 74548, "robert" ], [ 74555, "forever" ], [ 74563, "asdfgh" ], [ 74570, "rachel" ], [ 74577, "rainbow" ], [ 74585, "guitar" ], [ 74592, "peanut" ], [ 74599, "batman" ], [ 74606, "cookie" ], [ 74613, "bailey" ], [ 74620, "soccer1" ], [ 74628, "mickey" ], [ 74635, "biteme" ], [ 74642, "hello1" ], [ 74649, "eminem" ], [ 74656, "dakota" ], [ 74663, "samantha" ], [ 74672, "compaq" ], [ 74679, "diamond" ], [ 74687, "taylor" ], [ 74694, "forum" ], [ 74700, "john316" ], [ 74708, "richard" ], [ 74716, "blink182" ], [ 74725, "peaches" ], [ 74733, "cool" ], [ 74738, "flower" ], [ 74745, "scooter" ], [ 74753, "banana" ], [ 74760, "james" ], [ 74766, "asdfasdf" ], [ 74775, "victory" ], [ 74783, "london" ], [ 74790, "123qwe" ], [ 74797, "123321" ], [ 74804, "startrek" ], [ 74813, "george" ], [ 74820, "winner" ], [ 74827, "maggie" ], [ 74834, "trinity" ], [ 74842, "online" ], [ 74849, "123abc" ], [ 74856, "chicken" ], [ 74864, "junior" ], [ 74877, "passw0rd" ], [ 74886, "austin" ], [ 74893, "sparky" ], [ 74900, "admin" ], [ 74906, "merlin" ], [ 74913, "google" ], [ 74920, "friends" ], [ 74928, "hope" ], [ 74933, "shalom" ], [ 74940, "nintendo" ], [ 74949, "looking" ], [ 74957, "harley" ], [ 74964, "smokey" ], [ 74976, "joseph" ], [ 74989, "digital" ], [ 74999, "thunder" ], [ 75007, "spirit" ], [ 75014, "bandit" ], [ 75021, "enter" ], [ 75027, "anthony" ], [ 75035, "corvette" ], [ 75044, "hockey" ], [ 75051, "power" ], [ 75057, "benjamin" ], [ 75083, "viper" ], [ 75089, "genesis" ], [ 75097, "knight" ], [ 75104, "qwerty1" ], [ 75112, "creative" ], [ 75121, "foobar" ], [ 75128, "adidas" ], [ 75135, "rotimi" ], [ 75142, "slayer" ], [ 75149, "wisdom" ], [ 75192, "http://don.service-master.eu/gate.php" ], [ 75448, "http://don.service-master.eu/shit.exe" ], [ 75705, "YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0" ], [ 75749, "68.85.1.1:19791" ], [ 75751, "MODU" ], [ 75765, "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" ], [ 75817, "UninstallString" ], [ 75833, "DisplayName" ], [ 75855, ".exe" ], [ 75860, "Software\\WinRAR" ], [ 75876, "open" ], [ 75885, "kernel32.dll" ], [ 75898, "WTSGetActiveConsoleSessionId" ], [ 75927, "ProcessIdToSessionId" ], [ 75949, "netapi32.dll" ], [ 75962, "NetApiBufferFree" ], [ 75979, "NetUserEnum" ], [ 75992, "ole32.dll" ], [ 76002, "StgOpenStorage" ], [ 76018, "advapi32.dll" ], [ 76031, "AllocateAndInitializeSid" ], [ 76056, "CheckTokenMembership" ], [ 76077, "FreeSid" ], [ 76085, "CredEnumerateA" ], [ 76100, "CredFree" ], [ 76109, "CryptGetUserKey" ], [ 76125, "CryptExportKey" ], [ 76140, "CryptDestroyKey" ], [ 76156, "CryptReleaseContext" ], [ 76176, "RevertToSelf" ], [ 76189, "OpenProcessToken" ], [ 76206, "ImpersonateLoggedOnUser" ], [ 76230, "GetTokenInformation" ], [ 76250, "ConvertSidToStringSidA" ], [ 76273, "LogonUserA" ], [ 76284, "LookupPrivilegeValueA" ], [ 76306, "AdjustTokenPrivileges" ], [ 76329, "crypt32.dll" ], [ 76341, "CryptUnprotectData" ], [ 76360, "CertOpenSystemStoreA" ], [ 76381, "CertEnumCertificatesInStore" ], [ 76409, "CertCloseStore" ], [ 76424, "CryptAcquireCertificatePrivateKey" ], [ 76459, "msi.dll" ], [ 76467, "MsiGetComponentPathA" ], [ 76489, "pstorec.dll" ], [ 76501, "PStoreCreateInstance" ], [ 76639, "shell32.dll" ], [ 76651, "SHGetFolderPathA" ], [ 76737, "My Documents" ], [ 76758, "AppData" ], [ 76774, "Local AppData" ], [ 76796, "Cache" ], [ 76810, "Cookies" ], [ 76826, "History" ], [ 76842, "My Documents" ], [ 76863, "Common AppData" ], [ 76886, "My Pictures" ], [ 76906, "Common Documents" ], [ 76931, "Common Administrative Tools" ], [ 76967, "Administrative Tools" ], [ 76996, "Personal" ], [ 77005, "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], [ 77070, "explorer.exe" ], [ 77096, "SeImpersonatePrivilege" ], [ 77119, "SeTcbPrivilege" ], [ 77134, "SeChangeNotifyPrivilege" ], [ 77158, "SeCreateTokenPrivilege" ] ], "sz": 102400, "ts": [ { "c": 1.0, "d": "Binary is not digitally signed", "i": "metadata/unsigned", "l": 3 }, { "a": "T1195.002", "c": 0.550000011920929, "d": "Plaintext hello beacon token", "e": [ "hello" ], "i": "objectives/command-and-control/backdoor/binary::plaintext-hello-beacon-token", "l": 1, "m": "B0025" }, { "a": "T1572", "c": 1.0, "d": "DMW custom SSH tunneling tool password string", "e": [ "password", "password", "password", "password" ], "i": "objectives/command-and-control/channel/tunnel::dmw-tunnel-pwd", "l": 1 }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry subkeys via import", "e": [ "RegEnumKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-enum-key-ex-a-symbol", "l": 2 }, { "c": 0.8999999761581421, "d": "sqlite3 string", "e": [ "sqlite3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite3-string", "l": 2 }, { "a": "T1027.002", "c": 0.800000011920929, "d": "PEB access via FS segment (x86)", "e": [ "64 a1 30 00 00 00" ], "i": "micro-behaviors/os/api-resolution/hash-based::peb-fs-access", "l": 2, "m": "F0004" }, { "c": 0.8999999761581421, "d": "Tool identity claims FileZilla", "e": [ "filezilla", "FileZilla", "FileZilla" ], "i": "metadata/package/tooling::tool-identity-filezilla", "l": 1 }, { "c": 0.8999999761581421, "d": "Initialize Winsock library", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::wsa-startup", "l": 3 }, { "a": "T1071.001", "d": "HTTP header syntax marker", "e": [ "HTTP/1.0\r\nHost: " ], "i": "objectives/command-and-control/channel/http/protocol::http-delimiter", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock send import", "e": [ "send" ], "i": "micro-behaviors/communications/socket/init::send-api", "l": 2 }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla recentservers.xml config", "e": [ "\\recentservers.xml" ], "i": "objectives/credential-access/ftp/filezilla::recentservers-xml", "l": 1 }, { "c": 0.699999988079071, "d": "Get current process handle", "e": [ "GetCurrentProcess" ], "i": "micro-behaviors/os/module/load::get-current-process", "l": 2 }, { "c": 0.75, "d": "INI extension marker", "e": [ ".ini", ".ini" ], "i": "well-known/malware/trojan/elex/lpadv::ini-extension", "l": 1 }, { "c": 0.8999999761581421, "d": "Get Windows installation directory", "e": [ "GetWindowsDirectoryA", "sub.KERNEL32.DLL_GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory", "l": 2 }, { "a": "T1082", "c": 0.6499999761581421, "d": "Hostname in binary", "e": [ "Hostname" ], "i": "micro-behaviors/os/sysinfo/hostname::hostname-string-raw", "l": 1, "m": "E1082" }, { "a": "T1071.001", "d": "User-Agent header", "e": [ "User-Agent:", "User-Agent:", "User-Agent:" ], "i": "micro-behaviors/communications/http/request::user-agent-header", "l": 2, "m": "C0002" }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox PK11SDR_Decrypt function", "e": [ "PK11SDR_Decrypt" ], "i": "objectives/credential-access/browser/firefox::pk11-decrypt", "l": 4, "m": "B0028" }, { "c": 0.8500000238418579, "d": "Query file attributes or existence", "e": [ "GetFileAttributesA" ], "i": "micro-behaviors/fs/path/check::get-file-attributes", "l": 2 }, { "c": 1.0, "d": "Binary has 40+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-40", "l": 1 }, { "c": 0.6000000238418579, "d": "Copyright notice", "e": [ "Copyright", "Copyright" ], "i": "metadata/package/license::copyright-word", "l": 2 }, { "c": 1.0, "d": "WSAStartup import", "e": [ "WSAStartup" ], "i": "well-known/malware/trojan/hijack-gen::padodor-wsa-startup-import", "l": 1 }, { "a": "T1071.001", "c": 0.8500000238418579, "d": "Suspicious PHP endpoint URL (gate/upload/etc)", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::suspicious-php-filename", "l": 4, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Write data to file handle", "e": [ "WriteFile" ], "i": "micro-behaviors/fs/file/write::write-file", "l": 2 }, { "c": 0.8999999761581421, "d": "Tool identity claims WinRAR", "e": [ "WinRAR" ], "i": "metadata/package/tooling::tool-identity-winrar", "l": 1 }, { "c": 0.699999988079071, "d": "gethostbyname import string", "e": [ "gethostbyname" ], "i": "micro-behaviors/communications/ip/resolve::resolve-gethostbyname-import", "l": 2 }, { "c": 0.75, "d": "Initialize OLE/COM subsystem", "e": [ "OleInitialize" ], "i": "micro-behaviors/os/com/invoke::ole-initialize", "l": 2 }, { "c": 0.7599999904632568, "d": "Winsock startup API string", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/socket/init::ws2-startup-api-string", "l": 1 }, { "a": "T1110.001", "c": 0.20000000298023224, "d": "admin keyword", "e": [ "admin" ], "i": "micro-behaviors/data/text/keywords/username::admin-keyword", "l": 2, "m": "B0028" }, { "c": 0.8999999761581421, "d": "Begin directory enumeration ANSI", "e": [ "FindFirstFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-first-file-a", "l": 2 }, { "c": 0.6600000262260437, "d": "Create directories (Windows API ANSI)", "e": [ "CreateDirectoryA" ], "i": "micro-behaviors/fs/directory/mkdir::create-directory-a", "l": 2 }, { "c": 0.699999988079071, "d": "Check if running under WoW64", "e": [ "IsWow64Process" ], "i": "micro-behaviors/os/compat/wow64::is-wow64-process", "l": 2 }, { "c": 1.0, "d": "Binary has 4 or fewer sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/command-and-control/infrastructure/config::max-sections-4", "l": 1 }, { "c": 0.8999999761581421, "d": "Windows file creation/open API", "e": [ "CreateFileA" ], "i": "micro-behaviors/fs/file/open::file-create-win", "l": 2 }, { "c": 0.699999988079071, "d": "PE has few sections", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/layout::legacy-few-sections", "l": 2 }, { "a": "T1027", "c": 0.8399999737739563, "d": "VB6 PE with three sections", "e": [ "binary.section_count = 3.00" ], "i": "objectives/anti-static/obfuscation/payload::three-section-vb6-layout", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "Binary has 3+ functions", "e": [ "binary.function_count = 441.00" ], "i": "metadata/binary/metrics::few-functions-3", "l": 1 }, { "c": 0.800000011920929, "d": "Map a file section into memory", "e": [ "MapViewOfFile" ], "i": "micro-behaviors/fs/memory/mmap::map-view-of-file", "l": 2 }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla main config file", "e": [ "\\filezilla.xml" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-xml", "l": 1 }, { "a": "T1071.001", "c": 0.6600000262260437, "d": "Accept-Encoding header", "e": [ "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConne…", "…\nHost: %s\r\nAccept: */*\r\nAccept-Encoding: identity, *;q=0\r\nConte…", "Accept-Encoding: identity, *;q=0" ], "i": "micro-behaviors/communications/http/headers::headers-encoding", "l": 2, "m": "C0002" }, { "c": 1.0, "d": "Binary has 50+ functions", "e": [ "binary.function_count = 441.00" ], "i": "metadata/binary/metrics::many-functions-50", "l": 1 }, { "a": "T1005", "c": 0.75, "d": "SQLite extension", "e": [ ".sqlite", ".sqlite", ".sqlite" ], "i": "objectives/collection/file-targeting/filter::sqlite-extension", "l": 1, "m": "B0024" }, { "a": "T1027", "c": 0.8799999952316284, "d": "Dense short mixed-case data tokens", "e": [ "Microsoft", "Software", "FreeSid", "CredFree", "Documents", "AppData", "Local", "Cache", "Cookies", "History", "Documents", "Common", "Pictures", "Common", "Common", "Tools" ], "i": "objectives/anti-static/obfuscation/string::dense-short-mixedcase-data-tokens", "l": 1, "m": "B0032" }, { "c": 1.0, "d": "OpenProcess/NtOpenProcess symbol", "e": [ "OpenProcess" ], "i": "objectives/evasion/fileless/memory::open-process-sym", "l": 1 }, { "a": "T1548.002", "c": 0.699999988079071, "d": "Shell Open command registry key", "e": [ "\\shell\\open\\command" ], "i": "objectives/privilege-escalation/elevation-control/uac-bypass/hijack::shell-open-command-reg", "l": 1 }, { "c": 0.699999988079071, "d": "Delay execution", "e": [ "Sleep" ], "i": "micro-behaviors/time/timing/delay::sleep-dup", "l": 2 }, { "c": 0.9900000095367432, "d": "Exactly three sections", "e": [ "binary.section_count = 3.00" ], "i": "well-known/malware/worm/ludbaruma::metric-section-count-3", "l": 1 }, { "c": 0.8500000238418579, "d": "Read current working directory", "e": [ "GetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::get-current-directory", "l": 2 }, { "a": "T1620", "c": 0.8999999761581421, "d": "LoadLibraryA loader API string", "e": [ "LoadLibraryA" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-loadlibrarya-string", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "Padodor COM instance string", "e": [ "CoCreateInstance" ], "i": "well-known/malware/trojan/shellobject/padodor::padodor-cocreateinstance-string", "l": 1 }, { "c": 0.8199999928474426, "d": "GetWindowsDirectory API string", "e": [ "GetWindowsDirectoryA" ], "i": "micro-behaviors/os/sysinfo/directories::get-windows-directory-string", "l": 2 }, { "a": "T1071.001", "c": 0.6000000238418579, "d": "HTTP Connection close header", "e": [ "Connection: close" ], "i": "objectives/command-and-control/channel/http-beacon::http-connection-close-header", "l": 1, "m": "B0030" }, { "a": "T1552.004", "c": 0.75, "d": "Remote Desktop Protocol extension", "e": [ ".rdp" ], "i": "objectives/collection/file-targeting/filter::rdp-extension", "l": 3, "m": "B0024" }, { "c": 1.0, "d": "Binary has 50+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-50", "l": 1 }, { "c": 0.8999999761581421, "d": "High-risk token privilege name", "e": [ "SeImpersonatePrivilege", "SeTcbPrivilege", "SeAssignPrimaryTokenPrivilege" ], "i": "objectives/privilege-escalation/token-manipulation::dangerous-privilege-name", "l": 1 }, { "c": 1.0, "d": "File is a compiled binary", "e": [ "binary.file_size = 102400.00" ], "i": "metadata/binary/framework::is-binary", "l": 1 }, { "c": 0.8999999761581421, "d": "PE standard runtime section", "e": [ ".rdata" ], "i": "metadata/binary/section/names::pe-runtime-standard-section", "l": 1 }, { "d": ".dll extension reference", "e": [ ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll", ".dll" ], "i": "micro-behaviors/fs/path/extension::dll-dup", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-endpoint-url", "l": 1 }, { "c": 0.8999999761581421, "d": "WinExec hidden-window flag immediate", "e": [ "53 4b 41 00" ], "i": "micro-behaviors/process/create/flags::winexec-sw-hide-immediate", "l": 1 }, { "a": "T1112", "c": 0.8399999737739563, "d": "Open registry key ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-open-key-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Close directory enumeration handle", "e": [ "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-close", "l": 2 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Java DPAPI unprotect call", "e": [ "UnprotectData" ], "i": "objectives/credential-access/discord/token::java-crypt-unprotect-data", "l": 1 }, { "a": "T1057", "d": "Browser app firefox", "e": [ "Firefox", "Firefox" ], "i": "micro-behaviors/process/enumerate/apps::browser-apps-firefox", "l": 2, "m": "E1592" }, { "a": "T1005", "c": 0.4000000059604645, "d": "Generic data extension", "e": [ ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat", ".dat" ], "i": "objectives/collection/file-targeting/filter::dat-extension", "l": 1, "m": "B0024" }, { "a": "T1112", "c": 0.8799999952316284, "d": "Enumerate registry values via import", "e": [ "RegEnumValueA" ], "i": "micro-behaviors/os/registry/access::reg-enum-value-a-symbol", "l": 2 }, { "a": "T1059.001", "c": 0.75, "d": "Execute shell command (ShellExecuteA)", "e": [ "ShellExecuteA" ], "i": "micro-behaviors/process/create/exec::shell-execute-a", "l": 3 }, { "c": 1.0, "d": "Binary has low average string entropy", "e": [ "binary.avg_string_entropy = 3.03" ], "i": "metadata/binary/metrics::avg-string-entropy-4-max", "l": 2 }, { "c": 0.8999999761581421, "d": "Read data from file handle", "e": [ "ReadFile" ], "i": "micro-behaviors/fs/file/read::read-file", "l": 2 }, { "c": 0.7200000286102295, "d": "Short uppercase mutex token", "e": [ "CONSTRAINT" ], "i": "micro-behaviors/process/sync/mutex::short-uppercase-token", "l": 1, "m": "C0042" }, { "a": "T1485", "c": 0.699999988079071, "d": "Windows Shell Folders registry path", "e": [ "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders" ], "i": "objectives/impact/destroy/file-deletion::shell-folders-personal-targeting", "l": 2, "m": "C0047" }, { "a": "T1106", "c": 0.949999988079071, "d": "Open process handle", "e": [ "OpenProcess" ], "i": "micro-behaviors/process/create/spawn::open-process", "l": 2 }, { "c": 0.8999999761581421, "d": "Winsock outbound connect import", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::connect-api", "l": 3 }, { "c": 0.8999999761581421, "d": "Tool identity claims PuTTY", "e": [ "PuTTY" ], "i": "metadata/package/tooling::tool-identity-putty", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol ANSI", "e": [ "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-ex-a-symbol", "l": 2 }, { "c": 0.6800000071525574, "d": "Read INI string value", "e": [ "GetPrivateProfileStringA" ], "i": "micro-behaviors/fs/config/system::read-private-profile-ansi", "l": 2 }, { "c": 1.0, "d": "LoadLibrary symbol", "e": [ "LoadLibraryA" ], "i": "objectives/anti-static/obfuscation/reflection/class::loadlibrary-sym", "l": 1 }, { "a": "T1555.003", "c": 0.8999999761581421, "d": "Firefox logins database", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "micro-behaviors/fs/path/sensitive/browser::firefox-logins", "l": 3 }, { "c": 0.699999988079071, "d": "PE has many readable strings", "e": [ "binary.string_count = 841.00" ], "i": "metadata/binary/layout::many-readable-strings", "l": 2 }, { "c": 0.8500000238418579, "d": "Query current module path", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/fs/path/check::get-module-filename", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock socket API string", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::ws2-socket-api-string", "l": 1 }, { "c": 0.8500000238418579, "d": "PuTTY identity string", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/supply-chain/trojanized/application/monitor::putty-identity-string", "l": 1 }, { "d": "Content-Type header string", "e": [ "Content-Type: application/octet-stream", "…%lu\r\nConnection: close\r\nContent-Type: application/octet-strea…" ], "i": "micro-behaviors/communications/http/request::content-type-header", "l": 1 }, { "c": 0.6399999856948853, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a-text", "l": 2 }, { "c": 0.8600000143051147, "d": "Register unhandled exception filter", "e": [ "SetUnhandledExceptionFilter" ], "i": "micro-behaviors/os/exception/error-handling::set-unhandled-exception-filter-import", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Create registry key via WinAPI", "e": [ "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::reg-create-key-a", "l": 2 }, { "a": "T1070.006", "c": 0.699999988079071, "d": "PE header compile timestamp predates 2025", "e": [ "pe.timestamp = 1442649594.00" ], "i": "objectives/evasion/indicator-removal/timestamps::header-timestamp-pre-2025", "l": 1 }, { "d": "password keyword", "e": [ "_Password", "PassWord", "password", "FtpPassword", "password1", "_FtpPassword", "\"password\" : \"", "PasswordType", "Password" ], "i": "micro-behaviors/data/text/keywords::password", "l": 1 }, { "a": "T1071.001", "c": 0.7799999713897705, "d": "HTTP POST request line", "e": [ "POST %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/post::post-request-line", "l": 3, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Close handle", "e": [ "CloseHandle" ], "i": "micro-behaviors/process/create/spawn::close-handle-dup", "l": 2 }, { "c": 0.6600000262260437, "d": "Delete files (Windows API ANSI)", "e": [ "DeleteFileA" ], "i": "micro-behaviors/fs/file/delete::deletefile-a", "l": 2 }, { "c": 1.0, "d": "Binary has low average complexity", "e": [ "binary.avg_complexity = 4.97" ], "i": "metadata/binary/metrics::avg-complexity-15-max", "l": 2 }, { "c": 0.8999999761581421, "d": "SQLite format header", "e": [ "SQLite format 3" ], "i": "micro-behaviors/data/db/conn/sqlite::sqlite-format", "l": 3 }, { "c": 1.0, "d": "Binary is not position-independent (fixed load address)", "e": [ "binary.is_pie = 0.00" ], "i": "metadata/hardening::no-pie", "l": 2 }, { "c": 0.8999999761581421, "d": "PE standard code/data section", "e": [ ".text", ".data" ], "i": "metadata/binary/section/names::pe-code-data-standard-section", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP User-Agent header", "e": [ "…q=0\r\nConnection: close\r\nUser-Agent: Mozilla/4.0 (compatible…", "…ntent-Encoding: binary\r\nUser-Agent: Mozilla/4.0 (compatible…", "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)" ], "i": "micro-behaviors/communications/http/user-agent::user-agent-header-dup", "l": 2 }, { "c": 0.800000011920929, "d": "Uses Windows API for file mapping", "e": [ "CreateFileMappingA" ], "i": "micro-behaviors/fs/memory/mmap::win32-file-mapping", "l": 2 }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query system hardware info (CPU cores)", "e": [ "GetSystemInfo" ], "i": "micro-behaviors/os/sysinfo/hardware::get-system-info", "l": 2 }, { "c": 1.0, "d": "NCapture launches explorer", "e": [ "explorer.exe" ], "i": "well-known/app/graphics::ncapture-explorer", "l": 1 }, { "a": "T1082", "c": 0.8799999952316284, "d": "Query locale information", "e": [ "GetLocaleInfoA" ], "i": "micro-behaviors/os/sysinfo/platform::get-locale-info", "l": 2 }, { "a": "T1005", "c": 0.550000011920929, "d": "Generic database extension", "e": [ ".db", ".db", ".db" ], "i": "objectives/collection/file-targeting/filter::db-extension", "l": 1, "m": "B0024" }, { "c": 0.949999988079071, "d": "Binary imports ADVAPI32.dll", "e": [ "advapi32.dll" ], "i": "metadata/binary/symbols::imports-advapi32-dll", "l": 1 }, { "c": 0.8999999761581421, "d": "Local memory deallocation", "e": [ "LocalFree" ], "i": "micro-behaviors/mem/alloc/heap::local-free", "l": 2 }, { "c": 0.699999988079071, "d": "PE has low overall entropy", "e": [ "binary.overall_entropy = 4.77" ], "i": "metadata/binary/layout::low-overall-entropy", "l": 2 }, { "c": 1.0, "d": "PE binary has trailing overlay data", "e": [ "binary.has_overlay = 1.00" ], "i": "metadata/binary/layout::has-overlay", "l": 2 }, { "c": 0.8999999761581421, "d": "PE mapped image under 768 KiB", "e": [ "pe.size_of_image = 102400.00" ], "i": "metadata/binary/layout::image-under-768kb", "l": 1 }, { "c": 0.75, "d": "HTTP protocol version strings", "e": [ "HTTP/1.0", "HTTP/1.0" ], "i": "micro-behaviors/communications/http/request::http-versions", "l": 1 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Set registry value via WinAPI ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/access::reg-set-value-ex-a", "l": 2 }, { "c": 0.699999988079071, "d": "Get system error code", "e": [ "GetLastError" ], "i": "micro-behaviors/os/exception/error-handling::get-last-error", "l": 2 }, { "c": 0.800000011920929, "d": "Small PE resource section", "e": [ "pe.rsrc_size = 0.00" ], "i": "metadata/package/versioning::pe-small-rsrc", "l": 1 }, { "c": 0.800000011920929, "d": "Binary has many functions (\u003e30)", "e": [ "binary.function_count = 441.00" ], "i": "metadata/binary/metrics::many-functions", "l": 2 }, { "c": 0.8999999761581421, "d": "Directory enumeration (ANSI)", "e": [ "FindNextFileA" ], "i": "micro-behaviors/fs/enumerate/directory::find-next-file-a", "l": 2 }, { "c": 0.800000011920929, "d": "Low-entropy rdata section", "e": [ ".rdata (entropy: 3.05)" ], "i": "metadata/binary/section/metrics::low-entropy-rdata-section", "l": 1 }, { "c": 0.699999988079071, "d": "HTTP GET method", "e": [ "GET %s HTTP/1.0" ], "i": "micro-behaviors/communications/http/get::get", "l": 3 }, { "a": "T1071.001", "d": "HTTP/1.x version string", "e": [ "GET %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…", "POST %s HTTP/1.0\r\nHost: %s\r\nAccept: */*…" ], "i": "micro-behaviors/communications/http/request::http-version", "l": 2, "m": "C0002" }, { "a": "T1036.005", "c": 0.75, "d": "C2 gate.php endpoint", "e": [ "gate.php" ], "i": "objectives/command-and-control/beacon/network::c2-gate-php-endpoint", "l": 1, "m": "B0030" }, { "a": "T1562.001", "c": 0.8999999761581421, "d": "Task Manager process enumeration", "e": [ "Process32Next" ], "i": "micro-behaviors/process/terminate/kill::taskmgr-process-enum", "l": 3, "m": "B0001" }, { "c": 0.8999999761581421, "d": "Local memory allocation", "e": [ "LocalAlloc" ], "i": "micro-behaviors/mem/alloc/heap::local-alloc", "l": 2 }, { "c": 0.6499999761581421, "d": "Get file size", "e": [ "GetFileSize" ], "i": "micro-behaviors/fs/sync/fsync::get-file-size", "l": 2 }, { "a": "T1053.005", "c": 0.8799999952316284, "d": "Task action principal properties", "e": [ "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path", "Path" ], "i": "objectives/persistence/login/scheduled-task::task-action-principal-properties", "l": 1, "m": "F0012" }, { "a": "T1555.003", "c": 0.699999988079071, "d": "Chromium Login Data database reference", "e": [ "Login Data" ], "i": "objectives/credential-access/browser/chromium::logins-table", "l": 3 }, { "c": 0.8999999761581421, "d": "Exit current process", "e": [ "ExitProcess" ], "i": "micro-behaviors/process/terminate/kill::exit-process", "l": 2 }, { "c": 0.75, "d": "Binary exports no symbols", "e": [ "binary.export_count = 0.00" ], "i": "metadata/binary/symbols::no-exports", "l": 1 }, { "a": "T1053.005", "c": 0.8999999761581421, "d": "Task Scheduler builder methods", "e": [ "GetFolder", "Connect", "Connect", "Connect", "Connect", "Connect" ], "i": "objectives/persistence/login/scheduled-task::task-scheduler-builder-methods", "l": 1, "m": "F0012" }, { "a": "T1105", "c": 0.800000011920929, "d": "Numbered DAT payload filename", "e": [ "ESTdb2.dat" ], "i": "objectives/command-and-control/dropper/staging::numbered-dat-payload-name", "l": 1, "m": "B0024" }, { "a": "T1036.005", "c": 0.800000011920929, "d": "explorer.exe process name", "e": [ "explorer.exe" ], "i": "objectives/evasion/masquerade/process::explorer-name", "l": 1, "m": "F0004" }, { "c": 0.6600000262260437, "d": "Look up temp directory via GetTempPath", "e": [ "GetTempPathA" ], "i": "micro-behaviors/fs/temp/directory::get-temp-path-dup", "l": 2 }, { "d": ".bat extension reference", "e": [ ".bat" ], "i": "micro-behaviors/fs/path/extension::bat-dup", "l": 1 }, { "a": "T1027.007", "c": 0.8500000238418579, "d": "PEB Ldr access for module enumeration", "e": [ "64 A1 30 00 00 00" ], "i": "objectives/anti-static/obfuscation/imports::peb-ldr-access", "l": 1, "m": "B0032.014" }, { "a": "T1082", "c": 0.8999999761581421, "d": "Query Windows version info", "e": [ "GetVersionExA" ], "i": "micro-behaviors/os/sysinfo/platform::get-version-ex", "l": 2 }, { "c": 0.7200000286102295, "d": "Winsock connect API string", "e": [ "connect" ], "i": "micro-behaviors/communications/socket/init::ws2-connect-api-string", "l": 1 }, { "c": 0.8999999761581421, "d": "Binary has low overall entropy", "e": [ "binary.overall_entropy = 4.77" ], "i": "metadata/binary/metrics::low-overall-entropy-binary", "l": 1 }, { "c": 0.9599999785423279, "d": "Elex Internet Explorer product resource", "e": [ "Internet Explorer" ], "i": "well-known/malware/trojan/elex/worm::elex-internet-explorer-product-resource", "l": 2 }, { "c": 0.800000011920929, "d": "High number of imported symbols (\u003e80)", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports", "l": 2 }, { "c": 0.20000000298023224, "d": "command keyword", "e": [ "Opera.HTML\\shell\\open\\command", "FTP++.Link\\shell\\open\\command" ], "i": "micro-behaviors/data/text/keywords::command-dup", "l": 1 }, { "a": "T1485", "c": 0.8999999761581421, "d": "Preserves .exe .gho .bak files", "e": [ ".exe" ], "i": "objectives/impact/destroy/file-deletion::exe-gho-bak-whitelist", "l": 1, "m": "C0047" }, { "a": "T1555", "c": 0.8999999761581421, "d": "FileZilla sitemanager.xml config", "e": [ "\\sitemanager.xml" ], "i": "objectives/credential-access/ftp/filezilla::sitemanager-xml", "l": 1 }, { "c": 0.6000000238418579, "d": "SELECT SQL keyword in query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM" ], "i": "micro-behaviors/data/db/conn/sql::sql-select", "l": 2 }, { "c": 0.699999988079071, "d": "Get module file path (ANSI)", "e": [ "GetModuleFileNameA" ], "i": "micro-behaviors/os/module/load::get-module-filename-ansi", "l": 2 }, { "c": 0.8399999737739563, "d": "High basic block count in sparse binary", "e": [ "binary.total_basic_blocks = 3329.00" ], "i": "metadata/binary/metrics::dense-basic-blocks", "l": 1 }, { "a": "T1041", "c": 0.6000000238418579, "d": "PHP gate endpoint", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-gate", "l": 4, "m": "C0002" }, { "c": 1.0, "d": "Binary has 25+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-25", "l": 1 }, { "a": "T1555", "c": 0.8500000238418579, "d": "FileZilla application directory", "e": [ "Software\\FileZilla Client", "Software\\FileZilla" ], "i": "objectives/credential-access/ftp/filezilla::application-path", "l": 1 }, { "c": 0.8999999761581421, "d": "Winsock receive import", "e": [ "recv" ], "i": "micro-behaviors/communications/socket/init::recv-api", "l": 2 }, { "c": 0.699999988079071, "d": "Free COM memory allocation", "e": [ "CoTaskMemFree" ], "i": "micro-behaviors/os/com/invoke::co-task-mem-free", "l": 2 }, { "a": "T1027", "c": 0.699999988079071, "d": "Code section dominates file layout", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/string/anomaly::dominant-text-section", "l": 1, "m": "B0032" }, { "a": "T1112", "c": 0.8999999761581421, "d": "Open registry key via import symbol", "e": [ "RegOpenKeyA" ], "i": "micro-behaviors/os/registry/access::reg-open-key-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "Get module handle ANSI", "e": [ "GetModuleHandleA" ], "i": "micro-behaviors/os/module/load::get-module-handle-ansi", "l": 2 }, { "c": 0.800000011920929, "d": "Create COM object instance", "e": [ "CoCreateInstance" ], "i": "micro-behaviors/os/com/invoke::co-create-instance", "l": 2 }, { "a": "T1112", "c": 0.8500000238418579, "d": "Query registry value via import symbol", "e": [ "RegQueryValueExA" ], "i": "micro-behaviors/os/registry/access::reg-query-value-ex-a-symbol", "l": 2 }, { "c": 0.699999988079071, "d": "GetModuleFileName API call", "e": [ "GetModuleFileNameA", "sub.KERNEL32.DLL_GetModuleFileNameA" ], "i": "micro-behaviors/process/info/current::get-module-filename", "l": 2 }, { "c": 1.0, "d": ".bat extension", "e": [ ".bat" ], "i": "objectives/command-and-control/dropper/builder::bat-ext", "l": 1 }, { "c": 0.800000011920929, "d": "Uses internet communication API imports", "e": [ "WSAStartup" ], "i": "micro-behaviors/communications/http::has-internet-communication-apis", "l": 2 }, { "c": 1.0, "d": "Binary has 20+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-20", "l": 1 }, { "c": 0.7799999713897705, "d": "HTTP URL prefix marker", "e": [ "http://", "http://", "http://" ], "i": "well-known/malware/trojan/elex/lpadv::http-prefix", "l": 1 }, { "c": 0.8999999761581421, "d": "Close registry key", "e": [ "RegCloseKey" ], "i": "micro-behaviors/os/registry/manipulate::reg-close-key", "l": 2 }, { "a": "T1071.001", "d": "Old Mozilla 4.0 User-Agent", "e": [ "…ng: binary\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …", "User-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)", "…ion: close\r\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; …" ], "i": "micro-behaviors/communications/http/headers::ua-mozilla-old", "l": 2, "m": "C0002" }, { "c": 0.8999999761581421, "d": "Get tick count", "e": [ "GetTickCount" ], "i": "micro-behaviors/time/query::get-tick-count", "l": 2 }, { "c": 1.0, "d": "Binary has 30+ imports", "e": [ "binary.import_count = 91.00" ], "i": "metadata/binary/metrics::many-imports-30", "l": 1 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Set registry value ANSI", "e": [ "RegSetValueExA" ], "i": "micro-behaviors/os/registry/manipulate::reg-set-value-ex-a", "l": 2 }, { "c": 0.8999999761581421, "d": "Winsock socket creation import", "e": [ "socket" ], "i": "micro-behaviors/communications/socket/init::socket-api", "l": 3 }, { "c": 0.30000001192092896, "d": "secret keyword", "e": [ "secret" ], "i": "micro-behaviors/data/text/keywords::secret", "l": 1 }, { "d": ".exe extension reference", "e": [ ".exe", ".exe", ".exe", ".exe" ], "i": "micro-behaviors/fs/path/extension::exe-dup", "l": 2 }, { "c": 0.8999999761581421, "d": "Resolve exports with GetProcAddress", "e": [ "GetProcAddress" ], "i": "micro-behaviors/os/module/load::get-proc-address-import", "l": 2 }, { "a": "T1027.007", "c": 0.8600000143051147, "d": "PE API hashing indicator present", "e": [ "pe.api_hashing_indicators = 1.00" ], "i": "objectives/anti-static/obfuscation/imports::pe-api-hashing-indicator-single", "l": 1, "m": "B0032.014" }, { "a": "T1546.015", "c": 0.8199999928474426, "d": "InprocServer32 registry write", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}\\InProcServer32" ], "i": "objectives/persistence/system/registry/com-hijack::inprocserver32-write", "l": 3 }, { "a": "T1071", "c": 0.75, "d": "PHP URL endpoint (often used for C2)", "e": [ "http://don.service-master.eu/gate.php" ], "i": "objectives/command-and-control/infrastructure/domain::php-url", "l": 3, "m": "C0002" }, { "a": "T1070.006", "c": 0.8999999761581421, "d": "Export timestamp is absent", "e": [ "pe.export_timestamp_present = 0.00" ], "i": "objectives/evasion/indicator-removal/timestamps::export-timestamp-absent", "l": 2 }, { "c": 0.8999999761581421, "d": "Switch current working directory", "e": [ "SetCurrentDirectoryA" ], "i": "micro-behaviors/fs/traversal/drives::set-current-directory", "l": 3 }, { "a": "T1027", "c": 0.800000011920929, "d": "Few PE resource entries (no DIALOG/MENU/STRINGTABLE)", "e": [ "pe.resource_count = 0.00" ], "i": "objectives/evasion/anti-av/heuristic::minimal-pe-resources", "l": 1 }, { "a": "T1552.004", "c": 0.800000011920929, "d": "PuTTY sessions registry reference", "e": [ "Software\\SimonTatham\\PuTTY\\Sessions" ], "i": "objectives/credential-access/ssh/key::putty-sessions", "l": 4 }, { "c": 0.6000000238418579, "d": "Very few sections (merged/stripped)", "e": [ "binary.section_count = 3.00" ], "i": "metadata/binary/metrics::few-sections", "l": 2 }, { "c": 0.800000011920929, "d": "PE executable is unsigned", "i": "metadata/signed::unsigned-pe-executable", "l": 3 }, { "a": "T1620", "c": 0.8999999761581421, "d": "GetProcAddress loader API string", "e": [ "GetProcAddress" ], "i": "objectives/command-and-control/dropper/execution/loader::dark-eye-getprocaddress-string", "l": 1, "m": "B0030" }, { "a": "T1574.002", "c": 0.8999999761581421, "d": "Hidden LoadLibraryA string reference", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/dylib/load::load-library-a-string-no-import", "l": 1 }, { "a": "T1055", "c": 0.949999988079071, "d": "Huge null run in executable (128+ bytes)", "e": [ "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00", "00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00" ], "i": "objectives/anti-static/obfuscation/binary-structure::huge-null-run-text", "l": 1 }, { "c": 0.699999988079071, "d": "High function count over 200", "e": [ "binary.function_count = 441.00" ], "i": "metadata/binary/metrics::high-function-count-200", "l": 2 }, { "a": "T1027", "c": 0.8600000143051147, "d": "Long mixed-case identifiers cluster", "e": [ "ProcessIdToSessionId", "AllocateAndInitializeSid", "CheckTokenMembership", "ImpersonateLoggedOnUser", "ConvertSidToStringSidA", "AdjustTokenPrivileges", "CryptAcquireCertificatePrivateKey", "GetNativeSystemInfo", "WininetCacheCredentials", "WideCharToMultiByte", "GetWindowsDirectoryA", "GetPrivateProfileStringA", "SetCurrentDirectoryA", "GetPrivateProfileSectionNamesA", "GetPrivateProfileIntA", "GetCurrentDirectoryA" ], "i": "objectives/anti-static/obfuscation/string::long-mixedcase-identifiers", "l": 1, "m": "B0032" }, { "a": "T1057", "c": 0.8999999761581421, "d": "Create process or module snapshot", "e": [ "CreateToolhelp32Snapshot" ], "i": "micro-behaviors/process/enumerate/snapshot::create-toolhelp32-snapshot", "l": 3, "m": "E1057" }, { "a": "T1082", "c": 0.699999988079071, "d": "hwid string", "e": [ "HWID" ], "i": "objectives/discovery/system/fingerprint/machine-id::hwid-string", "l": 1 }, { "c": 1.0, "d": "Android Pictures folder", "e": [ "My Pictures" ], "i": "objectives/impact/wipe/disk/mass-delete::android-pictures", "l": 1 }, { "c": 0.8999999761581421, "d": "CreateFile API string reference", "e": [ "CreateFile", "CreateFile" ], "i": "micro-behaviors/fs/file/open::createfile-api", "l": 2 }, { "a": "T1055.001", "c": 0.949999988079071, "d": "Dynamic LoadLibraryA resolution for remote injection", "e": [ "LoadLibraryA" ], "i": "micro-behaviors/process/inject/dll::load-library-a-remote-resolution", "l": 3, "m": "F0003" }, { "c": 0.8999999761581421, "d": "NetUserEnum remote user enumeration", "e": [ "NetUserEnum" ], "i": "micro-behaviors/os/service/remote::net-user-enum-source", "l": 3 }, { "a": "T1027", "c": 0.8199999928474426, "d": "Packed loader largest section ratio above 0.65", "e": [ "binary.largest_section_ratio = 0.71" ], "i": "objectives/anti-static/obfuscation/payload/section::packed-loader-largest-section-dominates", "l": 1, "m": "B0032" }, { "a": "T1027.007", "c": 0.8999999761581421, "d": "Kernel32 DLL resolution string", "e": [ "kernel32.dll" ], "i": "micro-behaviors/os/api-resolution/manual::kernel32-resolver", "l": 1 }, { "a": "T1033", "c": 0.8999999761581421, "d": "Query current username", "e": [ "GetUserNameA" ], "i": "micro-behaviors/os/sysinfo/hostname::get-user-name", "l": 3 }, { "c": 0.8799999952316284, "d": "CLSID registry path manipulation", "e": [ "CLSID\\{11C1D741-A95B-11d2-8A80-0080ADB32FF4}" ], "i": "objectives/persistence/system/registry/com-hijack::clsid-registry-path", "l": 3 }, { "c": 0.800000011920929, "d": "GUID-formatted mutex name", "e": [ "{CB1F2C0F-8094-4AAC-BCF5-41A64E27F777}", "{9EA55529-E122-4757-BC79-E4825F80732C}", "{11C1D741-A95B-11d2-8A80-0080ADB32FF4}", "{F9043C88-F6F2-101A-A3C9-08002B2F49FB}", "{74FF1730-B1F2-4D88-926B-1568FAE61DB7}" ], "i": "micro-behaviors/process/sync/mutex::guid-mutex", "l": 2, "m": "C0042" }, { "c": 0.800000011920929, "d": "Binary lacks resource section entirely", "e": [ "binary.rsrc_to_file_ratio = 0.00" ], "i": "metadata/binary/resource::no-resources", "l": 2 }, { "c": 1.0, "d": "Binary is not digitally signed", "e": [ "binary.has_signature = 0.00" ], "i": "metadata/signed::unsigned", "l": 2 }, { "a": "T1555.003", "c": 0.949999988079071, "d": "Firefox moz_logins SQL query", "e": [ "SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins" ], "i": "objectives/credential-access/browser/firefox::moz-logins-sql", "l": 4, "m": "B0028" }, { "c": 0.949999988079071, "d": "links userenv.dll (LoadUserProfileA, UnloadUserProfile)", "e": [ "userenv.dll" ], "i": "metadata/dylib::userenv/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links advapi32.dll (RegOpenKeyExA, RegQueryValueExA, RegCloseKey, RegOpenKeyA, RegEnumKeyExA, ... +6 more)", "e": [ "advapi32.dll" ], "i": "metadata/dylib::advapi32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shlwapi.dll (StrStrIA, StrRChrIA, StrToIntA, StrStrA, StrCmpNIA, ... +1 more)", "e": [ "shlwapi.dll" ], "i": "metadata/dylib::shlwapi/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links user32.dll (wsprintfA)", "e": [ "user32.dll" ], "i": "metadata/dylib::user32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links KERNEL32.DLL (CreateFileA, ReadFile, CloseHandle, WriteFile, lstrlenA, ... +47 more)", "e": [ "KERNEL32.DLL" ], "i": "metadata/dylib::kernel32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links shell32.dll (ShellExecuteA)", "e": [ "shell32.dll" ], "i": "metadata/dylib::shell32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links wininet.dll (InternetCrackUrlA, InternetCreateUrlA)", "e": [ "wininet.dll" ], "i": "metadata/dylib::wininet/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links ole32.dll (CreateStreamOnHGlobal, GetHGlobalFromStream, CoCreateGuid, CoTaskMemFree, CoCreateInstance, ... +1 more)", "e": [ "ole32.dll" ], "i": "metadata/dylib::ole32/dll", "l": 2 }, { "c": 0.949999988079071, "d": "links wsock32.dll (inet_addr, gethostbyname, socket, connect, closesocket, ... +5 more)", "e": [ "wsock32.dll" ], "i": "metadata/dylib::wsock32/dll", "l": 2 }, { "c": 0.9200000166893005, "d": "Directory walker using Win32 find APIs", "e": [ "FindNextFileA", "FindFirstFileA", "FindClose" ], "i": "micro-behaviors/fs/enumerate/directory::find-file-walker", "l": 2 }, { "a": "T1555", "c": 0.949999988079071, "d": "FileZilla credential stealer detected", "e": [ "\\filezilla.xml", "\\recentservers.xml", "Software\\FileZilla", "\\sitemanager.xml", "Software\\FileZilla Client" ], "i": "objectives/credential-access/ftp/filezilla::filezilla-stealer", "l": 4 }, { "c": 0.9200000166893005, "d": "Winsock client symbol lifecycle", "e": [ "socket", "send", "recv", "connect" ], "i": "micro-behaviors/communications/socket/init::winsock-client-symbol-lifecycle", "l": 3 }, { "a": "T1027.009", "c": 0.800000011920929, "d": "File self-reading import chain", "e": [ "CreateFileA", "ReadFile", "GetFileSize", "GetModuleFileNameA" ], "i": "objectives/anti-static/obfuscation/payload/self-read::self-read-file-import-chain", "l": 1, "m": "B0032" }, { "c": 0.8500000238418579, "d": "Drop and execute file from Temp directory", "e": [ "ShellExecuteA", "GetTempPathA", "WriteFile" ], "i": "objectives/command-and-control/dropper/staging::temp-file-execution", "l": 2 }, { "c": 0.9200000166893005, "d": "Dynamically resolve own modules and exports", "e": [ "GetModuleHandleA", "GetProcAddress" ], "i": "micro-behaviors/os/module/load::dynamic-self-resolution-imports", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key and value write chain", "e": [ "RegOpenKeyA", "RegOpenKeyExA", "RegSetValueExA", "RegCreateKeyA" ], "i": "micro-behaviors/os/registry/access::registry-write-api-chain", "l": 2 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key open and query chain", "e": [ "RegOpenKeyA", "RegQueryValueExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-read-api-chain", "l": 2 }, { "a": "T1070.004", "c": 0.8199999928474426, "d": "Resolve own path then delete file", "e": [ "GetModuleFileNameA", "DeleteFileA", "DeleteFileA", "sub.KERNEL32.DLL_GetModuleFileNameA" ], "i": "objectives/evasion/self-delete/file::module-path-delete", "l": 1, "m": "F0007" }, { "a": "T1057", "c": 0.8999999761581421, "d": "ToolHelp snapshot enumeration with process access", "e": [ "CreateToolhelp32Snapshot", "OpenProcess" ], "i": "objectives/discovery/process/targeting::toolhelp-enumeration-with-access", "l": 3, "m": "E1057" }, { "a": "T1112", "c": 0.9200000166893005, "d": "Registry open create and write APIs", "e": [ "RegSetValueExA", "RegOpenKeyA", "RegOpenKeyExA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/manipulate::registry-write-api-chain", "l": 3 }, { "a": "T1112", "c": 0.8999999761581421, "d": "Registry key enumeration API chain", "e": [ "RegOpenKeyA", "RegEnumKeyExA", "RegEnumValueA", "RegOpenKeyExA" ], "i": "micro-behaviors/os/registry/access::registry-enumeration-api-chain", "l": 3 }, { "c": 0.8999999761581421, "d": "High-trust tool delivered via low-integrity packaging", "e": [ "binary.has_overlay = 1.00" ], "i": "objectives/supply-chain/trojanized/application/monitor::low-integrity-installer-packaging", "l": 1 }, { "c": 0.8999999761581421, "d": "Trojanized system utility or hardware monitor dropper", "e": [ "binary.has_overlay = 1.00", "filezilla", "WinRAR", "PuTTY", "FileZilla" ], "i": "objectives/supply-chain/trojanized/application/monitor::trojanized-system-utility-dropper", "l": 4 } ], "sha": "affb6507386ffe1791a085e96a211078c1b1331c2e7fcbe4b9ecd151eb02643c", "path": "507081!!embedded:pe@0x1d49a0", "type": "pe" } ], "tv": "2a0fe" } }