9f3c1d176f3cc78bf678552ff62ede0f2249f00e97e3912752458c08bb07bb26

Analysis

max time kernel
30s
max time network
138s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260126-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260126-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
24/02/2026, 01:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
titanjr.i486.elf
Size 77KB
Sample260224-b5b8sshx8b
SHA256 9f3c1d176f3cc78bf678552ff62ede0f2249f00e97e3912752458c08bb07bb26
MD5 1ff10e96c78002eb0b92697edb647b12
SHA1 37641089b4539154aa9abab34e20397d35d949de
SHA512 9533afc61e735fedacf53fcfbc49b191d9f76e93e440218f3c0f6ee7434591ff4db09c53faaf2d81c80312d7a7dc0d1264c6bdf95d04f80ae0d4434457dce305
SSDEEP 1536:Lp9vxnA7U15vbIHfC1j83YAKoRYeyUz31Ai6I2r:LplxA7U/8HfC1YJbKO+
TLSH
T1C6737D99FB57D0F0D94205B011ABFB3A9631DD361014DE6BEB88FE36BC3264294563AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence

Malware Config

Signatures

Deletes Audit logs 1 TTPs 1 IoCs

Deletes logs related to the Linux Audit framework.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/audit/audit.log	titanjr.i486.elf

Deletes journal logs 1 TTPs 1 IoCs

Deletes systemd journal logs. Likely to evade detection.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/journal/11c67417355f45d397f6be11f62e85a6/system.journal	titanjr.i486.elf

Deletes system logs 1 TTPs 1 IoCs

Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.

defense_evasion

Clear Linux or Mac System Logs

T1070.002

description	ioc	Process
File deleted	/var/log/syslog	titanjr.i486.elf

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/init.d/sysd	titanjr.i486.elf

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

persistence

Boot or Logon Autostart Execution

T1547

RC Scripts

T1037.004

description	ioc	Process
File opened for modification	/etc/rc.local	titanjr.i486.elf

Changes its process name 3 IoCs

description	pid	Process
Changes the process name, possibly in an attempt to hide itself	1546	titanjr.i486.elf
Changes the process name, possibly in an attempt to hide itself	1546	titanjr.i486.elf
Changes the process name, possibly in an attempt to hide itself	1550	titanjr.i486.elf

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1/cmdline	titanjr.i486.elf
File opened for reading	/proc/479/cmdline	titanjr.i486.elf
File opened for reading	/proc/1546/cmdline	titanjr.i486.elf
File opened for reading	/proc/28/cmdline	titanjr.i486.elf
File opened for reading	/proc/1109/cmdline	titanjr.i486.elf
File opened for reading	/proc/1215/cmdline	titanjr.i486.elf
File opened for reading	/proc/1354/cmdline	titanjr.i486.elf
File opened for reading	/proc/724/cmdline	titanjr.i486.elf
File opened for reading	/proc/945/cmdline	titanjr.i486.elf
File opened for reading	/proc/1546/fd/0	titanjr.i486.elf
File opened for reading	/proc/8/cmdline	titanjr.i486.elf
File opened for reading	/proc/34/cmdline	titanjr.i486.elf
File opened for reading	/proc/175/cmdline	titanjr.i486.elf
File opened for reading	/proc/184/cmdline	titanjr.i486.elf
File opened for reading	/proc/213/cmdline	titanjr.i486.elf
File opened for reading	/proc/501/cmdline	titanjr.i486.elf
File opened for reading	/proc/543/cmdline	titanjr.i486.elf
File opened for reading	/proc/567/cmdline	titanjr.i486.elf
File opened for reading	/proc/737/cmdline	titanjr.i486.elf
File opened for reading	/proc/2/cmdline	titanjr.i486.elf
File opened for reading	/proc/17/cmdline	titanjr.i486.elf
File opened for reading	/proc/21/cmdline	titanjr.i486.elf
File opened for reading	/proc/498/cmdline	titanjr.i486.elf
File opened for reading	/proc/16/cmdline	titanjr.i486.elf
File opened for reading	/proc/25/cmdline	titanjr.i486.elf
File opened for reading	/proc/80/cmdline	titanjr.i486.elf
File opened for reading	/proc/179/cmdline	titanjr.i486.elf
File opened for reading	/proc/463/cmdline	titanjr.i486.elf
File opened for reading	/proc/497/cmdline	titanjr.i486.elf
File opened for reading	/proc/1011/cmdline	titanjr.i486.elf
File opened for reading	/proc/1040/cmdline	titanjr.i486.elf
File opened for reading	/proc/621/cmdline	titanjr.i486.elf
File opened for reading	/proc/687/cmdline	titanjr.i486.elf
File opened for reading	/proc/98/cmdline	titanjr.i486.elf
File opened for reading	/proc/4/cmdline	titanjr.i486.elf
File opened for reading	/proc/481/cmdline	titanjr.i486.elf
File opened for reading	/proc/970/cmdline	titanjr.i486.elf
File opened for reading	/proc/1115/cmdline	titanjr.i486.elf
File opened for reading	/proc/7/cmdline	titanjr.i486.elf
File opened for reading	/proc/29/cmdline	titanjr.i486.elf
File opened for reading	/proc/31/cmdline	titanjr.i486.elf
File opened for reading	/proc/172/cmdline	titanjr.i486.elf
File opened for reading	/proc/180/cmdline	titanjr.i486.elf
File opened for reading	/proc/182/cmdline	titanjr.i486.elf
File opened for reading	/proc/1048/cmdline	titanjr.i486.elf
File opened for reading	/proc/1090/cmdline	titanjr.i486.elf
File opened for reading	/proc/81/cmdline	titanjr.i486.elf
File opened for reading	/proc/344/cmdline	titanjr.i486.elf
File opened for reading	/proc/1079/cmdline	titanjr.i486.elf
File opened for reading	/proc/1101/cmdline	titanjr.i486.elf
File opened for reading	/proc/1289/cmdline	titanjr.i486.elf
File opened for reading	/proc/1404/cmdline	titanjr.i486.elf
File opened for reading	/proc/186/cmdline	titanjr.i486.elf
File opened for reading	/proc/490/cmdline	titanjr.i486.elf
File opened for reading	/proc/577/cmdline	titanjr.i486.elf
File opened for reading	/proc/1088/cmdline	titanjr.i486.elf
File opened for reading	/proc/1200/cmdline	titanjr.i486.elf
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/82/cmdline	titanjr.i486.elf
File opened for reading	/proc/696/cmdline	titanjr.i486.elf
File opened for reading	/proc/1071/cmdline	titanjr.i486.elf
File opened for reading	/proc/1095/cmdline	titanjr.i486.elf
File opened for reading	/proc/1096/cmdline	titanjr.i486.elf
File opened for reading	/proc/1154/cmdline	titanjr.i486.elf

/tmp/titanjr.i486.elf
/tmp/titanjr.i486.elf
1⤵
- Deletes Audit logs
- Deletes journal logs
- Deletes system logs
- Modifies init.d
- Modifies rc script
- Changes its process name
- Reads runtime system information
PID:1544
- /bin/sh
  sh -c "cp dhclient /usr/bin/.sh"
  2⤵
  PID:1547
- - /bin/cp
    cp dhclient /usr/bin/.sh
    3⤵
    - Reads runtime system information
    PID:1548