The Appraiser: A Loader That Checks What You're Worth — and Whether You're Watching

TI-2026-083C · The Loader's Trail, Part C Confidence: HIGH — the profiling command, the ASN-wide zero-download pattern, and the bulletproof infrastructure anchor are all directly documented from honeypot telemetry and enrichment. Classification: TLP:WHITE

Two ways to take a machine

Part B read a loader that was a shotgun. The Nexus chain fired five router-CLI escape verbs at whatever answered, tested /tmp, sprayed fourteen CPU architectures, and dropped its payload in the same breath. It did not know what it had hit and did not care; it was built to conscript the cheapest, most numerous hardware on the internet — routers and cameras — by the million, and burn through them.

This part reads the opposite instinct. On the DMZHOST bulletproof network — AS47890 (UNMANAGED LTD, GB) and its sister AS48090 — a cluster of ~19 IPs has been logging into our honeypot as root since May and running a single, identical command that does something the Nexus loader never bothers with: it appraises the machine. It asks what the box is worth, who else is on it, and — critically — whether the shell it is talking to is even real. And then, on our sensor, it drops nothing.

Where the shotgun sprays, the appraiser inspects. Same trail, opposite doctrine.

The command: an inventory, not an infection

Every successful login triggers the same ~2KB one-liner. Stripped of its fallback scaffolding, it collects a structured hardware and host report:

UNAME     : uname -s -v -n -m   (→ /bin/uname → /usr/bin/uname → busybox uname
                                  → head -1 /proc/version → grep ^ID= /etc/os-release)
ARCH      : uname -m            (→ /proc/cpuinfo: "lm"→x86_64, "CPU architecture: 8"→aarch64,
                                  ":7"→armv7l)
UPTIME    : cat /proc/uptime
CPUS      : nproc               (→ grep -c ^processor /proc/cpuinfo)
CPU_MODEL : lscpu "Model name" ; /proc/cpuinfo "model name" / "Hardware" ;
            /proc/device-tree/model
GPU       : lspci | grep -i vga ; lspci | grep -i nvidia   (+ busybox lspci fallbacks)
LAST      : last                (recent login history)
FILTER    : <shell-authenticity probe — see below>

It emits the results as labelled lines — UNAME:…, ARCH:…, CPUS:…, CPU_MODEL:…, GPU:…, LAST:…. That is not the shape of an infection step. It is the shape of a survey: a machine-readable inventory report, almost certainly beaconed back to a controller that decides what — if anything — to do next.

The layered fallbacks (five ways to get uname, four to get the GPU, busybox variants throughout) tell you the operator expects a heterogeneous fleet and wants the survey to succeed on stripped userlands too. But the fields tell you who it is surveying.

The tell is nvidia

Look at the GPU line again:

gpu_info=$( lspci | grep -i vga ; lspci | grep -i nvidia ; busybox lspci | grep -i vga ; busybox lspci | grep -i nvidia )

A loader hunting routers does not grep lspci for nvidia. Routers do not have discrete GPUs. This is a loader triaging hosts by compute value. Put the fields together — CPU model, core count (nproc), uptime, and the presence of an NVIDIA card — and the survey answers one question: what is this box worth?

In 2026 that question has two lucrative answers. A machine with a real GPU and many cores is a cryptomining prize, or a compute-theft target — someone's ML workstation, a rendering node, a cloud GPU instance left with a weak root password. A dormant single-core VPS is worth far less. The appraiser is doing target selection the Mirai shotgun never does: it wants to know whether the effort of a payload is justified before spending one.

This is the sophisticated end of conscription. The embedded shotgun takes everything and sorts later. The appraiser sorts first.

And then it checks whether you are real

The most interesting part of the command is a block it labels ===SHELL_BEHAVIOR===. It does three things, in order:

1. Runs a command that does not exist as a path — ./xxxxxx — and captures the shell's exact error (path_err=).
2. Runs a bare non-existent command — xxxxxx — and captures that error too (cmd_err=).
3. Writes a throwaway script that echoes the sentinel xxxxxx, chmod +xes it, executes it, and checks whether the sentinel actually comes back (execute_err=), with bash → /bin/bash → /usr/bin/bash → busybox sh fallbacks.

This is an anti-honeypot / sandbox-authenticity probe. A real Linux shell produces specific, predictable error strings for a missing command, and it genuinely creates and runs the little script, returning xxxxxx. A simulated shell — the Cowrie-class emulators that most SSH honeypots (including the one that caught this) are built on — fakes command execution and emits generic or wrong error text. The xxxxxx sentinel is a canary: if the loader does not get its own sentinel back through a real write-chmod-execute cycle, it knows it is talking to a sensor, not a server.

The appraiser does not just ask what is this box worth? It asks is anyone watching me appraise it? And it is built to walk away if the answer is yes.

The proof it walks away: zero downloads

If the anti-honeypot logic works, we should see the profiler run constantly and the payload never land. That is exactly the record:

Two thousand one hundred and two commands, and not a single binary dropped. The cluster profiles our honeypot hundreds of times and never once commits a payload to it. Either the shell-authenticity probe fails on our emulated sensor and the loader declines, or the fingerprint is beaconed out and any real payload is delivered out-of-band to hosts that passed — we cannot see which from the honeypot alone, and we say so. But either way the conclusion holds: the loud, immediate drop of the Mirai chain is absent by design. This loader's whole discipline is not dropping where it might be caught.

It also reads last — who has recently logged in. For a conscription loader that is situational awareness: a busy, administered box will notice an intruder and get cleaned; a dormant one will not. Uptime plus login history estimates how closely the host is watched. It is of a piece with the honeypot probe — minimise the chance of being caught before committing anything.

Where it lives: a network already judged do-not-route

The appraiser's infrastructure is the clean opposite of Part B's NASK, where the abuse desk was a national CERT. Here:

• AS47890 — UNMANAGED-DEDICATED-SERVERS / UNMANAGED LTD, GB (RIPE, allocated 2020), branded DMZHOST and TECHOFF SRV LIMITED — is assessed bulletproof: Spamhaus-listed with reason ASN-DROP (the community's do-not-route verdict on the entire autonomous system), risk score 91.48, average threat 76, 15 of 16 profiled IPs CRITICAL, 18 of 19 at abuse-100.
• The IPs are GB-registered but geolocate to Romania — the registration/hosting split typical of anonymous VPS.
• The abuse contact is a free Gmail — dmzhostabuse@gmail.com — covering 16 IPs across three org labels (DMZHOST, TECHOFF SRV LIMITED, TECHOFF-MNT).
• The sister ASN AS48090 ("DMZHOST — TECHOFF SRV LIMITED, GB") runs the identical profiler from 195.178.110.217/.228/.232 (threat up to 97). One operator, two autonomous systems, three brand names, one throwaway mailbox.

That last point is the survival mechanism. A hosting operation administered through a Gmail address and rotated across ASNs and brand names is built to outlast takedowns: burn one label, route from the next. Spamhaus has already flagged the whole thing — which means remediation here is not a clean-up call to a responsive desk, it is a routing decision for anyone downstream.

Steelman: is this just a benign inventory bot?

The fair objection: system-inventory commands are not inherently malicious — monitoring agents, asset-management tools and even some legitimate scanners run uname/lscpu/lspci. Could this be a misattributed benign fingerprinter?

No, and the context refuses it. Benign inventory tools do not (1) arrive via root brute-force with guessed passwords (root:123, root:1234, root:12345), (2) run from a Spamhaus ASN-DROP bulletproof network with a Gmail abuse desk, (3) carry abuse-100 and CRITICAL threat scores across 19 coordinated IPs, or (4) embed a honeypot-detection probe to avoid being observed. A monitoring agent has credentials and has no reason to fingerprint the shell to see if it is being watched. The anti-honeypot block is the detail that settles intent: only an intruder cares whether the box is a sensor. The inventory is real; its purpose is target selection for conscription.

The trail, at both ends

The Loader's Trail now has samples from opposite ends of operator sophistication:

A "loader" is not one thing. It is a spectrum from the disposable embedded shotgun that sprays and burns to the patient server appraiser that inspects, values, and checks for watchers before it spends a single payload. The honeypot has now caught the trail at both ends — and the careful end is, in its way, the more dangerous, because it is built specifically not to be seen doing it.

Findings

1. The loader appraises compute value before it acts — including GPU detection. (HIGH) — lspci | grep nvidia + CPU model/cores = value-based target triage.
2. Anti-honeypot: it fingerprints the shell and withholds payload on suspicion. (HIGH) — the xxxxxx sentinel probe; 0 downloads across 2,102 commands.
3. [INST] A Spamhaus-DROP'd bulletproof cluster with a Gmail abuse desk. (HIGH) — AS47890 risk 91.48, GB-reg/RO-host, dmzhostabuse@gmail.com across DMZHOST/TECHOFF/AS48090.
4. The Loader's Trail is a spectrum: loud embedded shotgun vs cautious server appraiser. (MEDIUM)

Cross-references

• TI-2026-083A — The Senpai Loader · 083B — The Target Was Never a Server — the loud, embedded-target end of the trail.
• TI-2026-084B — The Watchman's Own Gate — the abuse-desk inverse: a national CERT versus a Gmail address.

The Nexus loader asked no questions; it fired every key at the lock and dropped its payload where it fell. This one asks three: what are you worth, who is watching you, and are you even real — and it answers by dropping nothing at all where it cannot be sure. The trail runs from the shotgun to the appraiser, and the appraiser is the one you never see.