{"ip":"101.201.31.157","data_as_of":"2026-10-26T21:48:07+00:00","observed":true,"total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1 event(s) from this address as well.","Not in any known-scanner range.","Held a session open for 61s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"363 bytes sent, longest session 61s","bytes_sent":363,"session_seconds":61,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-23T05:24:36","last_seen":"2026-10-25T09:33:35","events_24h":0,"events_7d":1,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"ssh","sessions":2}],"geo":{"country_code":"CN","country_name":"China","region":"Beijing","city":"Beijing","lat":39.911,"lon":116.395,"asn":37963,"org":"Hangzhou Alibaba Advertising Co.,Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as37963","label":"Alibaba (China)","category":"cdn","url":"https://www.peeringdb.com/asn/37963"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-23T05:24:36","last_seen":"2026-10-23T05:25:37","verdicts":[{"verdict":"scan","sessions":1},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":2}],"services":[{"protocol":"ssh","port":2222,"sessions":2}],"logins":[{"username":"root","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-23T05:24:36"}],"commands":[{"ts":"2026-10-23T05:25:36","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sleep 2","exit_code":0},{"ts":"2026-10-23T05:25:36","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"/usr/.work/work64 root 123456","exit_code":0},{"ts":"2026-10-23T05:25:35","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x /usr/.work/work64","exit_code":0},{"ts":"2026-10-23T05:25:35","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sleep 2","exit_code":0},{"ts":"2026-10-23T05:25:34","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"/usr/.work/work32 root 123456","exit_code":126},{"ts":"2026-10-23T05:25:34","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x /usr/.work/work32","exit_code":0},{"ts":"2026-10-23T05:25:16","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-23T05:24:44","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-23T05:24:43","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-23T05:24:42","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-23T05:24:41","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"mkdir /usr/.work","exit_code":0},{"ts":"2026-10-23T05:24:39","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-23T05:24:38","session_id":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo -e \"\\x6F\\x6B\"","exit_code":0}],"downloads":[],"files":[{"sha256":"2d2239acd852e43952bcb14fcdc7485fd804b54df241c077750f5447b55354b7","name":"work64","size":4662460,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-23T05:25:16","last_seen":"2026-10-23T05:25:16","virustotal":{"sha256":"2d2239acd852e43952bcb14fcdc7485fd804b54df241c077750f5447b55354b7","status":"known","malicious":36,"total":72,"name":"work64"}},{"sha256":"7f28b2791ad94a202eea5e4c91d47cdeadca4723723427af574519f8aedbf15e","name":"work32","size":4379004,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-23T05:24:44","last_seen":"2026-10-23T05:24:44","virustotal":{"sha256":"7f28b2791ad94a202eea5e4c91d47cdeadca4723723427af574519f8aedbf15e","status":"known","malicious":35,"total":74,"name":"malware-sample"}},{"sha256":"41f1685d04031d88891dea1cd02d5154f8aa841119001a72017b0e7158159e23","name":".bashrc","size":570,"mime_type":"text/plain","kind":"sample","times":1,"first_seen":"2026-10-23T05:24:43","last_seen":"2026-10-23T05:24:43","virustotal":{"sha256":"41f1685d04031d88891dea1cd02d5154f8aa841119001a72017b0e7158159e23","status":"known","malicious":0,"total":75,"name":".bashrc"}},{"sha256":"67a96d570be8cf5be30a1a1474550305fb780c268197126e848ddaa750622130","name":".bash_history","size":1094,"mime_type":"text/plain","kind":"sample","times":1,"first_seen":"2026-10-23T05:24:42","last_seen":"2026-10-23T05:24:42","virustotal":{"sha256":"67a96d570be8cf5be30a1a1474550305fb780c268197126e848ddaa750622130","status":"known","malicious":0,"total":74,"name":"stdin_67a96d570be8cf5b"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":2222,"proto":"tcp","label":"SSH-alt","count":1,"sessions":2}],"fingerprints":{"ssh_hassh":["01ca35584ad5a1b66cf6a9846b5b2821"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun000_00000000_334359b9"],"interactive":{"ssh_hassh":["01ca35584ad5a1b66cf6a9846b5b2821"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"01ca35584ad5a1b66cf6a9846b5b2821":0,"b11cun000_00000000_334359b9":82},"akin_families":{"b11cun000_00000000_334359b9":{"head":"b11cun000_00000000_334359b9","shapes":2,"ips":82}},"user_agents":[],"timeline":[{"date":"2026-10-23","count":0,"sessions":2},{"date":"2026-10-25","count":1,"sessions":0}],"recent_events":[{"timestamp":"2026-10-25T09:33:35","port":2222,"proto":"tcp","app_proto":"","app_protocol":"http","host":"","headers":"","body":"\n\n","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"/","summary":"","payload_hex":"474554202f20485454502f312e310d0a0d0a0a0a","method":"GET","user_agent":"","ja3":"","session":"18e884ee-a6ec-4ef2-a89c-10f63427f9e3","seq":1,"duration_ms":101,"bytes_in":20,"bytes_out":79},{"timestamp":"2026-10-23T05:25:36","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sleep 2","payload_hex":"736c6565702032","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-45","seq":45,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aeb22b5620847955","strings":["sleep 2"]},"interactive":true},{"timestamp":"2026-10-23T05:25:36","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/usr/.work/work64 root 123456","payload_hex":"2f7573722f2e776f726b2f776f726b363420726f6f7420313233343536","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-43","seq":43,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f248562ebc5eb36c","strings":["/usr/.work/work64 root 123456"],"iocs":{"paths":["/usr/.work/work64"]}},"interactive":true},{"timestamp":"2026-10-23T05:25:35","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /usr/.work/work64","payload_hex":"63686d6f64202b78202f7573722f2e776f726b2f776f726b3634","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-41","seq":41,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e3e3f0610ed6d563","strings":["chmod +x /usr/.work/work64"],"iocs":{"paths":["/usr/.work/work64"]}},"interactive":true},{"timestamp":"2026-10-23T05:25:35","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sleep 2","payload_hex":"736c6565702032","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-39","seq":39,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aeb22b5620847955","strings":["sleep 2"]},"interactive":true},{"timestamp":"2026-10-23T05:25:34","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/usr/.work/work32 root 123456","payload_hex":"2f7573722f2e776f726b2f776f726b333220726f6f7420313233343536","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-37","seq":37,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d38ab914e4e38f24","strings":["/usr/.work/work32 root 123456"],"iocs":{"paths":["/usr/.work/work32"]}},"interactive":true},{"timestamp":"2026-10-23T05:25:34","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /usr/.work/work32","payload_hex":"63686d6f64202b78202f7573722f2e776f726b2f776f726b3332","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-35","seq":35,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9a2daf4e6c7a397c","strings":["chmod +x /usr/.work/work32"],"iocs":{"paths":["/usr/.work/work32"]}},"interactive":true},{"timestamp":"2026-10-23T05:25:34","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000","payload_hex":"00","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-33","seq":33,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-23T05:25:16","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0644 4662460 work64","payload_hex":"4330363434203436363234363020776f726b3634","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-30","seq":30,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"579f2cc9e0d76f93","strings":["C0644 4662460 work64"]},"interactive":true},{"timestamp":"2026-10-23T05:25:16","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -t /usr/.work/","payload_hex":"736370202d74202f7573722f2e776f726b2f","method":"","user_agent":"","ja3":"","session":"6d5ba05b-b0eb-4cd3-8bac-90b337faf44c-28","seq":28,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c1c84cb398c3015f","strings":["scp -t /usr/.work/"],"iocs":{"paths":["/usr/.work"]}},"interactive":true}],"http_methods":[{"method":"GET","count":1}],"distinct_ports_total":1,"top_paths":[{"path":"/","count":1,"ports":1}],"distinct_paths_total":1,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}