{"ip":"149.40.19.138","data_as_of":"2026-10-26T21:48:14+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"2 interactive session(s) carried an exploit attempt","confidence":"high","network_type":"network service provider","why":["2 interactive session(s) carried an exploit attempt.","Under 5 sessions, so confidence is medium.","Not in any known-scanner range.","Sent 5,411,329 bytes, which is sustained payload delivery.","Held a session open for 253s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"5,411,329 bytes sent, longest session 253s","bytes_sent":5411329,"session_seconds":253,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-20T15:59:58","last_seen":"2026-10-20T16:04:20","events_24h":0,"events_7d":0,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"smb","sessions":3}],"geo":{"country_code":"BR","country_name":"Brazil","region":"","city":"","lat":null,"lon":null,"asn":28323,"org":"AYKO TECNOLOGIA LTDA"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as28323","label":"VIPRede Telecomunicações","category":"isp","url":"https://www.peeringdb.com/asn/28323"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-20T15:59:58","last_seen":"2026-10-20T16:04:20","verdicts":[{"verdict":"exploit-attempt","sessions":2},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"smb@Windows Server 2016","sessions":3}],"services":[{"protocol":"smb","port":445,"sessions":3}],"logins":[],"commands":[],"downloads":[],"files":[{"sha256":"de33091e6ae438431cdca3abaf3b675477666578f9ad3e8f0528ace258052599","name":"doublepulsar-payload.bin","size":5304320,"mime_type":"application/octet-stream","kind":"sample","times":1,"first_seen":"2026-10-20T16:04:17","last_seen":"2026-10-20T16:04:17","virustotal":null},{"sha256":"3161d4feb7191d133a1c3af90b0a80c729c1ab366b8347cf0ad185596304d333","name":"doublepulsar-payload.dll","size":5298176,"mime_type":"application/x-dosexec","kind":"sample","times":1,"first_seen":"2026-10-20T16:04:17","last_seen":"2026-10-20T16:04:17","virustotal":{"sha256":"3161d4feb7191d133a1c3af90b0a80c729c1ab366b8347cf0ad185596304d333","status":"known","malicious":56,"total":76,"name":"k1tce8e.exe"}}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1190","technique_name":"Exploit Public-Facing Application","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":2},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":2}]},"top_ports":[{"port":445,"proto":"tcp","label":"SMB","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-20","count":0,"sessions":3}],"recent_events":[{"timestamp":"2026-10-20T16:04:17","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2597","seq":2597,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:17","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2595","seq":2595,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:17","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2593","seq":2593,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:17","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2591","seq":2591,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2589","seq":2589,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2587","seq":2587,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2585","seq":2585,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2583","seq":2583,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2581","seq":2581,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true},{"timestamp":"2026-10-20T16:04:16","port":445,"proto":"tcp","app_proto":"smb","app_protocol":"smb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000\u0000\u0010N�SMB2\u0000\u0000\u0000\u0000\u0018\u0007�\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0001\b��\u0000\bB\u0000\u000f\f\u0000\u0000\u0010\u0001\u0000\u0000\u0000\u0000\u0000\u0000\u0000%�\u001a\u0000\u0000\u0000\f\u0000B\u0000\u0000\u0010N\u0000\u0001","payload_hex":"0000104eff534d4232000000001807c00000000000000000000000000108fffe000842000f0c000010010000000000000025891a0000000c00420000104e0001","method":"","user_agent":"","ja3":"","session":"c92cfc74-9889-446b-9c1a-c1255cfec686-2579","seq":2579,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"04dcf44ebb7fd9ba","strings":["SMB2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":2}]}