{"ip":"69.158.85.56","data_as_of":"2026-10-26T21:47:56+00:00","observed":true,"total_events":0,"verdict":{"verdict":"malicious","label":"Exploit attempts observed","detail":"1 interactive session(s) ran commands after logging in","confidence":"high","network_type":"network service provider","why":["1 interactive session(s) logged in and ran commands.","The interactive sensors answer as a real service and record what the client did once inside, so this is activity after access.","Not in any known-scanner range."],"engagement":{"level":"request","label":"Request traffic","detail":"589 bytes sent","bytes_sent":589,"session_seconds":6,"persistent":false},"basis":"interactive"},"first_seen":"2026-10-24T11:19:48","last_seen":"2026-10-24T11:19:57","events_24h":0,"events_7d":0,"interactive_sessions":2,"interactive_sessions_24h":0,"interactive_sessions_7d":2,"interactive_protocols":[{"protocol":"ssh","sessions":2}],"geo":{"country_code":"CA","country_name":"Canada","region":"","city":"","lat":null,"lon":null,"asn":577,"org":"Bell Canada"},"source_domain":"bras-base-ltvlpq0412w-grc-28-69-158-85-56.dsl.bell.ca","known_scanners":[],"scanner_tag":{"key":"peeringdb:as577","label":"Bell Canada Backbone","category":"isp","url":"https://www.peeringdb.com/asn/577"},"cve_matches":[],"malware":[],"udp":null,"interaction":{"window_days":90,"sessions":2,"first_seen":"2026-10-24T11:19:48","last_seen":"2026-10-24T11:19:57","verdicts":[{"verdict":"scan","sessions":1},{"verdict":"post-exploitation","sessions":1}],"personas":[{"persona":"linux-ubuntu@24.04","sessions":2}],"services":[{"protocol":"ssh","port":2222,"sessions":2}],"logins":[{"username":"root","password":"123456","password_sent":true,"service":"ssh-password","outcome":"success","tries":1,"last_seen":"2026-10-24T11:19:51"}],"commands":[{"ts":"2026-10-24T11:19:57","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sleep 2","exit_code":0},{"ts":"2026-10-24T11:19:57","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"/usr/.work/work64 root 123456","exit_code":127},{"ts":"2026-10-24T11:19:57","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x /usr/.work/work64","exit_code":1},{"ts":"2026-10-24T11:19:56","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"sleep 2","exit_code":0},{"ts":"2026-10-24T11:19:56","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"/usr/.work/work32 root 123456","exit_code":126},{"ts":"2026-10-24T11:19:56","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"chmod +x /usr/.work/work32","exit_code":0},{"ts":"2026-10-24T11:19:55","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:55","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:54","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:54","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:54","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:53","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:53","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:53","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:53","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:52","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"scp -t /usr/.work/","exit_code":1},{"ts":"2026-10-24T11:19:52","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"mkdir /usr/.work","exit_code":0},{"ts":"2026-10-24T11:19:52","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"uname -m","exit_code":0},{"ts":"2026-10-24T11:19:51","session_id":"79606673-1112-468d-b29d-4ea43f911447","protocol":"ssh","persona":"linux-ubuntu@24.04","command":"echo -e \"\\x6F\\x6B\"","exit_code":0}],"downloads":[],"files":[{"sha256":"3916f4e6372384f91daa823a7b75eb33551922a9926441512ee7fa2e1afed3d7","name":"zVCTBzUk","size":188416,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:56","last_seen":"2026-10-24T11:19:56","virustotal":{"sha256":"3916f4e6372384f91daa823a7b75eb33551922a9926441512ee7fa2e1afed3d7","status":"known","malicious":7,"total":70,"name":"zVCTBzUk"}},{"sha256":"7f28b2791ad94a202eea5e4c91d47cdeadca4723723427af574519f8aedbf15e","name":"work32","size":4379004,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:55","last_seen":"2026-10-24T11:19:55","virustotal":{"sha256":"7f28b2791ad94a202eea5e4c91d47cdeadca4723723427af574519f8aedbf15e","status":"known","malicious":35,"total":74,"name":"malware-sample"}},{"sha256":"cc91efc54886674a31c9fd379f7326c9a8084bfc7dcf43da725342a01ca8a7ca","name":"tJWX181s","size":1867776,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:54","last_seen":"2026-10-24T11:19:54","virustotal":{"sha256":"cc91efc54886674a31c9fd379f7326c9a8084bfc7dcf43da725342a01ca8a7ca","status":"known","malicious":26,"total":78,"name":"tJWX181s"}},{"sha256":"39798a41678dc00b45c9bea3778a9cd4d529b8a877f952bd69336eafdce16327","name":"p6dSyumK","size":1552384,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:54","last_seen":"2026-10-24T11:19:54","virustotal":{"sha256":"39798a41678dc00b45c9bea3778a9cd4d529b8a877f952bd69336eafdce16327","status":"known","malicious":23,"total":76,"name":"p6dSyumK"}},{"sha256":"8fc05d6c32c66e847e14894945f947c0a318bfa75d72af0731eb28308b29865a","name":"oyhkI7gp","size":2019328,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:54","last_seen":"2026-10-24T11:19:54","virustotal":{"sha256":"8fc05d6c32c66e847e14894945f947c0a318bfa75d72af0731eb28308b29865a","status":"known","malicious":26,"total":75,"name":"oyhkI7gp"}},{"sha256":"3187af6cf545a8ded3251531dae5077b23c6bdb5f1d435a0f64944fca403f299","name":"mDE7ysCh","size":2768896,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:54","last_seen":"2026-10-24T11:19:54","virustotal":{"sha256":"3187af6cf545a8ded3251531dae5077b23c6bdb5f1d435a0f64944fca403f299","status":"known","malicious":25,"total":76,"name":"mDE7ysCh"}},{"sha256":"80e09370432754fe85e778d68fc395e03e60d845dd37bc8aac870d7baa74f966","name":"X8AI81OF","size":4096,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:53","last_seen":"2026-10-24T11:19:53","virustotal":{"sha256":"80e09370432754fe85e778d68fc395e03e60d845dd37bc8aac870d7baa74f966","status":"known","malicious":19,"total":76,"name":"X8AI81OF"}},{"sha256":"0ccb11a97216aba6e441ce23fb8b45526b8d7d6a1a7bd47278b2a9c94c56f3c5","name":"VNDme49T","size":393216,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:53","last_seen":"2026-10-24T11:19:53","virustotal":null},{"sha256":"f2edc22e1de3399ea7737491d5c6b63eb61e9e6bd7acbdd61c8567b15a794ab9","name":"RVBlnpJy","size":1466368,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:53","last_seen":"2026-10-24T11:19:53","virustotal":{"sha256":"f2edc22e1de3399ea7737491d5c6b63eb61e9e6bd7acbdd61c8567b15a794ab9","status":"known","malicious":24,"total":75,"name":"RVBlnpJy"}},{"sha256":"1df82fac857c062151fd5e3456f383c4e61d42fced8138e908c1c90e6b04b84a","name":"ELJwLYLC","size":2314240,"mime_type":"application/x-executable","kind":"sample","times":1,"first_seen":"2026-10-24T11:19:52","last_seen":"2026-10-24T11:19:52","virustotal":{"sha256":"1df82fac857c062151fd5e3456f383c4e61d42fced8138e908c1c90e6b04b84a","status":"known","malicious":26,"total":78,"name":"ELJwLYLC"}}],"attack":[{"technique_id":"T1595","technique_name":"Active Scanning","tactic_id":"TA0043","tactic_name":"Reconnaissance","sessions":1},{"technique_id":"T1078","technique_name":"Valid Accounts","tactic_id":"TA0001","tactic_name":"Initial Access","sessions":1},{"technique_id":"T1059.004","technique_name":"Command and Scripting Interpreter: Unix Shell","tactic_id":"TA0002","tactic_name":"Execution","sessions":1},{"technique_id":"T1110","technique_name":"Brute Force","tactic_id":"TA0006","tactic_name":"Credential Access","sessions":1}]},"top_ports":[{"port":2222,"proto":"tcp","label":"SSH-alt","count":0,"sessions":2}],"fingerprints":{"ssh_hassh":["01ca35584ad5a1b66cf6a9846b5b2821"],"tls_ja4":[],"tls_client_hello":"","tls_ja3":[],"http_akin":[],"interactive":{"ssh_hassh":["01ca35584ad5a1b66cf6a9846b5b2821"],"tls_ja4":[],"tls_ja3":[]}},"fingerprint_peers":{"01ca35584ad5a1b66cf6a9846b5b2821":0},"akin_families":{},"user_agents":[],"timeline":[{"date":"2026-10-24","count":0,"sessions":2}],"recent_events":[{"timestamp":"2026-10-24T11:19:57","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sleep 2","payload_hex":"736c6565702032","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-87","seq":87,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aeb22b5620847955","strings":["sleep 2"]},"interactive":true},{"timestamp":"2026-10-24T11:19:57","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/usr/.work/work64 root 123456","payload_hex":"2f7573722f2e776f726b2f776f726b363420726f6f7420313233343536","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-85","seq":85,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"f248562ebc5eb36c","strings":["/usr/.work/work64 root 123456"],"iocs":{"paths":["/usr/.work/work64"]}},"interactive":true},{"timestamp":"2026-10-24T11:19:57","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /usr/.work/work64","payload_hex":"63686d6f64202b78202f7573722f2e776f726b2f776f726b3634","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-83","seq":83,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"e3e3f0610ed6d563","strings":["chmod +x /usr/.work/work64"],"iocs":{"paths":["/usr/.work/work64"]}},"interactive":true},{"timestamp":"2026-10-24T11:19:56","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"sleep 2","payload_hex":"736c6565702032","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-81","seq":81,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"aeb22b5620847955","strings":["sleep 2"]},"interactive":true},{"timestamp":"2026-10-24T11:19:56","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"/usr/.work/work32 root 123456","payload_hex":"2f7573722f2e776f726b2f776f726b333220726f6f7420313233343536","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-79","seq":79,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"d38ab914e4e38f24","strings":["/usr/.work/work32 root 123456"],"iocs":{"paths":["/usr/.work/work32"]}},"interactive":true},{"timestamp":"2026-10-24T11:19:56","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"chmod +x /usr/.work/work32","payload_hex":"63686d6f64202b78202f7573722f2e776f726b2f776f726b3332","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-77","seq":77,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"9a2daf4e6c7a397c","strings":["chmod +x /usr/.work/work32"],"iocs":{"paths":["/usr/.work/work32"]}},"interactive":true},{"timestamp":"2026-10-24T11:19:56","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000","payload_hex":"00","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-75","seq":75,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true},{"timestamp":"2026-10-24T11:19:56","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"C0644 188416 zVCTBzUk","payload_hex":"433036343420313838343136207a564354427a556b","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-72","seq":72,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"fa28754d20bb1387","strings":["C0644 188416 zVCTBzUk"]},"interactive":true},{"timestamp":"2026-10-24T11:19:55","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"scp -t /usr/.work/","payload_hex":"736370202d74202f7573722f2e776f726b2f","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-70","seq":70,"duration_ms":0,"bytes_in":0,"bytes_out":0,"enriched":{"digest":"c1c84cb398c3015f","strings":["scp -t /usr/.work/"],"iocs":{"paths":["/usr/.work"]}},"interactive":true},{"timestamp":"2026-10-24T11:19:55","port":2222,"proto":"tcp","app_proto":"ssh","app_protocol":"ssh","host":"","headers":"","body":"","sni":"","tls_cipher":"","tls_version":"","alpn":[],"url_path":"","summary":"\u0000","payload_hex":"00","method":"","user_agent":"","ja3":"","session":"79606673-1112-468d-b29d-4ea43f911447-68","seq":68,"duration_ms":0,"bytes_in":0,"bytes_out":0,"interactive":true}],"http_methods":[],"distinct_ports_total":1,"top_paths":[],"distinct_paths_total":0,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":null,"tags":[{"tag_id":"post-exploitation","tag_type":"interactive","label":"post-exploitation","title":"Ran commands after logging in","sessions":1},{"tag_id":"shell","tag_type":"interactive","label":"shell","title":"Typed shell commands","sessions":1},{"tag_id":"logins","tag_type":"interactive","label":"logins","title":"Tried logins","sessions":1}]}