Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 180.93.32.58Malicious

IP Address: 180.93.32.58Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH SCP

Tags

Port 1234 Scan SSH Listening SCP Port 80 Scan Outgoing Connection Superuser Operation Download and Allow Execution Successful SSH Login Download and Execute Download File 13 Shell Commands

Associated Attack Servers

asahi-net.or.jp passionatelycurious.com

161.70.98.32 148.170.94.65 119.150.54.110 103.90.177.102 103.152.118.20 120.224.34.31 124.223.14.100 72.23.47.249 95.154.21.210 206.189.25.255 125.160.115.47 143.110.250.60 222.121.63.87 172.64.111.32 172.64.110.32 220.243.148.80 128.8.238.185 209.216.177.238 218.23.236.23 152.242.43.89 172.64.200.11 123.132.238.210 120.236.78.194 147.182.233.56 125.161.27.96 209.216.177.158 128.199.126.179 142.44.160.173 23.33.22.18

Basic Information

IP Address

180.93.32.58

Domain

-

ISP

Saigon Postel Corporation

Country

Viet Nam

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-08-06

Last seen in Akamai Guardicore Segmentation

2023-04-11

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 4 times

Successful SSH Login

A possibly malicious Superuser Operation was detected 4 times

Superuser Operation

The file /etc/ifconfig was downloaded and executed 6 times

Download and Execute

Process /etc/apache2 scanned port 1234 on 19 IP Addresses

Port 1234 Scan Port 80 Scan

Process /etc/apache2 scanned port 1234 on 62 IP Addresses

Port 1234 Scan Port 80 Scan

Process /etc/apache2 scanned port 80 on 19 IP Addresses

Port 1234 Scan Port 80 Scan

Process /usr/sbin/sshd scanned port 1234 on 19 IP Addresses

Port 1234 Scan

Process /bin/bash scanned port 1234 on 19 IP Addresses

Port 1234 Scan

Process /dev/shm/apache2 scanned port 1234 on 19 IP Addresses

Port 1234 Scan Port 80 Scan

Process /dev/shm/apache2 scanned port 1234 on 62 IP Addresses

Port 1234 Scan Port 80 Scan

Process /dev/shm/apache2 scanned port 80 on 19 IP Addresses

Port 1234 Scan Port 80 Scan

Process /bin/nc.openbsd scanned port 1234 on 19 IP Addresses

Port 1234 Scan

The file /etc/apache2 was downloaded and executed 8 times

Download and Execute

Process /etc/apache2 generated outgoing network traffic to: 100.234.219.194:80, 103.152.118.20:1234, 104.18.135.241:80, 109.148.39.143:80, 118.69.180.63:80, 124.223.14.100:1234, 136.41.227.5:80, 137.233.250.207:80, 156.8.173.30:80, 171.135.120.201:80, 176.163.183.7:80, 185.167.97.176:80, 185.210.144.122:1234, 19.172.54.158:80, 190.12.120.30:1234, 20.143.159.167:80, 202.61.203.229:1234, 203.10.209.133:80, 206.110.205.34:80, 210.216.226.231:80, 211.235.71.219:80, 215.27.86.168:80, 22.10.168.186:80, 220.51.186.10:80, 222.134.240.91:1234, 25.132.237.179:80, 251.128.75.40:80, 29.152.218.46:80, 32.141.214.102:80, 51.104.247.19:80, 53.202.195.214:80, 57.195.155.104:80, 6.221.56.46:80, 69.242.104.242:80, 82.149.112.170:1234, 84.204.148.99:1234, 86.134.107.241:80, 95.93.94.200:80 and 96.76.69.176:80

Process /etc/apache2 started listening on ports: 1234, 8087 and 8185

Listening

/dev/shm/ifconfig was downloaded

Download File

Process /etc/apache2 scanned port 80 on 62 IP Addresses

Port 1234 Scan Port 80 Scan

Process /dev/shm/apache2 scanned port 80 on 62 IP Addresses

Port 1234 Scan Port 80 Scan

Process /dev/shm/apache2 generated outgoing network traffic to: 103.132.235.32:80, 104.21.25.86:443, 109.48.69.218:80, 117.16.44.111:1234, 123.132.238.210:1234, 126.219.135.146:80, 131.43.7.164:80, 136.203.203.53:80, 145.225.93.11:80, 153.122.216.93:80, 159.9.186.44:80, 172.114.206.183:80, 172.67.133.228:443, 185.217.27.94:80, 186.182.115.113:80, 190.179.225.38:80, 190.60.239.44:1234, 198.81.180.95:80, 2.141.217.59:80, 2.177.3.58:80, 209.216.177.158:1234, 211.138.244.95:80, 211.92.237.150:80, 212.57.36.20:1234, 215.122.213.42:80, 217.68.245.10:80, 219.177.150.28:80, 222.121.63.87:1234, 24.31.5.134:80, 243.243.37.169:80, 252.35.84.111:80, 3.180.125.38:80, 39.175.68.100:1234, 41.242.143.108:80, 49.31.85.16:80, 50.106.169.107:80, 59.192.108.114:80, 62.44.237.201:80, 69.91.89.199:80, 86.133.233.66:1234, 93.176.229.145:1234 and 98.29.58.229:80

Outgoing Connection

Process /dev/shm/apache2 started listening on ports: 1234, 8086 and 8180

Listening

/tmp/ifconfig was downloaded

Download File

./ifconfig was downloaded

Download File

/var/tmp/ifconfig was downloaded

Download File

/root/ifconfig was downloaded

Download File

/etc/ifconfig was downloaded

Download File

Connection was closed due to timeout

Associated Files

/etc/ifconfig

SHA256: 2fd96aa6470f930f543ef665fcc62ffa4dfe6646b8f506c11b452a191800285b

2392064 bytes

/var/tmp/ifconfig

SHA256: 8a53c1d12942d21d2876a4b8d1eeed8a33a4a9d9f6d1ff3474980278e76a7cc9

1310720 bytes

/var/tmp/ifconfig

SHA256: fb6a5675b73aac01d91810ac511251778c4fe50ce51470a0cf5e8f909472b474

327680 bytes

/tmp/ifconfig

SHA256: 60cc0b454c5174dc5ec389859f0890a7ac0733c005f894083585a4274b71de5b

2719744 bytes

/etc/ifconfig

SHA256: 003fc3b1c6259d744b011cde32a47e8cb0b00708ebec1465839b9c14279bc70b

262144 bytes

/root/ifconfig

SHA256: f28c1becc58c6ae5d449da0b0f68f4def9db80ba792ab4486a7177e0ecd62b74

851968 bytes

/tmp/ifconfig

SHA256: fd3e94ee9b2ea054ed39b97f94f6542e9ce2c2bfbaf1be0c7a8412303ed15e39

2293760 bytes

/tmp/ifconfig

SHA256: 915f410de5799b81704f3695d8aa38d5da78b01b60cea17d3e0c3f162f9b0e9b

1802240 bytes

/etc/ifconfig

SHA256: 63ce5e408bc30df5efb4e48cb2e893e84b58da0ea31d834ce11db915f0dfaba2

32768 bytes

/var/tmp/ifconfig

SHA256: b33bbdefc7d571e92a857b05db1fe718d964b55ec882786d8134442e3bb18f96

622592 bytes

/etc/ifconfig

SHA256: 331f1ead3df8fed58ccf68da781f34b2f228a5c37f3bb245b836a4b49b1cf269

557056 bytes

/root/ifconfig

SHA256: 861921d16b4f8870dda3d79aecaa828b713b8e41b29ec977aca10c236356144e

1507328 bytes

/var/tmp/ifconfig

SHA256: b2712bdabd192560eb201c14818ff1368c742242fee50fb164ef9f84142462fc

2031616 bytes

/etc/ifconfig

SHA256: 9516639b92dfb73072de6c5220e3ee130547680b8870c9288eccd928de847e35

2883584 bytes

/etc/ifconfig

SHA256: f87647e01cba748d538eb5b447eacab7e9be78844c61e91abdd8a88a0e87fbb3

98304 bytes

/var/tmp/ifconfig

SHA256: 9f26c9e5240ac92baa25aadfd4f23dcb35723982204e00da5cbfb5cb88bf56af

1867776 bytes

/root/ifconfig

SHA256: 1b40245f21f1cb845b7fdf2428315166a8b1d8d5e1e42cd290cd8e479ed61ad7

2129920 bytes

/etc/ifconfig

SHA256: c04b32a7c24533bc14fdd18b6cff3756d284640b23569d19c8e268ece7666b43

1540096 bytes

/var/tmp/ifconfig

SHA256: 376f8f665f43984bf5aa16524421600b638fc1a7b331e8ac78b60a387fcf8dbb

2621440 bytes

/var/tmp/ifconfig

SHA256: e1dadd87aa59540122cfd42148c70236d72b8cccf5845aa3a341f38e80c3fc67

294912 bytes