Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 206.0.168.6Malicious

IP Address: 206.0.168.6Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

MSSQL MYSQL

Tags

MSSQL File Operation By CMD Successful MSSQL Login PowerShell DNS Query Persistency - Print Monitors System File Modification Access Suspicious Domain CMD IDS - Attempted User Privilege Gain Service Configuration Outgoing Connection Execute MsSql Shell Command

Associated Attack Servers

down.ftp21.cc wmi.362-com.com

211.57.200.17

Basic Information

IP Address

206.0.168.6

Domain

-

ISP

-

Country

India

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2024-02-26

Last seen in Akamai Guardicore Segmentation

2024-02-26

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using MSSQL with the following credentials: sa / ******* - Authentication policy: Reached Max Attempts

Successful MSSQL Login

MSSQL executed 1 shell commands

Execute MsSql Shell Command

IDS detected Attempted User Privilege Gain : SQL sp_configure - configuration change

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_reg* - registry access

IDS - Attempted User Privilege Gain

IDS detected Attempted User Privilege Gain : xp_cmdshell - program execution

IDS - Attempted User Privilege Gain

System file C:\Windows\AppCompat\Programs\Amcache.hve was modified

System File Modification

c:\windows\temp\mssqlh.exe set the command line C:\Windows\Logs\RunDllExe.dll to run using Persistency - Print Monitors

Persistency - Print Monitors

Process c:\windows\system32\wscript.exe attempted to access suspicious domains: down.ftp21.cc

DNS Query Access Suspicious Domain

Process c:\windows\syswow64\svchost.exe attempted to access suspicious domains: wmi.362-com.com

DNS Query Outgoing Connection Access Suspicious Domain

Process c:\windows\syswow64\svchost.exe generated outgoing network traffic to: 211.57.200.17:53

Outgoing Connection

Connection was closed due to user inactivity

Associated Files

/usr/local/mysql/lib/plugin/LinuxUDF32.SO

SHA256: 2789f4dbbcdeb8ebff855829c734fad4e466fdd736d441e62888b8de5bc31826

5696 bytes

/usr/local/mysql/lib/plugin/zzwszv32.so

SHA256: 681c6aa7782eb7780ea4d0745ba9dfd0c20cd363e3f2976f7e76fe13984d364d

8128 bytes