Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 219.140.162.82Previously Malicious

IP Address: 219.140.162.82Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SCP SSH

Tags

SSH SCP Superuser Operation Download and Allow Execution Successful SSH Login Download and Execute Download File

Associated Attack Servers

bsnl.in escom.bg iforte.net.id mycingular.net n11.dev nwgsm.ru telenet.be verointernet.com.br

8.213.128.6 8.213.128.90 13.50.16.84 34.85.186.96 36.77.94.79 41.207.248.204 43.142.151.41 45.168.133.250 46.229.134.81 50.192.233.138 58.229.125.66 64.19.144.228 78.221.115.22 82.143.75.1 85.26.129.164 88.120.198.193 93.183.167.152 101.35.211.207 103.158.58.2 103.165.122.93 117.247.172.37 120.224.34.31 122.70.156.12 123.132.238.210 124.19.54.134 124.70.55.29 147.182.233.56 161.35.79.199 161.70.98.32 166.193.42.40

Basic Information

IP Address

219.140.162.82

Domain

-

ISP

China Telecom

Country

China

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-09-20

Last seen in Akamai Guardicore Segmentation

2022-10-31

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 2 times

Successful SSH Login

A possibly malicious Superuser Operation was detected 6 times

Superuser Operation

The file /root/ifconfig was downloaded and executed 5 times

Download and Execute

The file /root/apache2 was downloaded and executed 15 times

Download and Execute

Process /bin/bash scanned port 1234 on 18 IP Addresses

Port 1234 Scan

Process /root/apache2 scanned port 1234 on 18 IP Addresses

Port 1234 Scan Port 80 Scan

Process /root/apache2 scanned port 80 on 18 IP Addresses

Port 1234 Scan Port 80 Scan

Process /root/apache2 scanned port 1234 on 60 IP Addresses

Port 1234 Scan Port 80 Scan

Process /var/tmp/apache2 scanned port 1234 on 18 IP Addresses

Port 1234 Scan Port 80 Scan

Process /var/tmp/apache2 scanned port 80 on 18 IP Addresses

Port 1234 Scan Port 80 Scan

Process /var/tmp/apache2 scanned port 1234 on 60 IP Addresses

Port 1234 Scan Port 80 Scan

Process /bin/bash scanned port 1234 on 18 IP Addresses

Port 1234 Scan

Process /root/apache2 started listening on ports: 1234, 8080 and 8184

Listening

Process /root/apache2 generated outgoing network traffic to: 1.127.202.70:80, 117.42.224.63:80, 12.147.192.24:80, 120.31.133.162:1234, 141.89.55.93:80, 143.61.242.15:80, 161.70.98.32:1234, 166.184.146.14:80, 170.40.51.114:80, 172.64.130.4:443, 172.64.131.4:443, 172.93.67.2:80, 174.136.98.182:80, 190.12.120.30:1234, 209.177.235.207:80, 210.125.223.154:80, 212.57.36.20:1234, 22.108.223.169:80, 222.100.124.62:1234, 223.171.91.191:1234, 247.46.227.11:80, 250.152.212.243:80, 31.168.88.152:80, 34.253.9.70:80, 35.9.31.212:80, 39.38.225.31:80, 42.123.74.174:80, 43.196.150.134:80, 56.84.50.68:80, 76.145.88.67:80, 78.58.7.197:80, 80.147.162.151:1234, 80.86.123.59:80, 82.222.151.176:80, 86.133.233.66:1234, 9.117.107.8:80, 93.29.119.127:80, 95.154.21.210:1234 and 98.143.125.246:80

Outgoing Connection

Process /root/apache2 scanned port 80 on 60 IP Addresses

Port 1234 Scan Port 80 Scan

Process /var/tmp/apache2 scanned port 80 on 60 IP Addresses

Port 1234 Scan Port 80 Scan

The file /var/tmp/ifconfig was downloaded and executed 5 times

Download and Execute

The file /var/tmp/apache2 was downloaded and executed 171 times

Download and Execute

Process /var/tmp/apache2 generated outgoing network traffic to: 101.184.220.144:80, 103.135.164.3:80, 103.208.236.177:80, 117.54.14.169:1234, 12.162.152.208:80, 126.18.225.241:80, 13.126.102.70:80, 142.123.141.39:80, 159.103.64.85:80, 161.70.98.32:1234, 162.8.91.147:80, 165.235.241.245:80, 172.64.130.4:443, 172.64.131.4:443, 176.188.26.27:80, 185.190.72.193:80, 199.27.170.143:80, 20.141.185.205:1234, 21.35.87.61:80, 210.99.20.194:1234, 211.162.184.120:1234, 212.57.36.20:1234, 216.173.250.92:80, 222.39.160.159:80, 26.39.222.8:80, 33.199.214.83:80, 33.83.152.221:80, 34.117.58.114:80, 40.155.147.248:80, 48.135.223.98:80, 49.244.156.241:80, 51.215.79.26:80, 59.15.168.163:80, 6.39.128.91:80, 61.77.105.219:1234, 65.75.19.193:80, 70.126.60.194:80, 70.18.80.2:80, 82.149.112.170:1234, 83.86.132.135:80, 85.17.93.108:80, 86.133.233.66:1234, 89.212.123.191:1234 and 93.60.122.207:80

Outgoing Connection

Process /var/tmp/apache2 started listening on ports: 1234, 8081 and 8181

Listening

Process /usr/local/mysql/bin/mysqld started listening on ports: 3306 3 times

Listening

Process /usr/local/apache2/bin/httpd started listening on ports: 80

Listening

The file /etc/ifconfig was downloaded and executed 6 times

Download and Execute

System file /etc/apache2 was modified 4 times

System File Modification

The file /etc/apache2 was downloaded and executed 3 times

Download and Execute

Connection was closed due to timeout

Associated Files

/var/tmp/ifconfig

SHA256: 0193f02136d940c51c84d3261b192af64a94f764c0443267e73bac203113efa2

2031616 bytes

/var/tmp/ifconfig

SHA256: 088d6c58a1e3845e304fc60931337faad96017b7f2a06feda58b7937db212894

229376 bytes

/etc/ifconfig

SHA256: 0c426e266609a33b81aac058abf027370d7953263e3e459eef863decb7a36f4a

1736704 bytes

/root/ifconfig

SHA256: 377273485b83e434b5c2974a87f90951e1067d9332866d0b5f16ee0a743d744b

393216 bytes

/tmp/ifconfig

SHA256: 3920685112d42b9eb419627d6b1c44234064990e53d85f6081d7813741fcaefa

1277952 bytes

/var/tmp/ifconfig

SHA256: 4028880b6d6318bb68703ad18cbc062f79aff02897692265a16c5a1e140a3d20

3087196 bytes

/var/tmp/ifconfig

SHA256: 4a9baae88afedaad6778862d3978370374aaa0450d27e5782df032f1044995eb

3105548 bytes

/var/tmp/ifconfig

SHA256: 4b8c944e8a7c49e920661953027e503eb27905011b5d93385c46e405c8bd5234

262144 bytes

/tmp/ifconfig

SHA256: 570f5ece820b6938cbda0479aac3614eb8d089935c1ad92f5d84282d6c5d5922

163840 bytes

/tmp/ifconfig

SHA256: 87f0f15a2d523698f8d3bae83c371bf984e0714bbfdc0ac0728f2ab00db543dc

1572864 bytes

/tmp/ifconfig

SHA256: d611d356f56a0ecc2e8394aa7ccdbcef9bfee375e29b9e1d1e2ade8d9ce9ed2e

3111900 bytes

/etc/ifconfig

SHA256: f713937a1ebd43a577bf5c19bf156aa872d6c72174ab3b979c22e52aa360d546

196608 bytes

/var/tmp/ifconfig

SHA256: ffcf6ef2311bb849c32de0695cecf838240d5fe3b71e605f9d624ed083aa3d2e

1343488 bytes