Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	SCP SSH
Tags	SSH SCP Superuser Operation Download File Download and Allow Execution Successful SSH Login Download and Execute
Associated Attack Servers	accessv.com alter.net amazonaws.com aniar.ie az1am5.shop bbtec.net bezeqint.net bta.net.cn comcast.net csn.net cultimording.org.uk dns.google fetnet.net inet.co.th innovatelekom.com ip-54-38-175.eu kagoya.net Majordomo.ru mdh.se ocn.ne.jp orangero.net pikara.ne.jp pre-print.rs qwest.net seatelecom.com.br sileman.net.pl smartone.com telefonica.de telstra.net tenet.edu 1.1.1.1 1.15.13.216 1.116.42.111 1.116.153.164 2.119.26.82 2.142.36.154 2.200.93.64 3.91.21.110 4.20.73.80 4.34.57.102 4.51.186.75 4.102.137.253 5.1.111.106 5.118.102.222 5.188.79.92 6.100.137.180 7.85.186.158 8.8.8.8 8.206.172.95 11.22.102.152 11.238.171.118 11.248.239.95 12.23.46.220 12.33.147.123 12.53.165.34 12.243.237.221 13.30.106.129 13.40.17.168 13.55.242.19 13.67.56.211

Basic Information

IP Address	43.242.247.139
Domain	-
ISP	Micronova Network Solutions Pvt.
Country	India
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-01-30
Last seen in Akamai Guardicore Segmentation	2024-07-24

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List	Successful SSH Login
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 2 times	Successful SSH Login
A possibly malicious Superuser Operation was detected 18 times	Superuser Operation
Process /dev/shm/apache2 scanned port 1234 on 40 IP Addresses 2 times	Port 1234 Scan
Process /tmp/ifconfig scanned port 1234 on 40 IP Addresses 2 times	Port 1234 Scan
Process /root/apache2 scanned port 1234 on 40 IP Addresses	Port 1234 Scan
Process /root/ifconfig scanned port 1234 on 40 IP Addresses	Port 1234 Scan
Process /var/tmp/ifconfig scanned port 1234 on 40 IP Addresses 2 times	Port 1234 Scan
Process /root/apache2 scanned port 1234 on 40 IP Addresses	Port 1234 Scan
Process /dev/shm/apache2 started listening on ports: 1234, 8080 and 8188	Listening
Process /dev/shm/apache2 generated outgoing network traffic to: 101.35.198.225:1234, 118.218.209.149:1234, 118.41.204.72:1234, 162.19.210.221:1234, 173.18.35.41:1234, 178.140.136.178:1234, 195.87.73.208:1234, 217.85.239.81:1234, 44.202.10.176:1234, 51.75.146.174:443, 85.53.55.133:1234 and 89.212.123.191:1234	Outgoing Connection
/dev/shm/ifconfig was downloaded	Download File
Process /dev/shm/apache2 generated outgoing network traffic to: 120.224.143.251:1234, 120.236.79.182:1234, 129.154.55.234:1234, 172.64.200.11:443, 172.64.201.11:443, 173.18.35.41:1234, 178.140.136.178:1234, 187.6.3.3:1234, 217.85.239.81:1234, 85.105.82.39:1234, 85.51.217.156:1234 and 89.121.228.38:1234	Outgoing Connection
Process /dev/shm/apache2 started listening on ports: 1234, 8082 and 8182	Listening
The file /tmp/ifconfig was downloaded and executed 3 times	Download and Execute
The file /tmp/ifconfig was downloaded and executed 5 times	Download and Execute
Process /tmp/ifconfig generated outgoing network traffic to: 169.254.85.1:1234, 172.64.200.11:443, 172.64.201.11:443, 223.223.200.243:1234, 66.70.154.59:1234, 82.66.109.74:1234 and 85.51.24.68:1234	Outgoing Connection
Process /tmp/ifconfig started listening on ports: 1234, 8089 and 8189	Listening
The file /tmp/apache2 was downloaded and executed 18 times	Download and Execute
The file /tmp/apache2 was downloaded and executed 126 times	Download and Execute
Process /tmp/ifconfig generated outgoing network traffic to: 172.64.200.11:443, 172.64.201.11:443, 182.92.162.51:1234, 195.87.73.208:1234, 223.223.200.243:1234 and 40.87.11.253:1234	Outgoing Connection
Process /tmp/ifconfig started listening on ports: 1234, 8081 and 8183	Listening
./ifconfig was downloaded 2 times	Download File
The file /root/ifconfig was downloaded and executed 11 times	Download and Execute
The file /root/apache2 was downloaded and executed 82 times	Download and Execute
Process /root/apache2 started listening on ports: 1234, 8083 and 8189	Listening
Process /root/apache2 generated outgoing network traffic to: 101.35.232.15:1234, 85.105.82.39:1234 and 89.121.228.38:1234
The file /root/apache2 was downloaded and executed 222 times	Download and Execute
Process /root/ifconfig generated outgoing network traffic to: 117.16.44.111:1234, 118.218.209.149:1234, 120.224.143.251:1234, 120.236.79.182:1234, 120.31.133.162:1234, 143.198.133.234:1234, 144.22.191.115:1234, 169.254.85.1:1234, 172.64.200.11:443, 172.64.201.11:443, 182.92.162.51:1234, 62.195.2.68:1234 and 85.105.82.39:1234	Outgoing Connection
Process /root/ifconfig started listening on ports: 1234, 8087 and 8183	Listening
The file /var/tmp/ifconfig was downloaded and executed 10 times	Download and Execute
The file /var/tmp/apache2 was downloaded and executed 125 times	Download and Execute
Process /var/tmp/ifconfig started listening on ports: 1234, 8088 and 8188	Listening
Process /var/tmp/ifconfig generated outgoing network traffic to: 102.141.225.244:1234, 103.105.12.48:1234, 120.31.133.162:1234, 121.199.57.14:1234, 139.59.135.142:1234, 142.250.191.196:443, 148.71.35.230:1234, 209.216.177.158:1234, 78.187.13.206:1234 and 85.51.24.68:1234
The file /var/tmp/apache2 was downloaded and executed 96 times	Download and Execute
Process /var/tmp/ifconfig generated outgoing network traffic to: 172.64.200.11:443	Outgoing Connection
Process /var/tmp/ifconfig started listening on ports: 1234, 8089 and 8189	Listening
The file /root/ifconfig was downloaded and executed 5 times	Download and Execute
Process /root/apache2 started listening on ports: 1234, 8081 and 8188	Listening
Process /root/apache2 generated outgoing network traffic to: 82.64.113.245:1234 and 82.66.109.74:1234
Connection was closed due to timeout

Associated Files

/tmp/ifconfig	SHA256: 0ba8b5dfd64996248790864d1603b6c2b34d7996629d032a8f4209a3e881b378	1966080 bytes
/var/tmp/ifconfig	SHA256: 163397562c5c280da8200df790dc2959025b5f933847b60ac0a3a175ea5531ec	3109940 bytes
/var/tmp/ifconfig	SHA256: 3b9707d2b3c510499a866fe655f57f05eba1eb55566b03979602e5b9d6616a05	655360 bytes
/var/tmp/ifconfig	SHA256: 550307921085269ac7b53b3492fbffd8dc7bb9deaee1b26d433b3ebb40282384	2195456 bytes
/var/tmp/ifconfig	SHA256: 6ee5b0eadb32669e495a5d4157119d3a8248235f0b3e21084070fb6bb45ca89e	950272 bytes
/var/tmp/ifconfig	SHA256: 861921d16b4f8870dda3d79aecaa828b713b8e41b29ec977aca10c236356144e	1507328 bytes
/var/tmp/ifconfig	SHA256: 93b5387c1ad89b1bba7a1c7ad722d5406dd174e58cd0a1de5a0684e02a83fd33	1474560 bytes
/etc/ifconfig	SHA256: 9516639b92dfb73072de6c5220e3ee130547680b8870c9288eccd928de847e35	2883584 bytes

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files