Akamai Guardicore Segmentation CTI

Threat Information

Role	Attacker, Connect-Back, Scanner
Services Targeted	SSH
Tags	1 Shell Commands Download Operation Successful SSH Login Download File SSH Download and Execute Download and Allow Execution Listening Outgoing Connection HTTP Access Suspicious Domain
Associated Attack Servers	jpgup.me privatelayer.com vsys.host 31.7.58.162 45.134.174.234 79.120.70.36 85.202.169.117 194.31.98.205

Basic Information

IP Address	46.19.137.50
Domain	-
ISP	Private Layer INC
Country	-
WHOIS	Created Date	-
	Updated Date	-
	Organization	-

First seen in Akamai Guardicore Segmentation	2022-05-24
Last seen in Akamai Guardicore Segmentation	2022-06-08

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List	Successful SSH Login
A possibly malicious Download Operation was detected 2 times	Download Operation
Process /usr/bin/wget generated outgoing network traffic to: 46.19.137.50:80 2 times	Outgoing Connection
Process /usr/bin/wget attempted to access suspicious domains: privatelayer.com 2 times	Access Suspicious Domain Outgoing Connection
The file /root/sh was downloaded and granted execution privileges
The file /root/miori.mips was downloaded and granted execution privileges	Download and Allow Execution
Process /bin/bash generated outgoing network traffic to: 46.19.137.50:80	Outgoing Connection
Process /bin/bash attempted to access suspicious domains: privatelayer.com	Access Suspicious Domain Outgoing Connection
The file /root/miori.mpsl was downloaded and granted execution privileges	Download and Allow Execution
Process /usr/bin/wget generated outgoing network traffic to: 46.19.137.50:80	Outgoing Connection
Process /usr/bin/wget attempted to access suspicious domains: privatelayer.com	Access Suspicious Domain Outgoing Connection
Process /bin/bash started listening on ports: 55588	Listening
Process /root/miori.x86 generated outgoing network traffic to: 46.19.137.50:55566	Outgoing Connection
Process /root/miori.x86 attempted to access suspicious domains: privatelayer.com	Access Suspicious Domain Outgoing Connection
The file /root/miori.x86 was downloaded and executed 19 times	Download and Execute
Process /usr/bin/wget generated outgoing network traffic to: 46.19.137.50:80	Outgoing Connection
Process /usr/bin/wget attempted to access suspicious domains: privatelayer.com	Access Suspicious Domain Outgoing Connection
Process /root/miori.x86 started listening on ports: 35676 8 times	Listening
Connection was closed due to timeout

Associated Files

/tmp/miori.mips	SHA256: 16a97a7944c74fc0dda11f5593ec0f26661c8ec14d3ba08d1a950433aa68f16a	48680 bytes
/tmp/miori.mpsl	SHA256: 20088d86376536f8f3b3a2fa4ed7627a5f279328897f786c565c553170c9a805	51176 bytes
/tmp/x86_64	SHA256: 33eef0c93b605ce87d0632bd362bcd033ee5c39dfb88f1d63e33ab27ea7e1179	54528 bytes
/tmp/mips	SHA256: 3a7ce8c173b7b75ddf1f96802b03b4fd05dae8ba305e0ddc2ba3a2bd541a20a0	67564 bytes
/tmp/arm7	SHA256: 5300d4241e33568144e9f3161c690232f7ea51ebdedfd00da2871eb0dde87695	53655 bytes
/tmp/x86	SHA256: 594900991d0e37938b960d5d5c7276bb895b834d3733f15d96afe33525aae567	35188 bytes
/tmp/miori.x86	SHA256: cf08da6870c9ae3b09cc45a3ba75d35fc89c772157c09131d97f8ba3b08e3562	38144 bytes
/tmp/mpsl	SHA256: f269f2e5639cb47b4772d970414e7d4ac3b8d0efeca986618e5fdb1811d5910d	39976 bytes

Akamai Security Intelligence Group

Guardicore CENTRA

Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

Threat Information

Basic Information

Attack Flow

Associated Files