Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 47.236.235.35Malicious

IP Address: 47.236.235.35Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Connect-Back, Scanner

Services Targeted

SSH

Tags

SSH SSH Brute Force Outgoing Connection Read Password Secrets Download and Allow Execution Executable File Modification Scheduled Task Creation New SSH Key System File Modification Successful SSH Login Service Restart Download and Execute Listening

Associated Attack Servers

125.74.93.225 172.17.32.115 172.17.32.116 172.17.32.117 172.17.32.118 172.17.32.119 172.17.32.121 172.17.32.122 172.17.32.123 172.17.32.124 172.17.32.125 172.17.32.126 172.17.32.128 172.17.32.129 172.17.32.130 172.17.32.131 172.17.32.132 172.17.32.133 172.17.32.134

Basic Information

IP Address

47.236.235.35

Domain

-

ISP

-

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2024-01-21

Last seen in Akamai Guardicore Segmentation

2024-01-29

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List (Part of a Brute Force Attempt)

SSH Brute Force Successful SSH Login

Process /bin/bash generated outgoing network traffic to: 125.74.93.225:60100

Outgoing Connection

System file /etc/crontab was modified 9 times

System File Modification

Executable file /usr/bin/wgbtx was modified

Executable File Modification

The file /tmp/i0tSDvhI94 was downloaded and executed 16 times

Download and Execute

System file /etc/shadow was modified 144 times

System File Modification

Process /tmp/i0tSDvhI94 started listening on ports: 60107

Listening

System file /etc/ssh/sshd_config was modified 4 times

System File Modification

Process /tmp/i0tSDvhI94 generated outgoing network traffic to: 125.74.93.225:60100, 172.17.32.115:60125, 172.17.32.116:60109, 172.17.32.117:60102, 172.17.32.118:60107, 172.17.32.119:60100, 172.17.32.121:60103, 172.17.32.122:60123, 172.17.32.123:60127, 172.17.32.124:60147, 172.17.32.125:60113, 172.17.32.126:60142, 172.17.32.128:60135, 172.17.32.129:60109, 172.17.32.130:60137, 172.17.32.131:60149, 172.17.32.132:60129, 172.17.32.133:60149, 172.17.32.134:60129 and 47.236.235.35:60131

Outgoing Connection

Process /usr/sbin/sshd started listening on ports: 22

Listening

The file /tmp/bash was downloaded and granted execution privileges

Connection was closed due to timeout

An attempt to download /root/.ssh/authorized_keys was made

New SSH Key

Associated Files

/tmp/t6VeDM4War

SHA256: 976e3772ffea7499f7c119e956a5a71806f8f054caf174978fa888b254dd22a0

1458464 bytes