Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 5.182.226.41Malicious

IP Address: 5.182.226.41Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Connect-Back, Scanner

Services Targeted

SSH

Tags

Listening New SSH Key Service Restart Executable File Modification Outgoing Connection Read Password Secrets Download and Execute SSH Download and Allow Execution System File Modification Scheduled Task Creation Successful SSH Login

Associated Attack Servers

oraclecloud.com

8.210.94.215 8.217.20.4 8.218.21.219 8.218.112.77 8.218.173.88 8.222.177.69 14.225.16.58 27.148.196.241 47.76.181.65 47.236.20.191 47.236.176.7 47.238.222.172 47.245.103.110 47.245.127.62 58.209.234.96 101.91.107.127 106.124.135.91 111.229.107.224 120.70.96.196 120.71.3.148 125.124.20.92 129.144.180.26 150.223.11.167 182.151.39.97 182.151.44.255 182.151.57.188

Basic Information

IP Address

5.182.226.41

Domain

-

ISP

-

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2024-06-28

Last seen in Akamai Guardicore Segmentation

2024-06-28

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

Process /usr/bin/wget generated outgoing network traffic to: 129.144.180.26:60107

Outgoing Connection

System file /etc/crontab was modified 9 times

System File Modification

Executable file /usr/bin/wgbtx was modified

Executable File Modification

System file /etc/shadow was modified 81 times

System File Modification

The file /tmp/FgvhO2UBSm was downloaded and executed 15 times

Download and Execute

Process /tmp/FgvhO2UBSm started listening on ports: 60132

Listening

System file /etc/ssh/sshd_config was modified 4 times

System File Modification

Process /tmp/FgvhO2UBSm generated outgoing network traffic to: 101.91.107.127:60133, 106.124.135.91:60108, 111.229.107.224:60100, 120.70.96.196:60100, 120.71.3.148:60137, 125.124.20.92:60147, 129.144.180.26:60107, 14.225.16.58:60115, 150.223.11.167:60102, 182.151.39.97:60125, 182.151.44.255:60140, 182.151.57.188:60141, 27.148.196.241:60123, 47.236.176.7:60132, 47.236.20.191:60134, 47.238.222.172:60128, 47.245.103.110:60139, 47.245.127.62:60101, 47.76.181.65:60125, 5.182.226.41:60112, 58.209.234.96:60133, 8.210.94.215:60145, 8.217.20.4:60145, 8.218.112.77:60111, 8.218.173.88:60115, 8.218.21.219:60108 and 8.222.177.69:60112

Outgoing Connection

Process /lib/systemd/systemd started listening on ports: 22

Listening

The file /tmp/bash was downloaded and executed

Download and Execute

Connection was closed due to timeout

An attempt to download /root/.ssh/authorized_keys was made

New SSH Key

Associated Files

/tmp/FgvhO2UBSm

SHA256: 4f949750575d7970c20e009da115171d28f1c96b8b6a6e2623580fa8be1753d9

2356344 bytes

/tmp/bash

SHA256: 52f4c6a0388a1be001acf3ff02988731b98e59b44d184aea5d3ea124c548c606

518048 bytes