IP Address: 62.12.108.44Malicious
IP Address: 62.12.108.44Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SSH SCP |
|
Tags |
SSH SCP Superuser Operation Download File Download and Allow Execution Successful SSH Login Download and Execute |
|
Associated Attack Servers |
destiny.be inter.net.il sbryercabletv.com uprr.com 183.213.26.13 124.212.182.167 138.129.16.182 219.78.158.141 101.42.109.172 201.48.205.89 82.157.127.47 139.155.206.168 116.45.106.126 74.61.164.211 209.216.177.238 184.83.112.246 103.90.177.102 101.35.121.8 135.181.104.81 84.228.117.160 172.64.80.1 202.90.131.38 36.80.113.248 41.39.182.198 218.23.236.23 172.64.201.11 172.64.200.11 120.224.34.31 123.132.238.210 124.223.14.100 147.182.233.56 125.161.27.96 95.154.21.210 209.216.177.158 |
|
IP Address |
62.12.108.44 |
|
|
Domain |
- |
|
|
ISP |
National Information Center (NIC) |
|
|
Country |
Sudan |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2022-01-01 |
|
Last seen in Akamai Guardicore Segmentation |
2023-04-15 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List |
Successful SSH Login |
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 2 times |
Successful SSH Login |
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 8 times |
Successful SSH Login |
|
A possibly malicious Superuser Operation was detected 44 times |
Superuser Operation |
|
The file /tmp/ifconfig was downloaded and executed 10 times |
Download and Execute |
|
The file /root/ifconfig was downloaded and executed 6 times |
Download and Execute |
|
The file /etc/apache2 was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /etc/ifconfig was downloaded and executed 6 times |
Download and Execute |
|
The file /root/apache2 was downloaded and executed 39 times |
Download and Execute |
|
The file /tmp/apache2 was downloaded and executed 128 times |
Download and Execute |
|
Process /root/apache2 generated outgoing network traffic to: 172.64.201.11:443 |
Outgoing Connection |
|
Process /root/apache2 scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /tmp/apache2 scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /var/tmp/ifconfig scanned port 1234 on 24 IP Addresses 2 times |
Port 1234 Scan |
|
Process /dev/shm/apache2 scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /root/ifconfig scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /var/tmp/ifconfig scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /root/ifconfig scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /tmp/ifconfig scanned port 1234 on 24 IP Addresses |
Port 1234 Scan |
|
Process /root/apache2 started listening on ports: 1234, 8084 and 8180 |
Listening |
|
Process /tmp/apache2 generated outgoing network traffic to: 118.218.209.149:1234, 172.64.201.11:443 and 191.242.188.103:1234 |
Outgoing Connection |
|
Process /tmp/apache2 started listening on ports: 1234, 8080 and 8184 |
Listening |
|
The file /var/tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /var/tmp/apache2 was downloaded and executed 131 times |
Download and Execute |
|
Process /var/tmp/ifconfig generated outgoing network traffic to: 117.16.44.111:1234, 118.218.209.149:1234, 139.209.222.134:1234, 150.107.95.20:1234, 161.70.98.32:1234, 172.64.200.11:443, 172.64.201.11:443, 182.224.177.56:1234, 185.210.144.122:1234, 191.242.182.210:1234, 223.99.166.104:1234, 46.13.164.29:1234, 52.131.32.110:1234, 62.12.106.5:1234 and 82.149.112.170:1234 |
Outgoing Connection |
|
Process /var/tmp/ifconfig started listening on ports: 1234, 8081 and 8183 |
Listening |
|
/dev/shm/ifconfig was downloaded 2 times |
Download File |
|
./ifconfig was downloaded 4 times |
Download File |
|
The file /var/tmp/apache2 was downloaded and executed 55 times |
Download and Execute |
|
The file /var/tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
Process /var/tmp/ifconfig started listening on ports: 1234, 8082 and 8182 |
Listening |
|
Process /var/tmp/ifconfig generated outgoing network traffic to: 172.64.201.11:443 |
Outgoing Connection |
|
The file /tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
Process /dev/shm/apache2 started listening on ports: 1234, 8087 and 8188 |
Listening |
|
The file /root/ifconfig was downloaded and executed 15 times |
Download and Execute |
|
The file /root/apache2 was downloaded and executed 142 times |
Download and Execute |
|
Process /root/ifconfig started listening on ports: 1234, 8086, 8182 and 8188 |
Listening |
|
Process /root/ifconfig generated outgoing network traffic to: 190.60.239.44:1234, 80.147.162.151:1234 and 89.212.123.191:1234 |
|
|
The file /var/tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /var/tmp/apache2 was downloaded and executed 122 times |
Download and Execute |
|
Process /var/tmp/ifconfig started listening on ports: 1234, 8081 and 8185 |
Listening |
|
Process /var/tmp/ifconfig generated outgoing network traffic to: 120.224.34.31:1234, 172.64.200.11:443, 206.189.25.255:1234, 85.105.82.39:1234 and 86.133.233.66:1234 |
Outgoing Connection |
|
/etc/ifconfig was downloaded 2 times |
Download File |
|
The file /root/apache2 was downloaded and executed 94 times |
Download and Execute |
|
Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443, 173.18.35.41:1234 and 209.216.177.238:1234 |
Outgoing Connection |
|
Process /root/ifconfig started listening on ports: 1234, 8089 and 8183 |
Listening |
|
The file /tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /tmp/apache2 was downloaded and executed 10 times |
Download and Execute |
|
The file /tmp/apache2 was downloaded and executed 113 times |
Download and Execute |
|
Process /tmp/ifconfig generated outgoing network traffic to: 172.64.201.11:443 |
Outgoing Connection |
|
Process /tmp/ifconfig started listening on ports: 1234, 8087, 8183 and 8187 |
Listening |
|
/root/ifconfig was downloaded |
Download File |
|
Connection was closed due to user inactivity |
|
|
/var/tmp/ifconfig |
SHA256: c04b32a7c24533bc14fdd18b6cff3756d284640b23569d19c8e268ece7666b43 |
1540096 bytes |
|
/tmp/ifconfig |
SHA256: 1118f58badaea9c524290c7ac9bee6703ff6656960121dc52bdb9c378775276a |
3109968 bytes |
|
/tmp/ifconfig |
SHA256: 331f1ead3df8fed58ccf68da781f34b2f228a5c37f3bb245b836a4b49b1cf269 |
557056 bytes |
|
/root/ifconfig |
SHA256: 2aacc3f6c14a2bd120ce9f7cab7af1f4d3e207bea33d56f02a14f75613a7930c |
786432 bytes |
|
/root/ifconfig |
SHA256: 6ee5b0eadb32669e495a5d4157119d3a8248235f0b3e21084070fb6bb45ca89e |
950272 bytes |
|
/root/ifconfig |
SHA256: 8a53c1d12942d21d2876a4b8d1eeed8a33a4a9d9f6d1ff3474980278e76a7cc9 |
1310720 bytes |
|
/etc/ifconfig |
SHA256: fb6a5675b73aac01d91810ac511251778c4fe50ce51470a0cf5e8f909472b474 |
327680 bytes |
|
/root/ifconfig |
SHA256: 8a80c7f19c03dc2a33a1f698b2bf2acf83fb6fd9f7c78a3a66541327a8bf62d4 |
425984 bytes |
|
/tmp/ifconfig |
SHA256: 63ce5e408bc30df5efb4e48cb2e893e84b58da0ea31d834ce11db915f0dfaba2 |
32768 bytes |
|
/tmp/ifconfig |
SHA256: 60cc0b454c5174dc5ec389859f0890a7ac0733c005f894083585a4274b71de5b |
2719744 bytes |
|
/root/ifconfig |
SHA256: bc4c4c39f98753ec5421a21b33179c026cae4f44f6ce47de8355c24546601af4 |
196608 bytes |
|
/tmp/ifconfig |
SHA256: f5c07ee7e6943a9fa0a949bfbe10730dfe89f5614126f9c2dd050ab796ba2dc4 |
458752 bytes |
|
/etc/ifconfig |
SHA256: 003fc3b1c6259d744b011cde32a47e8cb0b00708ebec1465839b9c14279bc70b |
262144 bytes |
|
/root/ifconfig |
SHA256: f28c1becc58c6ae5d449da0b0f68f4def9db80ba792ab4486a7177e0ecd62b74 |
851968 bytes |
|
/tmp/ifconfig |
SHA256: 915f410de5799b81704f3695d8aa38d5da78b01b60cea17d3e0c3f162f9b0e9b |
1802240 bytes |
|
/etc/ifconfig |
SHA256: 93b5387c1ad89b1bba7a1c7ad722d5406dd174e58cd0a1de5a0684e02a83fd33 |
1474560 bytes |
© 2023 Akamai Technologies