IP Address: 79.113.184.159Previously Malicious
IP Address: 79.113.184.159Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SSH |
|
Tags |
Successful SSH Login 22 Shell Commands Human Port 22 Scan Download and Execute Outgoing Connection DNS Query Superuser Operation Package Install Download and Allow Execution SSH Bulk Files Tampering |
|
Associated Attack Servers |
|
IP Address |
79.113.184.159 |
|
|
Domain |
- |
|
|
ISP |
RCS & RDS |
|
|
Country |
Romania |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2022-04-18 |
|
Last seen in Akamai Guardicore Segmentation |
2022-04-18 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / *********** - Authentication policy: White List |
Successful SSH Login |
|
Process /usr/lib/git-core/git-remote-http attempted to access domains: github.com |
DNS Query |
|
Process /usr/lib/git-core/git-remote-http generated outgoing network traffic to: 140.82.114.4:443 |
Outgoing Connection |
|
A possibly malicious Package Install was detected 2 times |
Package Install Superuser Operation |
|
A possibly malicious Superuser Operation was detected 3 times |
Package Install Superuser Operation |
|
The file /root/leaks/fnlv2/banner was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/banner.log was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/clear was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/ez was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/bios.txt was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/filtru.sh was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/fnlg was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/fnl was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/frm was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/fnlgr was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/haiduc was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/i was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/pass.fnl was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/ps was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/ps3 was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/random was downloaded and granted execution privileges |
Download and Allow Execution |
|
The file /root/leaks/fnlv2/range was downloaded and granted execution privileges |
Download and Allow Execution |
|
Process /root/leaks/fnlv2/ps2 generated outgoing network traffic to: 253.46.0.10:22, 253.46.0.11:22, 253.46.0.12:22, 253.46.0.13:22, 253.46.0.14:22, 253.46.0.15:22, 253.46.0.16:22, 253.46.0.17:22, 253.46.0.18:22, 253.46.0.19:22, 253.46.0.1:22, 253.46.0.20:22, 253.46.0.21:22, 253.46.0.22:22, 253.46.0.23:22, 253.46.0.24:22, 253.46.0.25:22, 253.46.0.26:22, 253.46.0.27:22, 253.46.0.28:22, 253.46.0.29:22, 253.46.0.2:22, 253.46.0.30:22, 253.46.0.31:22, 253.46.0.32:22, 253.46.0.33:22, 253.46.0.34:22, 253.46.0.35:22, 253.46.0.36:22, 253.46.0.37:22, 253.46.0.38:22, 253.46.0.39:22, 253.46.0.3:22, 253.46.0.40:22, 253.46.0.41:22, 253.46.0.42:22, 253.46.0.43:22, 253.46.0.44:22, 253.46.0.45:22, 253.46.0.46:22, 253.46.0.47:22, 253.46.0.48:22, 253.46.0.49:22, 253.46.0.4:22, 253.46.0.50:22, 253.46.0.51:22, 253.46.0.52:22, 253.46.0.53:22, 253.46.0.54:22, 253.46.0.55:22, 253.46.0.56:22, 253.46.0.57:22, 253.46.0.58:22, 253.46.0.59:22, 253.46.0.5:22, 253.46.0.60:22, 253.46.0.61:22, 253.46.0.62:22, 253.46.0.63:22, 253.46.0.64:22, 253.46.0.65:22, 253.46.0.66:22, 253.46.0.67:22, 253.46.0.68:22, 253.46.0.69:22, 253.46.0.6:22, 253.46.0.70:22, 253.46.0.71:22, 253.46.0.72:22, 253.46.0.73:22, 253.46.0.74:22, 253.46.0.75:22, 253.46.0.76:22, 253.46.0.77:22, 253.46.0.78:22, 253.46.0.79:22, 253.46.0.7:22, 253.46.0.80:22, 253.46.0.81:22, 253.46.0.82:22, 253.46.0.83:22, 253.46.0.84:22, 253.46.0.85:22, 253.46.0.86:22, 253.46.0.87:22, 253.46.0.88:22, 253.46.0.89:22, 253.46.0.8:22, 253.46.0.90:22, 253.46.0.91:22, 253.46.0.92:22, 253.46.0.93:22, 253.46.0.94:22, 253.46.0.95:22, 253.46.0.96:22, 253.46.0.97:22, 253.46.0.98:22, 253.46.0.99:22 and 253.46.0.9:22 |
|
|
Process /root/leaks/fnlv2/ps2 scanned port 22 on 99 IP Addresses |
Port 22 Scan |
|
The file /root/leaks/fnlv2/ps2 was downloaded and executed 2 times |
Download and Execute |
|
Connection was closed due to timeout |
|
|
Process /usr/bin/git performed bulk changes in {/} on 436 files |
Bulk Files Tampering |
© 2023 Akamai Technologies