Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 81.4.122.63Malicious

IP Address: 81.4.122.63Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Download and Execute Successful SSH Login Download File Access Suspicious Domain SSH System File Modification 1 Shell Commands Listening Outgoing Connection SFTP

Associated Attack Servers

103.in-addr.arpa netatonce.net starhub.net.sg tedata.net tre.se

24.224.121.81 79.138.160.66 82.197.242.101 102.47.54.127 103.123.73.207 122.11.169.7

Basic Information

IP Address

81.4.122.63

Domain

-

ISP

-

Country

Netherlands

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2023-02-24

Last seen in Akamai Guardicore Segmentation

2024-06-27

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

System file /lib/plvngiqdwyxm/ScBr_armv4l was modified 4 times

System File Modification

/lib/plvngiqdwyxm/ScBr_armv4l was downloaded

Download File

System file /lib/plvngiqdwyxm/ScBr_mips was modified 4 times

System File Modification

/lib/plvngiqdwyxm/ScBr_i586 was downloaded

Download File

/lib/plvngiqdwyxm/ScBr_mips was downloaded

Download File

/lib/plvngiqdwyxm/ScBr_mipsel was downloaded

Download File

System file /lib/plvngiqdwyxm/ScBr_mips64 was modified 4 times

System File Modification

/lib/plvngiqdwyxm/ScBr_powerpc was downloaded

Download File

/lib/plvngiqdwyxm/ScBr_mips64 was downloaded

Download File

System file /lib/plvngiqdwyxm/src was modified 9 times

System File Modification

/lib/plvngiqdwyxm/ScBr_larm was downloaded

Download File

/lib/plvngiqdwyxm/src was downloaded

Download File

/lib/plvngiqdwyxm/xdebug was downloaded

Download File

The file /lib/plvngiqdwyxm/ScBr_x86_64 was downloaded and executed 6 times

Download and Execute

Process /lib/plvngiqdwyxm/ScBr_x86_64 started listening on ports: 41297

Listening

Process /lib/plvngiqdwyxm/ScBr_x86_64 generated outgoing network traffic to: 102.47.54.127:41297, 103.123.73.207:41297, 122.11.169.7:41297, 24.224.121.81:41297, 79.138.160.66:41297 and 82.197.242.101:41297

Outgoing Connection

Process /lib/plvngiqdwyxm/ScBr_x86_64 attempted to access suspicious domains: 103.in-addr.arpa, netatonce.net, starhub.net.sg and tre.se

Access Suspicious Domain Outgoing Connection

Connection was closed due to timeout

Associated Files

/lib/pxlesetikvi/ScBr_x86_64

SHA256: 306ee0eff111da5a4163c58afda9a3174db7814d347f0f161d91f266caa395b6

1465240 bytes