IP Address: 82.64.113.245Previously Malicious
IP Address: 82.64.113.245Previously Malicious
This IP address attempted an attack on a machine in our threat sensors network
|
Role |
Attacker, Scanner |
|
Services Targeted |
SCP SSH |
|
Tags |
SSH Superuser Operation SCP Download and Allow Execution Successful SSH Login Download and Execute |
|
Associated Attack Servers |
|
IP Address |
82.64.113.245 |
|
|
Domain |
- |
|
|
ISP |
Free SAS |
|
|
Country |
France |
|
|
WHOIS |
Created Date |
- |
|
Updated Date |
- |
|
|
Organization |
- |
|
|
First seen in Akamai Guardicore Segmentation |
2022-10-05 |
|
Last seen in Akamai Guardicore Segmentation |
2022-10-31 |
What is Akamai Guardicore SegmentationAkamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List |
Successful SSH Login |
|
A user logged in using SSH with the following credentials: root / ****** - Authentication policy: Correct Password 3 times |
Successful SSH Login |
|
A possibly malicious Superuser Operation was detected 18 times |
Superuser Operation |
|
The file /root/ifconfig was downloaded and executed 9 times |
Download and Execute |
|
The file /root/apache2 was downloaded and executed 115 times |
Download and Execute |
|
Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443 |
Outgoing Connection |
|
Process /root/ifconfig scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /var/tmp/apache2 scanned port 1234 on 28 IP Addresses 2 times |
Port 1234 Scan |
|
Process /root/apache2 scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /root/ifconfig scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /etc/ifconfig scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /etc/apache2 scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /dev/shm/ifconfig scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /tmp/apache2 scanned port 1234 on 28 IP Addresses |
Port 1234 Scan |
|
Process /root/ifconfig started listening on ports: 1234, 8085 and 8180 |
Listening |
|
The file /var/tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /var/tmp/apache2 was downloaded and executed 158 times |
Download and Execute |
|
Process /var/tmp/apache2 generated outgoing network traffic to: 161.107.113.27:1234, 172.64.200.11:443, 172.64.201.11:443, 173.18.35.41:1234, 190.60.239.44:1234, 191.242.188.103:1234, 211.162.184.120:1234, 51.159.19.47:1234, 61.84.162.66:1234, 84.204.148.99:1234 and 89.212.123.191:1234 |
Outgoing Connection |
|
Process /var/tmp/apache2 started listening on ports: 1234, 8084 and 8185 |
Listening |
|
The file /var/tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
Process /var/tmp/apache2 generated outgoing network traffic to: 172.64.201.11:443 |
Outgoing Connection |
|
Process /var/tmp/apache2 started listening on ports: 1234, 8089 and 8180 |
Listening |
|
The file /root/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /root/apache2 was downloaded and executed 111 times |
Download and Execute |
|
Process /root/apache2 generated outgoing network traffic to: 123.132.238.210:1234, 161.35.79.199:1234, 172.64.200.11:443, 172.64.201.11:443, 190.60.239.44:1234, 222.165.136.99:1234, 223.171.91.127:1234, 46.13.164.29:1234 and 52.131.32.110:1234 |
Outgoing Connection |
|
Process /root/apache2 started listening on ports: 1234, 8082 and 8188 |
Listening |
|
The file /root/apache2 was downloaded and executed 122 times |
Download and Execute |
|
Process /root/ifconfig generated outgoing network traffic to: 172.64.200.11:443 |
Outgoing Connection |
|
Process /root/ifconfig started listening on ports: 1234, 8084 and 8183 |
Listening |
|
The file /etc/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /etc/apache2 was downloaded and executed 125 times |
Download and Execute |
|
Process /etc/ifconfig started listening on ports: 1234, 8080 and 8187 |
Listening |
|
Process /etc/ifconfig generated outgoing network traffic to: 117.54.14.169:1234, 172.64.200.11:443, 172.64.201.11:443, 190.12.120.30:1234, 191.242.182.210:1234, 222.121.63.87:1234, 52.131.32.110:1234, 59.3.186.45:1234 and 62.12.106.5:1234 |
Outgoing Connection |
|
The file /etc/ifconfig was downloaded and executed 4 times |
Download and Execute |
|
The file /etc/apache2 was downloaded and executed 61 times |
Download and Execute |
|
Process /etc/apache2 generated outgoing network traffic to: 172.64.201.11:443 |
Outgoing Connection |
|
Process /etc/apache2 started listening on ports: 1234, 8080, 8086 and 8184 |
Listening |
|
/dev/shm/ifconfig was downloaded |
Download File |
|
Process /dev/shm/ifconfig generated outgoing network traffic to: 172.64.200.11:443, 172.64.201.11:443, 183.213.26.13:1234, 191.242.188.103:1234, 209.216.177.158:1234, 218.146.15.97:1234, 222.103.98.58:1234, 222.121.63.87:1234, 222.134.240.91:1234, 45.120.216.114:1234 and 46.13.164.29:1234 |
Outgoing Connection |
|
Process /dev/shm/ifconfig started listening on ports: 1234, 8080, 8180 and 8184 |
Listening |
|
The file /tmp/ifconfig was downloaded and executed 5 times |
Download and Execute |
|
The file /tmp/apache2 was downloaded and executed 40 times |
Download and Execute |
|
Process /tmp/apache2 started listening on ports: 1234, 8084 and 8182 |
Listening |
|
Connection was closed due to timeout |
|
|
/var/tmp/ifconfig |
SHA256: af5a3b16f20172c433cf59e47ab12d7659877616d5442fc440c2411c513c40a9 |
3090288 bytes |
© 2023 Akamai Technologies