Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 101.43.185.6Previously Malicious

IP Address: 101.43.185.6Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Successful SSH Login SSH Brute Force SSH Download and Execute Outgoing Connection Access Suspicious Domain New SSH Key

Associated Attack Servers

hichina.com hybs-pro.net ident.me

3.224.225.62 14.157.119.189 34.117.59.81 39.106.141.219 42.194.145.218 47.98.152.150 47.98.237.159 47.104.60.24 47.240.81.89 49.12.234.183 49.233.76.132 49.235.26.143 58.87.111.245 96.16.55.40 101.226.197.196 103.27.42.31 103.27.42.46 103.36.84.148 103.47.242.21 103.47.242.122 104.18.114.97 106.53.250.239 106.55.234.96 107.170.192.159 115.159.51.76 118.25.193.16 118.89.62.49 118.144.137.141 119.23.219.95

Basic Information

IP Address

101.43.185.6

Domain

-

ISP

Beijing CNISP Technology Co.

Country

China

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-05-18

Last seen in Akamai Guardicore Segmentation

2022-05-18

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ********* - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SSH Brute Force Successful SSH Login

The file /usr/local/bin/qkglvy was downloaded and executed 31 times

Download and Execute

Process /usr/local/bin/qkglvy generated outgoing network traffic to: 1.1.1.1:53, 101.226.197.196:38531, 103.27.42.31:33835, 103.27.42.46:40369, 103.36.84.148:34874, 103.47.242.122:35245, 103.47.242.21:41730, 104.18.114.97:80, 106.53.250.239:39176, 106.55.234.96:36115, 107.170.192.159:8000, 115.159.51.76:49041, 118.144.137.141:38847, 118.144.137.141:43096, 118.25.193.16:33723, 118.89.62.49:33053, 119.23.219.95:40286, 120.238.246.181:40425, 120.25.243.182:33254, 120.55.165.126:51190, 121.40.102.119:58312, 122.51.124.200:32822, 122.51.124.200:33557, 122.51.124.200:36219, 122.51.124.200:41169, 123.206.41.71:34659, 124.113.176.5:53534, 129.204.153.208:39257, 129.211.25.204:34644, 129.28.170.215:34850, 132.232.40.86:38003, 132.232.47.144:37545, 14.157.119.189:1458, 178.128.188.37:46415, 182.75.115.93:43327, 208.67.222.222:443, 210.73.207.46:49558, 218.244.130.78:60848, 3.224.225.62:80, 34.117.59.81:80, 39.106.141.219:36845, 42.194.145.218:45389, 47.104.60.24:43115, 47.240.81.89:41235, 47.98.152.150:42130, 47.98.237.159:45657, 49.12.234.183:80, 49.233.76.132:35640, 49.235.26.143:43796, 58.87.111.245:44618 and 96.16.55.40:80

Outgoing Connection

Process /usr/local/bin/qkglvy attempted to access suspicious domains: 182-airtel.com, googleusercontent.com, hichina.com, hybs-pro.net and ident.me

Access Suspicious Domain Outgoing Connection

Connection was closed due to timeout

An attempt to download /root/.ssh/authorized_keys was made 25 times

New SSH Key

Associated Files

/usr/local/bin/qkglvy

SHA256: 5e9eed61745f9cab83471787ec9610b722c950ac5bc185fd152327eb068e7ed9

3180796 bytes