Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 136.243.82.205Previously Malicious

IP Address: 136.243.82.205Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

System File Modification Scheduled Task Creation Download Operation Scheduled Task Configuration Outgoing Connection Service Configuration Access Suspicious Domain Download and Execute Service Deletion Successful SSH Login Service Creation SSH Download and Allow Execution

Associated Attack Servers

a.oracleservice.top ovh.ca

51.79.175.139 80.71.158.96 104.168.71.132 185.153.198.230 198.23.214.117

Basic Information

IP Address

136.243.82.205

Domain

-

ISP

Hetzner Online GmbH

Country

Germany

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-01-18

Last seen in Akamai Guardicore Segmentation

2022-01-20

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / *********** - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SSH Brute Force Successful SSH Login

A possibly malicious Download Operation was detected

Download Operation

Process /usr/bin/wget generated outgoing network traffic to: 80.71.158.96:80 2 times

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: blingdash.com

Access Suspicious Domain Outgoing Connection

Process /bin/bash attempted to access domains: pool.supportxmr.com

DNS Query

Process /bin/bash attempted to access suspicious domains: a.oracleservice.top

DNS Query Access Suspicious Domain

The file /etc/cron.hourly/oanacroner1 was downloaded and granted execution privileges

Download and Allow Execution

Process /usr/bin/wget attempted to access suspicious domains: a.oracleservice.top and blingdash.com 2 times

DNS Query Access Suspicious Domain Outgoing Connection

The file /tmp/dbused was downloaded and executed 48 times

Download and Execute

Process /tmp/dbused generated outgoing network traffic to: 198.23.214.117:8080

Outgoing Connection

Executable file /bin/crondr was modified 25 times

Executable File Modification

System file /etc/cron.daily/pwnrig was modified 16 times

System File Modification

System file /etc/cron.hourly/pwnrig was modified 16 times

System File Modification

System file /etc/cron.monthly/pwnrig was modified 16 times

System File Modification

System file /etc/cron.weekly/pwnrig was modified 16 times

System File Modification

System file /etc/cron.daily/sedoiwjE0 was modified 9 times

System File Modification

System file /etc/cron.monthly/sedSaTEGI was modified 9 times

System File Modification

The file /etc/cron.daily/pwnrig was downloaded and granted execution privileges

Download and Allow Execution

The file /etc/cron.hourly/pwnrig was downloaded and granted execution privileges

The file /etc/cron.weekly/pwnrig was downloaded and granted execution privileges

Download and Allow Execution

The file /etc/cron.monthly/pwnrig was downloaded and granted execution privileges

System file /etc/init.d/.depend.boot was modified 144 times

System File Modification

System file /etc/init.d/.depend.start was modified 144 times

System File Modification

System file /etc/init.d/.depend.stop was modified 144 times

System File Modification

Executable file /bin/initdr was modified 25 times

Executable File Modification

System file /etc/init.d/pwnrig was modified 16 times

System File Modification

System file /etc/init.d/sedGmDN7e was modified 9 times

System File Modification

The file /etc/init.d/pwnrig was downloaded and granted execution privileges

Download and Allow Execution

System file /lib/systemd/system/pwnrigl.service was modified 4 times

System File Modification

System file /lib/systemd/system/sedckZtT3 was modified 9 times

System File Modification

System file /etc/systemd/system/sedS0Mi44 was modified 9 times

System File Modification

The file /bin/-bash was downloaded and executed 31 times

Download and Execute

Process /usr/bin/wget generated outgoing network traffic to: 80.71.158.96:80

Outgoing Connection

The file /tmp/bashirc was downloaded and granted execution privileges

The file /var/tmp/cruner was downloaded and granted execution privileges

Process /tmp/bashirc generated outgoing network traffic to: 104.168.71.132:80

Outgoing Connection

The file /bin/-bash was downloaded and executed 32 times

Download and Execute

Process /usr/bin/python2.7 generated outgoing network traffic to: 80.71.158.96:80

Outgoing Connection

Process /usr/bin/python2.7 attempted to access suspicious domains: blingdash.com

Access Suspicious Domain Outgoing Connection

Process /usr/local/bin/dash attempted to access domains: pool.supportxmr.com

DNS Query

The file /etc/cron.d/pwnrig was downloaded and granted execution privileges

Download and Allow Execution

The file /etc/cron.daily/sedbFX2pD was downloaded and granted execution privileges

Download and Allow Execution

System file /etc/cron.hourly/sedp4FVng was modified 9 times

System File Modification

The file /etc/cron.hourly/sedp4FVng was downloaded and granted execution privileges

The file /etc/cron.monthly/pwnrig was downloaded and granted execution privileges

The file /etc/cron.weekly/sedtRpMsw was downloaded and granted execution privileges

Download and Allow Execution

The file /etc/cron.d/pwnrig was downloaded and granted execution privileges

Download and Allow Execution

Service S01pwnrig was created

Service Creation

Service pwnrige was created

Service Creation

Service pwnrigl was created

Service Creation

Service pwnrig was created

Service Creation

Service sedGmDN7e was created

Service Creation

Service sed4llUlB was created

Service Creation

The file /etc/init.d/sed4llUlB was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/bashirc.x86_64 was downloaded and executed

Download and Execute

Process /usr/local/bin/dash attempted to access suspicious domains: a.oracleservice.top and blingdash.com

DNS Query Access Suspicious Domain Outgoing Connection

Process /usr/local/bin/dash generated outgoing network traffic to: 80.71.158.96:80

Outgoing Connection

Process /bin/ping attempted to access domains: pool.supportxmr.com

DNS Query

Process /bin/bash attempted to access suspicious domains: a.oracleservice.top

DNS Query Access Suspicious Domain

/etc/cron.monthly/pwnrig scheduled task was modified

/etc/cron.hourly/sedEtfZER scheduled task was modified

/etc/cron.weekly/sedtRpMsw scheduled task was modified

/etc/cron.daily/pwnrig scheduled task was modified

/etc/cron.hourly/sedp4FVng scheduled task was modified

/etc/cron.monthly/sedSaTEGI scheduled task was modified

/etc/cron.hourly/oanacroner1 scheduled task was modified

/etc/cron.hourly/pwnrig scheduled task was modified

/etc/cron.daily/sedbFX2pD scheduled task was modified

/etc/cron.weekly/pwnrig scheduled task was modified

/etc/cron.monthly/sedwJstoT scheduled task was modified

/etc/cron.daily/sedoiwjE0 was scheduled to run

/etc/cron.weekly/pwnrig was scheduled to run

Connection was closed due to timeout