IP Address: 213.233.88.62Previously Malicious

Weekly Summary

Browse or download a weekly review of our cyber threat intelligence data and gain more insight to help protect your network

Top Threats

Cyber Threat Intelligence

Discover Malicious IPs and Domains with Guardicore Cyber Threat Feed

IP Address:
213.233.88.62​
Previously Malicious

This IP address attempted an attack on a machine protected by Guardicore Centra

Threat Information

Role

Attacker

Services Targeted

SSH

Tags

DNS Query Download File Human Outgoing Connection SSH Successful SSH Login Access Suspicious Domain Malicious File 5 Shell Commands SFTP

Connect Back Servers

www.speedtest.net stosat-rstn-01.sys.comcast.net shentel.net sp1.winchesterwireless.net ntc-com.com stosat-malt-01.sys.comcast.net customcomputersva.com edinburg.speedtest.shentel.net bigdaddy.wave2net.com comcast.net

69.241.0.94 204.111.5.18 72.21.92.82 69.241.87.90 184.170.114.134 204.111.21.7

Basic Information

IP Address

213.233.88.62

Domain

-

ISP

Vodafone Romania

Country

Romania

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Guardicore Centra

2017-06-16

Last seen in Guardicore Centra

2017-06-17

What is Guardicore Centra
Guardicore Centra is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Centra generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List

Successful SSH Login

A user logged in using SSH with the following credentials: root / **** - Authentication policy: Correct Password 2 times

Successful SSH Login

/root/test.py was downloaded

Download File

Process /usr/bin/python2.7 attempted to access domains: stosat-rstn-01.sys.comcast.net, www.speedtest.net, stosat-malt-01.sys.comcast.net and edinburg.speedtest.shentel.net

DNS Query

Process /usr/bin/python2.7 generated outgoing network traffic to: 69.241.0.94:80, 69.241.87.90:80, 204.111.21.7:80, 184.170.114.134:80, 204.111.5.18:80 and 72.21.92.82:80

Outgoing Connection

Process /usr/bin/python2.7 attempted to access suspicious domains: sp1.winchesterwireless.net, customcomputersva.com and bigdaddy.wave2net.com

DNS Query Access Suspicious Domain Outgoing Connection

/root/hex/1 was downloaded

Download File

/root/hex/a was downloaded

Download File

/root/hex/port.filepart was downloaded

Download File

/root/hex/pscan2.filepart was downloaded

Download File

/root/hex/pscan2.c was downloaded

Download File

/root/hex/scan.log was downloaded

Download File

/root/hex/screen.filepart was downloaded

Download File

/root/hex/sshd.filepart was downloaded

Download File

/root/hex/screen.filepart was identified as malicious by YARA according to rules: Maldoc Somerules and Toolkit Thor Hacktools

Malicious File

/root/hex/pscan2.c was identified as malicious by YARA according to rules: Toolkit Thor Hacktools

Malicious File

/root/hex/start was identified as malicious by YARA according to rules: Toolkit Thor Hacktools

Malicious File

/root/hex/pscan2.filepart was identified as malicious by YARA according to rules: Malw Miscelanea Linux and Toolkit Thor Hacktools

Malicious File

/root/hex/sshd.filepart was identified as malicious by YARA according to rules: Malw Miscelanea Linux, Maldoc Somerules and Crypto Signatures

Malicious File

/root/hex/start was downloaded

Download File

/root/hex/w was downloaded

Download File

Associated Files

/var/tmp/scan/pscan2

SHA256: 2ede344e0415193d41b90d3cdfbf8558c307d8b8182464dfe15655ea1f88eab0

888972 bytes

/var/tmp/zone/screen.filepart

SHA256: 2413af510a75ada34716165992a425b35f62ba1478f63746502afd8a8a156b80

249980 bytes

/var/tmp/sshd.filepart

SHA256: 3c00611b670b128c1ca6d3c6f0e9522eea385e0670e74a9b2b26325b4e13c864

1485768 bytes

/root/sk/a

SHA256: 80a2727e83a71f4bf3c425a7bbdce8fdf01db418562ce51153159499b929fba9

963 bytes

/root/sk/pscan2.c

SHA256: e49ed29893985dbaed632eed3713de5efdd7738270ed95940e5eb4050b6624db

5752 bytes

/var/tmp/test.py

SHA256: a5350d5b22b4a6329d319010c65cbad445c09154dab74aff956f4d6301fda3e5

25872 bytes

/var/tmp/magni/magni/go

SHA256: d78a4a02574e711d7b6bdebee7695dd8ae38c7eb9a14ae69e668abcf84d7e882

679 bytes

/var/tmp/magni/magni/pscan2.c

SHA256: b38772886f99bd690cccb7c9824127dafa5b0ceff4666aca66ff1b9d08c1a58e

5814 bytes

/root/hex/1

SHA256: be58a8b528c639812c50beeef4999f07e839088e65d7d08d529e120e77fa1eda

9278 bytes

Oops! - Do you see your IP here? Contact us at labs@guardicore.com to remove it from the Threat Intelligence data.

IP Address: 213.233.88.62​Previously Malicious