Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 46.217.172.194Malicious

IP Address: 46.217.172.194Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

1 Shell Commands SSH Download File SFTP Port 22 Scan Listening Successful SSH Login Download and Execute System File Modification Outgoing Connection

Associated Attack Servers

dns.google

8.8.8.8 89.109.55.202

Basic Information

IP Address

46.217.172.194

Domain

-

ISP

-

Country

North Macedonia

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2023-05-04

Last seen in Akamai Guardicore Segmentation

2023-05-04

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

/lib/ahblrwohifu/ScBr_armv4l was downloaded

Download File

System file /lib/ahblrwohifu/ScBr_i586 was modified 4 times

System File Modification

System file /lib/ahblrwohifu/ScBr_mips was modified 4 times

System File Modification

/lib/ahblrwohifu/ScBr_i586 was downloaded

Download File

/lib/ahblrwohifu/ScBr_mips was downloaded

Download File

/lib/ahblrwohifu/ScBr_mipsel was downloaded

Download File

/lib/ahblrwohifu/ScBr_powerpc was downloaded

Download File

System file /lib/ahblrwohifu/ScBr_mips64 was modified 4 times

System File Modification

/lib/ahblrwohifu/ScBr_mips64 was downloaded

Download File

/lib/ahblrwohifu/ScBr_larm was downloaded

Download File

/lib/ahblrwohifu/src was downloaded

Download File

System file /lib/ahblrwohifu/xdebug was modified 4 times

System File Modification

/lib/ahblrwohifu/xdebug was downloaded

Download File

The file /lib/ahblrwohifu/ScBr_x86_64 was downloaded and executed 14 times

Download and Execute

System file /lib/ahblrwohifu/magicPussyMommy was modified 4 times

System File Modification

Process /lib/ahblrwohifu/ScBr_x86_64 started listening on ports: 41297 2 times

Listening

Process /lib/ahblrwohifu/ScBr_x86_64 generated outgoing network traffic to: 8.8.8.8:41297

Outgoing Connection

Process /lib/ahblrwohifu/ScBr_x86_64 generated outgoing network traffic to: 101.156.70.128:22, 102.254.13.1:22, 104.182.155.143:22, 104.212.116.186:22, 104.95.238.108:22, 108.60.250.230:22, 110.64.136.161:22, 111.198.198.80:22, 113.173.133.138:22, 115.244.233.169:22, 117.7.38.203:22, 118.177.97.157:22, 119.126.195.25:22, 119.143.83.229:22, 121.186.73.232:22, 122.51.51.165:22, 123.206.72.67:22, 128.217.222.127:22, 129.77.210.246:22, 130.74.245.156:22, 131.171.246.21:22, 134.194.107.71:22, 135.43.60.5:22, 136.237.143.249:22, 139.111.8.84:22, 141.24.25.174:22, 147.37.214.227:22, 148.96.254.45:22, 153.38.166.246:22, 154.111.60.64:22, 161.16.120.242:22, 161.90.132.215:22, 162.143.232.103:22, 163.199.45.205:22, 165.227.85.152:22, 167.0.82.122:22, 17.142.76.193:22, 170.71.78.39:22, 175.219.87.239:22, 176.187.39.35:22, 176.8.63.3:22, 18.200.213.79:22, 181.37.52.28:22, 186.157.229.14:22, 192.3.27.236:22, 193.206.70.151:22, 193.229.117.86:22, 196.121.178.148:22, 196.92.175.33:22, 197.116.148.186:22, 2.130.121.99:22, 200.26.167.95:22, 201.26.74.187:22, 203.206.215.235:22, 203.35.159.152:22, 203.64.29.116:22, 207.249.212.11:22, 211.194.83.207:22, 213.73.237.13:22, 217.178.228.3:22, 220.141.195.211:22, 221.195.96.89:22, 222.123.14.96:22, 223.87.24.134:22, 23.36.63.50:22, 24.65.15.73:22, 25.88.222.192:22, 32.100.248.185:22, 34.182.182.69:22, 34.214.62.26:22, 36.181.153.125:22, 36.241.184.208:22, 37.147.98.37:22, 38.171.254.71:22, 40.237.242.245:22, 44.4.198.43:22, 46.24.105.69:22, 47.82.246.232:22, 63.138.9.19:22, 64.22.88.113:22, 65.200.144.90:22, 65.21.240.207:22, 69.81.43.49:22, 71.135.26.154:22, 74.31.234.103:22, 75.153.82.8:22, 75.87.195.68:22, 76.41.210.158:22, 77.45.110.117:22, 78.169.114.175:22, 80.253.175.236:22, 81.147.43.8:22, 89.41.247.169:22, 91.130.121.18:22, 91.234.236.222:22, 92.159.110.177:22, 93.33.227.61:22, 94.218.117.136:22 and 96.202.135.38:22

Process /lib/ahblrwohifu/ScBr_x86_64 scanned port 22 on 99 IP Addresses

Port 22 Scan

Connection was closed due to timeout

Associated Files

/lib/sjjkcfiyphki/ScBr_mipsel

SHA256: 1603202a9115b83224233697f2ca1d36fef60113b94a73a15afed79a459aacc3

1813924 bytes

/lib/yxyioyasckf/ScBr_armv4l

SHA256: 16a28951acfe78b81046bfedb0b489efb4c9d3d1d3b8475c39b93cd5105dc866

1346388 bytes

/lib/sjjkcfiyphki/ScBr_powerpc

SHA256: 3da983ef3580a4b1b3b041cd991019b900f7995791c0acb32035ac5706085a63

1454200 bytes

/lib/ahblrwohifu/ScBr_mips64

SHA256: 648a4f33b2c268523378929179af529bc064538326a1202dcdfcd9ee12ae8f6c

1888104 bytes

/lib/yapkoptnyra/ScBr_x86_64

SHA256: 74bb0f2049b3c9c1fe92a4f7c57feb9e4c35653b652cf64ae4cdfab2d408d96d

1482784 bytes

/lib/sjjkcfiyphki/ScBr_mips

SHA256: 829b3c298f7003f49986fb26920f7972e52982651ae6127c6e8e219a86f46890

1818820 bytes

/lib/vpdhvwaopvbu/ScBr_i586

SHA256: c723a221cff37a700e0e3b9dc5f69cdd6a4cc82502ac7c144d6ca1eaf963e800

1265364 bytes

/lib/ahblrwohifu/ScBr_larm

SHA256: c8d3c0b87176b7f8d5667d479cb40d1b9f030d30afe588826254f26ebb4ac58e

1787476 bytes