Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 5.135.182.136Malicious

IP Address: 5.135.182.136Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Download and Execute Successful SSH Login Outgoing Connection Listening Download File 1 Shell Commands SSH SFTP

Associated Attack Servers

telenet.be

36.77.94.79 65.20.151.231 65.20.194.83 65.20.235.243 81.164.162.19

Basic Information

IP Address

5.135.182.136

Domain

-

ISP

-

Country

France

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2023-06-11

Last seen in Akamai Guardicore Segmentation

2023-06-13

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List

Successful SSH Login

/lib/ilqirrhwcg/ScBr_armv4l was downloaded

Download File

/lib/ilqirrhwcg/ScBr_i586 was downloaded

Download File

/lib/ilqirrhwcg/ScBr_mips was downloaded

Download File

/lib/ilqirrhwcg/ScBr_mipsel was downloaded

Download File

/lib/ilqirrhwcg/ScBr_powerpc was downloaded

Download File

/lib/ilqirrhwcg/ScBr_mips64 was downloaded

Download File

/lib/ilqirrhwcg/ScBr_larm was downloaded

Download File

/lib/ilqirrhwcg/src was downloaded

Download File

/lib/ilqirrhwcg/xdebug was downloaded

Download File

The file /lib/ilqirrhwcg/ScBr_x86_64 was downloaded and executed 6 times

Download and Execute

Process /lib/ilqirrhwcg/ScBr_x86_64 started listening on ports: 41297

Listening

Process /lib/ilqirrhwcg/ScBr_x86_64 generated outgoing network traffic to: 65.20.151.231:41297, 65.20.194.83:41297, 65.20.235.243:41297 and 81.164.162.19:41297

Outgoing Connection

Connection was closed due to timeout

Associated Files

/lib/qiagykfwac/ScBr_armv4l

SHA256: 985fc34b2732abe8af9cc112fcb394df7a4ff0dab68c6bf30490586906080df6

1329900 bytes

/lib/vodwmfcawk/ScBr_mips

SHA256: adde0f0d97bdbe606e793a3a082d9e3db6d6f9a098dbe9d835d445362b06a4ef

1794388 bytes

/lib/vatcotvfuh/ScBr_x86_64

SHA256: 306ee0eff111da5a4163c58afda9a3174db7814d347f0f161d91f266caa395b6

1465240 bytes

/lib/uhcyglpqkuh/ScBr_powerpc

SHA256: 32278d65e739c9fdc0888d6c7d658d0f77bce6a8b92f19654848251a0fde704e

1437396 bytes

/lib/ldtkhkrhot/ScBr_i586

SHA256: b74ee9301647bbb064e744fc36e2015b225f1b02fa3590319979805dc745b859

1252524 bytes