Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 64.31.47.250Previously Malicious

IP Address: 64.31.47.250Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SCP SSH

Tags

Successful SSH Login HTTP Download Operation Download and Execute SSH Brute Force Access Suspicious Domain Download File Outgoing Connection 1 Shell Commands Download and Allow Execution SSH

Associated Attack Servers

algarnetsuper.com.br attdns.com btcentralplus.com linkways.de ono.com plus.pl srasia-great.com

4.102.137.253 13.175.1.202 15.116.78.151 25.219.95.43 28.185.207.228 33.113.78.28 42.193.193.33 43.242.247.139 45.95.55.24 47.113.190.219 58.221.44.158 58.221.116.178 61.217.161.157 64.227.132.175 85.155.55.181 86.133.233.66 91.134.185.80 95.40.220.56 103.233.122.94 104.243.157.198 106.52.252.228 106.75.3.52 107.182.190.58 108.134.146.125 110.42.209.158 135.113.216.35 136.144.41.55 142.194.5.115 147.182.184.44

Basic Information

IP Address

64.31.47.250

Domain

-

ISP

Limestone Networks

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-04-16

Last seen in Akamai Guardicore Segmentation

2022-04-23

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ****** - Authentication policy: White List (Part of a Brute Force Attempt)

SSH Brute Force Successful SSH Login

A possibly malicious Download Operation was detected 2 times

Download Operation

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/wget.sh was downloaded and granted execution privileges

Download and Allow Execution

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.arm was downloaded and granted execution privileges

Download and Allow Execution

Process /usr/local/bin/dash generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/local/bin/dash attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.arm5 was downloaded and granted execution privileges

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.arm6 was downloaded and granted execution privileges

Process /usr/local/bin/dash generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/local/bin/dash attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.arm7 was downloaded and granted execution privileges

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.m68k was downloaded and granted execution privileges

Process /usr/local/bin/dash generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/local/bin/dash attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.mips was downloaded and granted execution privileges

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.mpsl was downloaded and granted execution privileges

Process /usr/bin/wget generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.ppc was downloaded and granted execution privileges

Download and Allow Execution

Process /usr/local/bin/dash generated outgoing network traffic to: 45.95.55.24:80 2 times

Outgoing Connection

Process /usr/local/bin/dash attempted to access suspicious domains: linkways.de 2 times

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.sh4 was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/meow.spc was downloaded and granted execution privileges

Process /usr/local/bin/dash generated outgoing network traffic to: 45.95.55.24:80

Outgoing Connection

Process /usr/local/bin/dash attempted to access suspicious domains: linkways.de

Access Suspicious Domain Outgoing Connection

The file /tmp/meow.x86 was downloaded and executed

Download and Execute

Connection was closed due to user inactivity

Associated Files

/tmp/meow.spc

SHA256: 06049a837635c0f02150578a9f8067d3d06344d96d95c8b2374983385d85833d

67108 bytes

/tmp/meow.arm7

SHA256: 314bf0b322bf1bc763cb5a7540585af6244b04ba7e58aef1776002aa93618b9a

148590 bytes

/tmp/meow.mips

SHA256: 73317bc871806a38225a378292a9597f1ef14116ebdf6f4cc18105e9061c85c9

75812 bytes

/tmp/meow.m68k

SHA256: af4ec309bbf6f3ab2c41f2558518ca279bd29be453fbc8787370c8047e456678

70212 bytes

/tmp/meow.arm5

SHA256: b5ae6ed97d31d6d4ea51aad337f2d0952568a5613190e3e8f9f5fa330bcb744a

22344 bytes

/tmp/meow.x86

SHA256: cfc37f73db3dba90f974c0a8f0308dd1f51235aea4335b2f346ecf0503365613

49616 bytes

/tmp/meow.arm

SHA256: eef204a6a3096c22cddaf98ac083237887d63e4399997fab4cc684d18a57e04f

40174 bytes