Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 8.225.226.100Previously Malicious

IP Address: 8.225.226.100Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Download Operation System File Modification Service Creation Log Tampering Download File SSH Brute Force Executable File Modification SSH Service Start Successful SSH Login Download and Execute 1 Shell Commands Package Install Service Configuration Outgoing Connection Download and Allow Execution

Associated Attack Servers

51.75.64.249 114.35.102.34 147.182.218.113

Basic Information

IP Address

8.225.226.100

Domain

-

ISP

Level 3 Communications

Country

United States

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2021-08-03

Last seen in Akamai Guardicore Segmentation

2022-04-17

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ******* - Authentication policy: Reached Max Attempts (Part of a Brute Force Attempt)

SSH Brute Force Successful SSH Login

A possibly malicious Download Operation was detected

Download Operation Package Install

A possibly malicious Package Install was detected

Download Operation Package Install

A possibly malicious Download Operation was detected

Download Operation Package Install

A possibly malicious Package Install was detected

Download Operation Package Install

History File Tampering detected from /bin/bash

Log Tampering

Process /usr/bin/wget generated outgoing network traffic to: 147.182.218.113:80

Outgoing Connection

/root/test was downloaded

Download File

The file /root/-s/sedkg3PWc was downloaded and granted execution privileges

Download and Allow Execution

System file /etc/rc.local was modified

System File Modification

The file /root/-s/.start was downloaded and executed 4 times

Download and Execute

System file /etc/iptables was modified 4 times

System File Modification

Executable file /usr/bin/lynx was modified 4 times

Executable File Modification

Executable file /usr/bin/top was modified 4 times

Executable File Modification

The file /usr/bin/lynx was downloaded and executed 14 times

Download and Execute

Service dns-start was created and started 4 times

Service Start Service Creation

The file /usr/sbin/kauditd was downloaded and executed 20 times

Download and Execute

Executable file /usr/sbin/1bf46663869b688 was modified 4 times

Executable File Modification

The file /usr/sbin/md was downloaded and executed 5 times

Download and Execute

Executable file /usr/sbin/fa91ac982e7bff4 was modified 4 times

Executable File Modification

Executable file /usr/sbin/1957143f2944c40 was modified 4 times

Executable File Modification

The file /usr/sbin/1957143f2944c40 was downloaded and executed

Download and Execute

The file /usr/sbin/fa9042a8d570f09 was downloaded and executed

Download and Execute

Log File Tampering detected from /root/-s/.start on the following logs: /var/log/lastlog

Log Tampering

History File Tampering detected from /bin/rm on the following logs: /root/.bash_history

Log Tampering

Connection was closed due to timeout

Associated Files

/root/test

SHA256: 1e1bee93f619bd641af98a83f2cfca75fcdec6365fb207165cb279a785c5f779

81961 bytes

/root/test

SHA256: 23ed39db951f154e76229a3ee0f4a629821807696adbc839bdd399d7c4f1718b

13213 bytes

/root/-s/.start

SHA256: 4bdbd06e59ee5920fcb828d7a1b02fa8bb86a6d227f695ce25302a2b9e7f945f

14256 bytes

/root/test

SHA256: 5d8f050bae3d5d77aab7d370e11afa58a059a6969f6eb328e4db06c78730591d

348865 bytes

/root/test

SHA256: 79bfe7a3b209e1354aad3ec47ca1669e68ac809f7f65f9926ce285975d1c923d

425701 bytes

/usr/lib/libupdate/h64

SHA256: 7fe9d6d8b9390020862ca7dc9e69c1e2b676db5898e4bfad51d66250e9af3eaf

838583 bytes