Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 86.122.2.185Previously Malicious

IP Address: 86.122.2.185Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Download Operation Successful SSH Login Human Download File Scheduled Task Creation SSH Download and Execute Download and Allow Execution Log Tampering Outgoing Connection Superuser Operation HTTP

Associated Attack Servers

dartmouth.edu fish.tvcconnect.net hometelco.net internexe.net kanren.net mtc4me.com perfsonar-test.dartmouth.edu speedtest01-cty-gfld-ma-prod.gcet.net speedtest.homecomminc.com speedtest.ideatek.com speedtest.internexe.net speedtest.mtc4me.com speedtest-wichita.kanren.net speedtest.wilsontelephone.com stsherbrookewireless.rogers.com

63.245.184.10 72.136.172.10 78.111.250.44 104.21.61.142 116.203.186.178 129.170.232.133 148.59.220.155 151.101.2.219 162.159.135.233 164.113.60.33 164.163.177.254 172.67.210.251 172.103.76.57 198.241.62.98 199.19.176.27 199.87.207.174 202.151.166.98 216.255.161.234

Basic Information

IP Address

86.122.2.185

Domain

-

ISP

RCS & RDS

Country

Romania

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2022-05-15

Last seen in Akamai Guardicore Segmentation

2022-05-22

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / **** - Authentication policy: White List

Successful SSH Login

A possibly malicious Superuser Operation was detected

Download Operation Superuser Operation

A possibly malicious Download Operation was detected 5 times

Download Operation Superuser Operation

Process /bin/bash attempted to access suspicious domains: bashupload.com 2 times

DNS Query Access Suspicious Domain Outgoing Connection

Process /bin/bash generated outgoing network traffic to: 116.203.186.178:443 2 times

Outgoing Connection

Process /usr/bin/wget attempted to access suspicious domains: bashupload.com

DNS Query Access Suspicious Domain Outgoing Connection

Process /usr/bin/wget generated outgoing network traffic to: 116.203.186.178:443

Outgoing Connection

Process /bin/bash generated outgoing network traffic to: 116.203.186.178:443

Outgoing Connection

Process /bin/bash attempted to access suspicious domains: bashupload.com

DNS Query Access Suspicious Domain Outgoing Connection

/tmp/.../miner.zip was downloaded

Download File

The file /tmp/.../lib/.hd_proc/.hd_proc was downloaded and granted execution privileges 2 times

Download and Allow Execution

The file /tmp/.../lib/.keep_alive/signal was downloaded and granted execution privileges 2 times

Download and Allow Execution

The file /tmp/.../install/install was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/uid0 was downloaded and granted execution privileges

The file /tmp/.../start was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.keep_alive/1_uid0 was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.keep_alive/check was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.keep_alive/daily was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.keep_alive/hd_proc was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.cron/.cron-tick was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.cron/.daily-tick was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../lib/.base/.base was downloaded and granted execution privileges

Download and Allow Execution

The file /tmp/.../install/dir_set was downloaded and executed

Download and Execute

The file /tmp/.../lib/.cron/.cron was downloaded and executed 12 times

Download and Execute

The file /tmp/.../run was downloaded and executed 9 times

Download and Execute

Process /usr/bin/H7b4Zpj generated outgoing network traffic to: 139.99.123.196:3333 3 times

Outgoing Connection

Process /usr/bin/H7b4Zpj attempted to access suspicious domains: ip-139-99-123.net 3 times

Access Suspicious Domain Outgoing Connection

The file /tmp/.../keep-alive was downloaded and executed 40 times

Download and Execute

The file /tmp/.../lib/.keep_alive/0_uid0 was downloaded and executed 151 times

Download and Execute

History File Tampering detected from /usr/sbin/sshd on the following logs: /root/.bash_history

Log Tampering

History File Tampering detected from /usr/sbin/sshd

Log Tampering

The file /usr/local/bin/dash was downloaded and executed

Download and Execute

A user logged in using SSH with the following credentials: root / ************ - Authentication policy: Correct Password

Successful SSH Login

Connection was closed due to timeout

Associated Files

/tmp/.../install/dir_set.filepart

SHA256: 0b40a2904f4521fe4d433d0c0b533265496b10ea0213c8f963f16a6ac3b11876

2476048 bytes

/tmp/.../lib/.keep_alive/hd_proc

SHA256: 22a30e633b707204b621763846a9522878e296723fd5f56cbb00e513a0a9f4b3

296 bytes

/tmp/.../lib/.cron/.daily-tick

SHA256: 23423b3276c8895b33e6df50db7bf9e298db68ed6c44b5e75a4c2e79de36ca84

17080 bytes

/tmp/.../lib/.cron/.cron

SHA256: 4eaafce77887160989c6428f5fb6c109ebcb6d8c5bce4486961ebf966eea4906

17072 bytes

/tmp/.../miner.zip

SHA256: 7755ad05d3fb8fb17651675a00bf42ffb91dd8b7ab86a7e00e84fcfc9ae5ea29

5188089 bytes

/tmp/.../start

SHA256: 7fa14e2f08c97fe02e8cdd078fa64ced0560a512b343cc21157eeb98fe80aa83

83 bytes

/tmp/.../install/install

SHA256: 824ae7976a975e3742ab5d454362013982e7b669c94cf7185979e9fee82a8729

1775 bytes

/root/users

SHA256: 8cc685a63dcef481a5e19c2eedf6abf25bcc9996323b17db16227796079dc77d

488 bytes

/tmp/.../lib/.cron/.cron-tick

SHA256: bf4b5b111647bdabbc3d3f88d61e7d6a92925016e8b06f93d1ed4d4a5ae21f83

17080 bytes

/tmp/.../lib/.keep_alive/1_uid0

SHA256: cfcc9f62930bffa9cee4b573e1e846ea77fb2fc4121f62e2267d65f7344d7263

23336 bytes

/tmp/.../lib/.keep_alive/daily

SHA256: f17d88836b71a2311dc4ce464b959030e040996cf67dacd2a6deac4f4d57c34b

109 bytes