Cyber Threat Intelligence

Discover malicious IPs and domains with Akamai Guardicore Segmentation

IP Address: 89.185.27.95Previously Malicious

IP Address: 89.185.27.95Previously Malicious

This IP address attempted an attack on a machine in our threat sensors network

Threat Information

Role

Attacker, Scanner

Services Targeted

SSH

Tags

Service Creation Listening Access Suspicious Domain HTTP SSH Download and Execute Successful SSH Login Download File Outgoing Connection Port 4001 Scan 1 Shell Commands Download and Allow Execution Service Start

Associated Attack Servers

tnx.nl tsukuba.ac.jp

3.0.200.55 52.206.178.1 58.220.83.37 104.24.123.146 106.118.240.15 110.245.41.240 110.245.42.178 110.254.34.87 116.202.55.106 117.80.194.166 130.158.75.44 139.178.69.135 146.112.255.205 176.58.123.25 182.138.122.36 192.168.1.152 192.168.1.153 192.168.1.205 192.168.4.224 193.200.132.187 204.237.142.152 206.116.153.42 207.6.222.55 218.102.175.82

Basic Information

IP Address

89.185.27.95

Domain

-

ISP

TVCOM Ltd.

Country

Ukraine

WHOIS

Created Date

-

Updated Date

-

Organization

-

First seen in Akamai Guardicore Segmentation

2020-05-16

Last seen in Akamai Guardicore Segmentation

2020-05-16

What is Akamai Guardicore Segmentation
Akamai Guardicore Segmentation is a data center and cloud security solution that protects the organization's core assets, using flexible, quickly deployed and easy to understand micro-segmentation controls. Akamai Guardicore Segmentation generates in-context security incidents, with details on attacker tools and techniques, that help IR teams prioritize incident investigation and reduce dwell time. Learn More

Attack Flow

A user logged in using SSH with the following credentials: root / ******* - Authentication policy: White List

Successful SSH Login

Process /usr/bin/wget generated outgoing network traffic to: 218.102.175.82:37855

Outgoing Connection

The file /tmp/storm was downloaded and executed 17 times

Download and Execute

Process /tmp/storm started listening on ports: 44098

Listening

Process /tmp/storm generated outgoing network traffic to: 10.0.24.62:4001, 100.25.43.190:4001, 104.131.131.82:4001, 104.24.123.146:80, 106.118.240.15:5122, 110.245.41.240:5146, 110.245.42.178:5171, 110.254.34.87:25600, 116.202.55.106:443, 117.80.194.166:45457, 122.51.24.238:4001, 130.158.75.44:80, 139.162.45.20:4001, 139.178.69.135:4001, 139.178.69.135:4002, 146.112.255.205:80, 147.75.109.213:4001, 147.75.77.187:4001, 147.75.83.83:4001, 147.75.94.115:4001, 159.69.30.217:4001, 172.17.0.1:4001, 172.17.0.3:4001, 172.217.6.19:80, 176.58.123.25:80, 182.138.122.36:42145, 182.138.122.36:43240, 182.138.122.36:43441, 182.138.122.36:43527, 182.138.122.36:43819, 182.138.122.36:44363, 182.138.122.36:45910, 182.138.122.36:45924, 192.168.1.13:4001, 192.168.1.151:4001, 192.168.1.152:4003, 192.168.1.153:4003, 192.168.1.205:4003, 192.168.1.3:4001, 192.168.4.224:10001, 193.200.132.187:443, 193.200.132.187:80, 204.237.142.152:80, 206.116.153.42:4003, 207.6.222.55:4003, 216.239.32.21:443, 3.0.200.55:4001, 3.0.200.55:50881, 3.82.110.131:4001, 52.206.178.1:80, 58.220.83.37:3185 and 8.8.8.8:53

Outgoing Connection

Process /tmp/storm scanned port 4001 on 20 IP Addresses

Port 4001 Scan

Process /tmp/storm attempted to access suspicious domains: dns.google, gateway-stage2, icanhazip.com and tnx.nl

Access Suspicious Domain Outgoing Connection

Service storm was created and started

Service Start Service Creation

The file /usr/bin/storm was downloaded and executed 16 times

Download and Execute

Process /lib/systemd/systemd started listening on ports: 46711

Listening

Connection was closed due to timeout