IntrusionLabs IntrusionLabs
← Back to feed

121.184.119.91

TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
Threat Confidence
38%
Assessment
Malware dropper: logs in and downloads payloads
  • Downloaded 2 files and ran 28 commands on the host.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇰🇷 KR / Nonsan
ASN
AS4766 · Korea Telecom
Cloud Provider
—
Total Events
47
Above average by volume
Agent Count
1
First / Last Seen
2026-10-09 21:17 — 2026-10-09 21:20
Attack Types
telnet:intrusion telnet:malware
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
malware_dropper ×1 interactive_operator ×1
Sessions
2 (2 with login)
Avg Depth Score
0.95
Commands Executed
28
Files Downloaded
2
Notable Commands
  • sh
  • shell
  • shell
  • enable
  • enable
  • system
  • system
  • ping; sh
  • CMD:
  • /bin/busybox HISILICON
Download URLs
  • http://130.12.180.212/x86_64
Evidence Timeline
Malware Dropper a48f7e0cb82b greencloud_phx_01 · 2026-10-09 21:17
17 2 1 100%
Loading events...
Interactive Operator 660c631d52d0 greencloud_phx_01 · 2026-10-09 21:17
11 1 90%
Loading events...