IntrusionLabs IntrusionLabs
← Back to feed

161.132.4.167

Threat Confidence
49%
Location
🇵🇪 PE
ASN
AS3132 · Red Cientifica Peruana
Cloud Provider
—
Total Events
74
Above average by volume
Agent Count
1
First / Last Seen
2026-04-16 15:08 — 2026-04-16 15:17
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.002
Initial Access
T1078
Execution
T1059.004
Credential Access
T1110 T1110.001
Discovery
T1046 T1082 T1083
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
scanner ×2 credential_probe ×2 interactive_operator ×5
Sessions
9 (5 with login)
Avg Depth Score
0.58
Commands Executed
25
Files Downloaded
0
Notable Commands
  • export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null); arch=$(uname -m 2>/dev/null); uptime=$(cat /proc/uptime 2>/dev/null | cut -d. -f1); cpus=$( (nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null) | head -1); cpu_model=$( (grep -m1 -E "model name|Hardware" /proc/cpuinfo | cut -d: -f2- | sed 's/^ *//;s/ *$//' ; lscpu 2>/dev/null | awk -F: '/Model name/ {gsub(/^ +| +$/,"",$2); print $2; exit}' ; dmidecode -s processor-version 2>/dev/null | head -n1 ; uname -p 2>/dev/null) | awk 'NF{print; exit}' ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia) 2>/dev/null | head -n50); cat_help=$( (cat --help 2>&1 | tr '\n' ' ') || cat --help 2>&1); ls_help=$( (ls --help 2>&1 | tr '\n' ' ') || ls --help 2>&1); last_output=$(last 2>/dev/null | head -n 10); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "CAT_HELP:$cat_help"; echo "LS_HELP:$ls_help"; echo "LAST:$last_output"
  • uname -s -v -n -m 2 > /dev/null
  • uname -m 2 > /dev/null
  • cat /proc/uptime 2 > /dev/null | cut -d. -f1
  • cut -d. -f1
Fingerprints
HASSH
2ec37a7cc8daf20b10e1ad6221061ca5
SSH Client
SSH-2.0-Go
Evidence Timeline
Interactive Operator 5b1ccc4abfe4 w4m_seattle_01 · 2026-04-16 15:17
5 1 90%
Loading events...
Interactive Operator a94c79db6e37 w4m_seattle_01 · 2026-04-16 15:16
5 1 90%
Loading events...
Interactive Operator b9b70467243c w4m_seattle_01 · 2026-04-16 15:15
5 1 90%
Loading events...
Credential Probe e3a5354790b6 w4m_seattle_01 · 2026-04-16 15:14
1 20%
Loading events...
Scanner 083e538cfb00 w4m_seattle_01 · 2026-04-16 15:14
15%
Loading events...
Interactive Operator c8fe7c767b94 w4m_seattle_01 · 2026-04-16 15:13
5 1 90%
Loading events...
Interactive Operator 6f1b729ea354 w4m_seattle_01 · 2026-04-16 15:11
5 1 90%
Loading events...
Credential Probe 977017ebb7e5 w4m_seattle_01 · 2026-04-16 15:10
1 20%
Loading events...
Scanner fd06af307d5a w4m_seattle_01 · 2026-04-16 15:08
15%
Loading events...