Single SSH brute-force session used root/---fuck_you---- from SSH-2.0-Go. After login, the actor che ...
show moreSingle SSH brute-force session used root/---fuck_you---- from SSH-2.0-Go. After login, the actor checked uname -m and uname -s, then attempted to stage /tmp/aarch64 and download it with wget from hxxp://31[.]56[.]209[.]73:32461/b/aarch64. The file was chmod 777, then removed with rm -f aarch64. No persistence, port forwarding, lateral movement, or additional credentials observed. One external payload URL was referenced; no dropped artifacts were reported.
show less
SSH login attempt using root with password ---fuck_you---- from an SSH-2.0-Go client. After authenti ...
show moreSSH login attempt using root with password ---fuck_you---- from an SSH-2.0-Go client. After authentication, the session ran uname -s -m to fingerprint the host OS and architecture. No downloads, dropped files, persistence, port forwarding, or lateral movement were observed. Two sessions occurred within 6 seconds, indicating rapid repeated access attempts.
show less
SSH brute-force activity with 3 sessions in 3 seconds using libssh_0.9.6. Tried credentials: 345gs56 ...
show moreSSH brute-force activity with 3 sessions in 3 seconds using libssh_0.9.6. Tried credentials: 345gs5662d34/345gs5662d34, sg/123456, and sg/3245gs5662d34. After access, attacker removed and recreated ~/.ssh, then wrote an SSH public key beginning with ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... into the directory. Second command attempted to clear file attributes on ~/.ssh using chattr -ia .ssh and lockr -ia .ssh. No downloads, payload execution, port forwards, or lateral movement were observed.
show less
SSH brute-force and post-login activity over 7 sessions. Tried credentials: admin/letmein, admin1/12 ...
show moreSSH brute-force and post-login activity over 7 sessions. Tried credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, root/root. SSH clients seen: SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Observed upload of file .16 to /home/honeypot/.16, followed by execution attempts with sudo and direct launch. Commands show chmod +x on /home/honeypot/.16, repeated runs of /home/honeypot/.16, and cleanup actions to remove the file, clear shell history, and overwrite /var/log/wtmp. Also observed check_3fb159da69e9dbc84e4d560b8fd7bef8_transport_done and check_7c9033dee2d2879d96180f9f0cbed5ff_transport_done. No additional lateral movement or port-forwarding commands were observed.
show less
SSH brute-force and command-execution activity across 9 sessions over ~11 minutes. Tried multiple ro ...
show moreSSH brute-force and command-execution activity across 9 sessions over ~11 minutes. Tried multiple root passwords: passw0rd, password, password1, qwerty, r00t, root, root!@#. SSH client identified as SSH-2.0-Go. After login, executed sudo-wrapped nproc/cpu-count checks using the attempted passwords, then issued many probe commands beginning with "echo; echo 'check_<hex>_transport_done'". No dropped files, downloads, port forwards, persistence, lateral movement, or malware artifacts were observed in the provided session data.
show less
Three SSH login attempts in 3 sessions using libssh_0.11.1: 345gs5662d34/345gs5662d34, autcom/3245gs ...
show moreThree SSH login attempts in 3 sessions using libssh_0.11.1: 345gs5662d34/345gs5662d34, autcom/3245gs5662d34, and autcom/autcom. After login, the actor ran “cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx...” to overwrite the SSH directory and install an RSA public key for access. A second command, “cd ~; chattr -ia .ssh; lockr -ia .ssh”, removed immutable attributes and attempted to re-lock the .ssh directory. No downloads, malware drop, port forwarding, lateral movement, or other persistence was observed beyond the SSH key setup and attribute changes.
show less
Tried 3 root logins in a 7-second window: root/r, root/root3245gs5662d34111111111, and rootssssss234 ...
show moreTried 3 root logins in a 7-second window: root/r, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. SSH client identified as SSH-2.0-libssh_0.9.6. After access, the actor ran cd ~ && rm -rf .ssh && mkdir .ssh and began writing an ssh-rsa public key into .ssh for access persistence. A second command attempted cd ~; chattr -ia .ssh; lockr -ia .ssh, removing immutable/append-only protections before modifying the SSH directory. No downloads, lateral movement, or dropped files were observed.
show less
8 SSH sessions over 13 minutes using SSH-2.0-Go. Tried weak root passwords: 123456, 1234567, 1234567 ...
show more8 SSH sessions over 13 minutes using SSH-2.0-Go. Tried weak root passwords: 123456, 1234567, 12345678, 123456789, 1234abcd, 123abc, 123qwe, 1q2w3e. After login, ran sudo-wrapped checks to discover CPU count with nproc/busybox/grep, then executed many “check_<id>_transport_done” echo commands. No downloads, file drops, persistence, port forwarding, or lateral movement observed. Activity was limited to credential brute force and host enumeration.
show less
3 SSH sessions using root/123456@A from SSH-2.0-libssh_0.9.6. Activity focused on host profiling and ...
show more3 SSH sessions using root/123456@A from SSH-2.0-libssh_0.9.6. Activity focused on host profiling and persistence setup: queried CPU model/core info, disk and memory with df and free, checked crontab, and inspected ls binary details. Modified the root account password with echo "root:sFOI4jEmqHig"|chpasswd|bash. Attempted to prepare SSH persistence by removing and recreating /root/.ssh, then writing an ssh-rsa public key into it. Also ran chattr -ia .ssh and lockr -ia .ssh to clear immutable/append-only attributes before changes. No downloads, port forwards, lateral movement, or dropped artifacts were observed in the captured commands.
show less
Two SSH sessions from SSH-2.0-Go used admin/letmein and root/root. Attacker uploaded the same file t ...
show moreTwo SSH sessions from SSH-2.0-Go used admin/letmein and root/root. Attacker uploaded the same file twice as /home/honeypot/.16, then tried to execute it, chmod +x it, and remove it. Commands also attempted to clear evidence: echo -n '' > /var/log/wtmp, rm -rf .bash_history, and history -c. No downloads, port forwards, or lateral movement were observed. Additional commands were simple status checks: echo 'check_1d8df459ff04a1841e00aa64da3387b4_transport_done' and echo 'check_5695860c271f461824d3e81d74d31406_transport_done'. The activity shows file drop, execution attempts, and anti-forensics on the SSH account.
show less
6 SSH sessions from SSH-2.0-libssh_0.9.6 used three root username/password pairs: root/123QWEqwe, ro ...
show more6 SSH sessions from SSH-2.0-libssh_0.9.6 used three root username/password pairs: root/123QWEqwe, root/root3245gs5662d34111111111, and rootssssss23424123123/rootssssss23424123123. The attacker executed 2 commands in 4 runs: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx... and cd ~; chattr -ia .ssh; lockr -ia .ssh. Observed activity shows credential guessing, destructive removal/recreation of the .ssh directory, attempted injection of an SSH public key for access, and attempts to remove immutability/attributes on .ssh for persistence or modification. No downloads, lateral movement, or dropped artifacts were observed.
show less
Observed 6 SSH sessions over ~12 minutes using SSH-2.0-Go. Login attempts used root with weak passwo ...
show moreObserved 6 SSH sessions over ~12 minutes using SSH-2.0-Go. Login attempts used root with weak passwords: 111111, 123, 123123, 123321, 1234, 12345. After authentication, the actor ran repeated sudo-wrapped probes to identify CPU count via nproc / /usr/bin/nproc / busybox nproc /proc/cpuinfo and emitted multiple transport-check strings like “check_<id>_transport_done”. No files were dropped, no downloads were observed, no persistence was observed, and no lateral movement or port forwarding was observed. The activity is limited to credential guessing and basic host reconnaissance.
show less
7 SSH sessions in 3 minutes using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/ ...
show more7 SSH sessions in 3 minutes using admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. Clients identified as SSH-2.0-Go and SSH-2.0-paramiko_4.0.0. Attacker uploaded /home/honeypot/.16 twice, then tried to execute it from /home/<user>/.16, made it executable with chmod +x, and attempted cleanup with rm -rf /home/<user>/.16. Commands also show sudo -S usage with passwords 123 and root, plus checks marked check_1a25915548fc2c22c0daa343d03c4e51_transport_done and check_2604cc1774f911507b67531e697819fe_transport_done. Observed post-exploitation activity focused on running the dropped payload and removing traces: echoed blank output, attempted to clear /var/log/wtmp, delete .bash_history, and run history -c. No lateral movement observed.
show less
8 SSH sessions from SSH-2.0-Go attempted root logins with a password spray: root/root, root/root1, r ...
show more8 SSH sessions from SSH-2.0-Go attempted root logins with a password spray: root/root, root/root1, root/root12, root/root123, root/root1234, root/root12345, root/root123456, and root/root1234567. After login attempts, the client ran sudo-wrapped shell probes to identify CPU count using nproc, /usr/bin/nproc, busybox nproc, and /proc/cpuinfo, then issued many command markers like “check_<id>_transport_done”. No files were dropped and no hashes, downloads, persistence, port forwards, or lateral movement were observed. Total activity: 128 unique commands across 143 executions in 14 minutes.
show less
8 SSH sessions from SSH-2.0-Go tried 8 weak root passwords: P4ssword, P@ssw0rd, Passw0rd, p4ssword, ...
show more8 SSH sessions from SSH-2.0-Go tried 8 weak root passwords: P4ssword, P@ssw0rd, Passw0rd, p4ssword, p@ssw0rd, passw0rd, password, qwerty. After login, the actor ran sudo-wrapped checks to enumerate CPU count with nproc/grep /proc/cpuinfo, then issued many shell probes and control strings such as echo; echo 'check_009874b0fdcc745400c92c56dadbded9_transport_done' and echo; echo 'check_1b1f20ae8833acdfceaa2e626e1ee90d_transport_done'. No downloads, file writes, persistence, port forwards, lateral movement, or dropped artifacts were observed in the provided data. Activity was concentrated on credential guessing and environment/recon commands across 148 commands total.
show less
Two SSH sessions used admin/letmein and admin1/123 via SSH-2.0-Go. The actor uploaded /home/honeypot ...
show moreTwo SSH sessions used admin/letmein and admin1/123 via SSH-2.0-Go. The actor uploaded /home/honeypot/.16 twice, then attempted to execute it, chmod +x it, and later delete it with rm -rf. They ran sudo commands with both passwords, including repeated attempts to invoke the uploaded file through sudo/sh -c. They also tried to wipe traces by clearing /var/log/wtmp, deleting .bash_history, and running history -c. Additional commands included checks like echo; echo 'check_698297d8443a5368e11840a65e720d87_transport_done' and echo; echo 'check_7aeed6a26a9aa9381a94ae2427418f0c_transport_done'. No lateral movement, port forwarding, or other downloads were observed.
show less
8 SSH sessions from SSH-2.0-Go in 14 minutes. Tried root logins with weak passwords: 1234, 12345, 12 ...
show more8 SSH sessions from SSH-2.0-Go in 14 minutes. Tried root logins with weak passwords: 1234, 12345, 123456, 1234567, 12345678, 123456789, 1234567890, 123qwe. After login attempts, ran sudo-based system discovery to get CPU count via nproc or /proc/cpuinfo, then issued many echo markers such as “check_02df17ea4a73adcef7b77d189f1ebf89_transport_done” and similar “transport_done” strings. 129 unique commands / 154 total were observed. Activity was focused on credential guessing and host reconnaissance; no downloads, payload execution, persistence, port forwarding, or lateral movement were observed.
show less
Multiple SSH logins from SSH-2.0-Go using root with passwords 1, 12, and 123. Activity focused on ho ...
show moreMultiple SSH logins from SSH-2.0-Go using root with passwords 1, 12, and 123. Activity focused on host profiling and execution checks: repeated sudo-wrapped nproc/CPU enumeration, PATH export, uname collection, and numerous echo markers such as check_*_transport_done. No file downloads, dropped files, persistence, port forwarding, or lateral movement were observed. No payloads or malware artifacts were observed.
show less
Two SSH sessions used master/wasd and root/root via SSH-2.0-Go. After login, the actor uploaded /hom ...
show moreTwo SSH sessions used master/wasd and root/root via SSH-2.0-Go. After login, the actor uploaded /home/honeypot/.16 twice, then tried to execute it, make it executable with chmod +x, and remove it with rm -rf. Multiple sudo -S attempts were made with both passwords to run the file and to change its permissions, showing active privilege escalation attempts. The session also issued check_a3954ac1f5a53cda681c4b3449cb44dc_transport_done and check_b6cacc0d859b0968109c758403b37d5d_transport_done markers. No successful payload execution, persistence creation, port forwarding, lateral movement, or additional downloads were observed.
show less
37 SSH sessions over ~5 hours used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root ...
show more37 SSH sessions over ~5 hours used admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root. The attacker dropped a hidden executable named .16 (1.6 MB, sha256:9775d376f5e5b3ed0d79d1179abf0f1e6b699e71e8171b354bb063ed166e5aa0), tried to run it from /home/<user>/.16, made it executable with chmod +x, and later removed it with rm -rf. Multiple sudo -S attempts were issued with guessed passwords, and one command sequence cleared logs/history: echo -n '' > /var/log/wtmp; cd $HOME; rm -rf .bash_history; history -c. No port forwarding or lateral movement was observed.
show less
Two SSH sessions using master/wasd and root/root from SSH-2.0-Go. Attacker uploaded /home/honeypot/. ...
show moreTwo SSH sessions using master/wasd and root/root from SSH-2.0-Go. Attacker uploaded /home/honeypot/.16 twice, set it executable, and attempted to run it repeatedly. They used sudo with both credentials to execute the file, then removed it with rm -rf. One command chain also tried to clear evidence by truncating /var/log/wtmp, deleting .bash_history, and running history -c. No successful login shell activity beyond these execution attempts was observed. Several transport marker strings were issued, including check_128e833b7973f5aebde581ae59d700b4_transport_done and check_9766adf28c4b89911fac64fa317b9875_transport_done. The main activity was payload staging, execution, and log cleanup.
show less
Brute-force SSH login attempts against root used weak passwords 000000, 111111, and 123 from SSH-2.0 ...
show moreBrute-force SSH login attempts against root used weak passwords 000000, 111111, and 123 from SSH-2.0-Go. After access, the actor ran system discovery and environment checks: nproc via sudo, uname, PATH export, and repeated check_*_transport_done probes. No file downloads, dropped artifacts, persistence actions, lateral movement, or port forwarding were observed in this session. Activity was limited to reconnaissance and host capability checks across 4 sessions and 56 total commands.
show less
Multiple SSH login attempts over 11s using libssh_0.11.1 with credentials 345gs5662d34/345gs5662d34, ...
show moreMultiple SSH login attempts over 11s using libssh_0.11.1 with credentials 345gs5662d34/345gs5662d34, ubuntu/3245gs5662d34, and ubuntu/rootroot. After access, the actor tried to alter SSH access and disable protections: cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXx and cd ~; chattr -ia .ssh; lockr -ia .ssh. No downloads, dropped files, persistence beyond .ssh tampering, lateral movement, or additional recon observed.
show less
Multiple SSH login attempts used weak credentials: admin/letmein, admin1/123, ec2-user/123456, maste ...
show moreMultiple SSH login attempts used weak credentials: admin/letmein, admin1/123, ec2-user/123456, master/wasd, and root/root via SSH-2.0-Go and SSH-2.0-paramiko_4.0.0 clients. After login, the session uploaded a file named .16 twice to /home/honeypot/.16, then ran it, made it executable with chmod +x, and removed it with rm -rf. Commands also show sudo execution attempts using the supplied passwords, including direct invocation of /home/<user>/.16 under sudo. Additional output included check_0c906691b08b75e7147ec3c791684230_transport_done and check_b67d819be2fc1a7a364c1be69fc88e72_transport_done. No persistence, port forwarding, lateral movement, or other dropped artifacts were observed beyond the uploaded .16 file.
show less
2 SSH sessions over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused on a dro ...
show more2 SSH sessions over SSH-2.0-Go used credentials master/wasd and root/root. Activity focused on a dropped payload named .16 (uploaded twice to /home/honeypot/.16). The actor attempted to run it, then used sudo with both passwords to chmod +x and later rm -rf the same file. Commands also included bare execution attempts and repeated sudo shell invocations. No additional uploads, downloads, port forwarding, or lateral movement were observed. The session included multiple check_*_transport_done markers and other command probes, but no successful interactive output was observed.
show less
Brute-ForceSSHHacking
By clicking “Accept all”, you agree to the storing of cookies on your device to remember preferences and
analyze site usage.
Read more
- Required to log into your AbuseIPDB account, and store these cookie preferences.