root@53ef41d5da39:/mnt# cat ftp.log  | zeek-grep RETR| zeek-cut id.resp_p command arg fuid 
21      RETR    ftp://172.31.39.46/./.backup    FgMmRQ11qkbBo3KqNd
21      RETR    ftp://172.31.39.46/./fetch.sh   FFyvQZ69UFh3EsEbj
24456   RETR    ftp://172.31.39.46/./.archived.sql      Fjikrz1twh8YRR8H34
24456   RETR    ftp://172.31.39.46/./Tasks to get Done.docx     FYD8L514rIoyQiOZZ3

Copy

24456

date -d @1679396330.288134
Tue Mar 21 10:58:50 UTC 2023
Copy

cat ftp.log | zeek-grep 3.109.209.43 | grep abdul | less -S
Copy

login-successful time

date -d @1679396401.595583
Tue Mar 21 11:00:01 UTC 2023
Copy

clues ->

Forela.

and .reminder file ->

A reminder to clean up the github repo. Some sensitive data could have been leaked from there
Copy

https://github.com/forela-finance/forela-dev/

In the commit's i found the password ->

YHUIhnollouhdnoamjndlyvbl398782bapd
Copy