That appears to be a successful login lasting for less than one minute. The
last command only shows successful logins by default.
You can confirm it by examining your system logs (e.g.
/var/log/audit/audit.log) and looking for login and logout events.
I recently had a chance to examine a compromised machine, and the compromise followed a similar pattern. After the first successful compromise, the attacker may simply make note of your server's information to be passed along later to other criminals. If your system remains open, expect logins over the next few days from all over the world.