diff options
| author | hrbrmstr <bob@rud.is> | 2026-06-15 02:53:38 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-06-15 02:53:38 -0400 |
| commit | bef08f968baf5e0fa534b4c2c95b07ab8416e70c (patch) | |
| tree | 56d50e76af00ee62a63c4f944da9cda2cbb0a684 /kevlar/2026-06-15/iocs/fingerprints.txt | |
| parent | 8d2890e93ff96fc21d6e00fe0a03cf4b1a871271 (diff) | |
chore: weekly asn update
Diffstat (limited to 'kevlar/2026-06-15/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-06-15/iocs/fingerprints.txt | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/kevlar/2026-06-15/iocs/fingerprints.txt b/kevlar/2026-06-15/iocs/fingerprints.txt new file mode 100644 index 0000000..81daedd --- /dev/null +++ b/kevlar/2026-06-15/iocs/fingerprints.txt @@ -0,0 +1,13 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 1 IP (185.100.87.136), FLOKINET +t13i1310h1_f57a46bbacb6_e7c285222651 -- Firefox 140 on Linux, 1 IP (45.83.20.230), THE + +# JA3 Legacy Fingerprints +7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon (JA3 counterpart of above) + +# JA4H HTTP Fingerprints +ge11nn0400_88d30a62b7ad -- SPARK C2 HTTP client, 1 IP, FLOKINET +ge11nn0400_9c3956fad5da -- go-dockerclient Docker API scanner, KAOPU-HK + +# HASSH SSH Fingerprints +f555226df1963d1d3c09daf865abdc9a -- libssh 0.9.6, 3 IPs (138.124.99.219, 109.172.95.248, 85.192.31.14), AEZA |