diff options
| author | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
|---|---|---|
| committer | hrbrmstr <bob@rud.is> | 2026-08-17 07:45:20 -0400 |
| commit | 237f2d9330398e0a0628980056db6b09098d5f2f (patch) | |
| tree | 09f16c0f363ee4a23bdc64cf3cfaab7562a80432 /kevlar/2026-08-17/iocs/fingerprints.txt | |
| parent | 7439049b2d46c035fda40b27d3f64b0b9f48af8a (diff) | |
feat: update bph iocs
Diffstat (limited to 'kevlar/2026-08-17/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-08-17/iocs/fingerprints.txt | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/kevlar/2026-08-17/iocs/fingerprints.txt b/kevlar/2026-08-17/iocs/fingerprints.txt new file mode 100644 index 0000000..7bb669f --- /dev/null +++ b/kevlar/2026-08-17/iocs/fingerprints.txt @@ -0,0 +1,19 @@ +# JA4 TLS Client Fingerprints +t13i190800_9dc949149365_97f8aa674fd9 -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD +t13i251000_b78ed14e2fd0_ab7e3b40a677 -- .git/HEAD probe, 77.83.39.94, KPRONET/PFCLOUD +t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 185.100.87.136, FLOKINET +t13i1310h1_f57a46bbacb6_e7c285222651 -- TLS web probe, 193.247.77.84 HOSTKEY; 179.43.146.27 PLI +t13i311000_e8f1e7e78f70_d41ae481755e -- .env/trpc probes, 179.43.150.26, PLI-AS +# JA3 TLS Client Fingerprints +7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon, 185.100.87.136, FLOKINET +19e29534fd49dd27d09234e639c4057e -- .env UA-rotator, 77.83.39.6, KPRONET/PFCLOUD +416eca07dcaad72dec6f76d1277b3eff -- .git/HEAD probe, 77.83.39.94 +004556e859f3c26c5d19746b3a957c74 -- 179.43.150.26, PLI-AS +# JA4H HTTP Client Fingerprints +po11nn0600_c9506d37ac14 -- SPARK POST /api/client/update, 185.100.87.136 +po11nn0700_e1eadaf42879 -- WinRM /wsman, shared KAOPU 154.93.53.239 + PLI 179.43.185.147 +ge11nn0500_9af7e0472034 -- .env/.git exfil over TLS, 77.83.39.6/.94 +ge11nn0400_9c3956fad5da -- Go-http-client/1.1 proxy checker, PFCLOUD +# HASSH SSH Client Fingerprints +41ff3ecd1458b0bf86e1b4891636213e -- PFCLOUD cloned fleet + .env crawler (77.83.39.6); also 204.76.203.221/214 prior week +e54ef3ec27fe1fea7ab64d3fa05359fd -- SPARK C2 client, 185.100.87.136, FLOKINET |