diff options
Diffstat (limited to 'kevlar/2026-06-15/iocs/fingerprints.txt')
| -rw-r--r-- | kevlar/2026-06-15/iocs/fingerprints.txt | 13 |
1 files changed, 13 insertions, 0 deletions
diff --git a/kevlar/2026-06-15/iocs/fingerprints.txt b/kevlar/2026-06-15/iocs/fingerprints.txt new file mode 100644 index 0000000..81daedd --- /dev/null +++ b/kevlar/2026-06-15/iocs/fingerprints.txt @@ -0,0 +1,13 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 1 IP (185.100.87.136), FLOKINET +t13i1310h1_f57a46bbacb6_e7c285222651 -- Firefox 140 on Linux, 1 IP (45.83.20.230), THE + +# JA3 Legacy Fingerprints +7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon (JA3 counterpart of above) + +# JA4H HTTP Fingerprints +ge11nn0400_88d30a62b7ad -- SPARK C2 HTTP client, 1 IP, FLOKINET +ge11nn0400_9c3956fad5da -- go-dockerclient Docker API scanner, KAOPU-HK + +# HASSH SSH Fingerprints +f555226df1963d1d3c09daf865abdc9a -- libssh 0.9.6, 3 IPs (138.124.99.219, 109.172.95.248, 85.192.31.14), AEZA |