From bef08f968baf5e0fa534b4c2c95b07ab8416e70c Mon Sep 17 00:00:00 2001 From: hrbrmstr Date: Mon, 15 Jun 2026 02:53:38 -0400 Subject: chore: weekly asn update --- kevlar/2026-06-15/iocs/fingerprints.txt | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 kevlar/2026-06-15/iocs/fingerprints.txt (limited to 'kevlar/2026-06-15/iocs/fingerprints.txt') diff --git a/kevlar/2026-06-15/iocs/fingerprints.txt b/kevlar/2026-06-15/iocs/fingerprints.txt new file mode 100644 index 0000000..81daedd --- /dev/null +++ b/kevlar/2026-06-15/iocs/fingerprints.txt @@ -0,0 +1,13 @@ +# JA4 TLS Fingerprints +t13i1909h2_9dc949149365_97f8aa674fd9 -- SPARK C2 beacon, 1 IP (185.100.87.136), FLOKINET +t13i1310h1_f57a46bbacb6_e7c285222651 -- Firefox 140 on Linux, 1 IP (45.83.20.230), THE + +# JA3 Legacy Fingerprints +7c1e207beb00684bbbe144f1b0abe1d5 -- SPARK C2 beacon (JA3 counterpart of above) + +# JA4H HTTP Fingerprints +ge11nn0400_88d30a62b7ad -- SPARK C2 HTTP client, 1 IP, FLOKINET +ge11nn0400_9c3956fad5da -- go-dockerclient Docker API scanner, KAOPU-HK + +# HASSH SSH Fingerprints +f555226df1963d1d3c09daf865abdc9a -- libssh 0.9.6, 3 IPs (138.124.99.219, 109.172.95.248, 85.192.31.14), AEZA -- cgit v1.2.3