fingerprints.yaml

---
name: "Cobalt Strike"
censys_query: "services.service_name: COBALT_STRIKE"
censys_virtual_hosts: true
malware_name: "win.cobalt_strike"
confidence_level: 100
tags: [C2]
---
name: "Gh0st RAT"
censys_query: "services.service_name: GHOST"
censys_virtual_hosts: false
malware_name: "win.ghost_rat"
confidence_level: 75
tags: [C2, RAT]
---
name: "DarkComet"
censys_query: "services.service_name: DARKCOMET"
censys_virtual_hosts: false
malware_name: "win.darkcomet"
confidence_level: 100
tags: [C2]
---
name: "DarkGate"
censys_query: "services.service_name: DARKGATE"
censys_virtual_hosts: true
malware_name: "win.darkgate"
confidence_level: 100
tags: [C2]
---
name: "Sliver"
censys_query: "services.software.product: Sliver"
censys_virtual_hosts: false
malware_name: "win.sliver"
confidence_level: 90
tags: [C2]
---
name: ShadowPad
censys_query: "services.software.product: ShadowPad"
censys_virtual_hosts: true
malware_name: win.shadowpad
confidence_level: 90
tags: [C2, RAT]
---
name: "Supershell"
censys_query: "services.software.product: Supershell"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, Supershell]
---
name: "AsyncRAT"
censys_query: "services.software.product: AsyncRAT"
censys_virtual_hosts: true
malware_name: "win.asyncrat"
confidence_level: 100
tags: [C2, RAT]
---
name: "Mythic"
censys_query: "services.software.product: Mythic"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, Mythic]
---
name: "Hookbot"
censys_query: "services.software.product: Hookbot"
censys_virtual_hosts: true
malware_name: apk.hook
confidence_level: 100
tags: [C2, Hookbot]
---
name: "Scarab Botnet"
censys_query: "services.software.product: Scarab"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, Scarab, Botnet]
---
name: "Echida Botnet"
censys_query: 'services.software.product: Echida'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Echida, Botnet]
---
name: "Quasar RAT"
censys_query: "services.software.product: Quasar"
censys_virtual_hosts: true
malware_name: "win.quasar_rat"
confidence_level: 100
tags: [C2, RAT]
---
name: "Havoc"
censys_query: "services.software.product: Havoc"
censys_virtual_hosts: true
malware_name: "win.havoc"
confidence_level: 100
tags: [C2]
---
name: "VenomRAT"
censys_query: "services.software.product: VenomRAT"
censys_virtual_hosts: true
malware_name: "win.venom"
confidence_level: 100
tags: [C2, RAT]
---
name: "L3MON"
censys_query: "services.software.product: L3MON"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, L3MON]
---
name: "Orcus RAT"
censys_query: "services.software.product: Orcus"
censys_virtual_hosts: false
malware_name: "win.orcus_rat"
confidence_level: 100
tags: [C2, RAT]
---
name: "DcRat"
censys_query: "services.software.product: DcRat"
censys_virtual_hosts: false
malware_name: "win.dcrat"
confidence_level: 100
tags: [C2, RAT]
---
name: "PoshC2"
censys_query: "services.software.product: PoshC2"
censys_virtual_hosts: false
malware_name: "win.poshc2"
confidence_level: 100
tags: [C2]
---
name: "DeimosC2"
censys_query: "services.software.product: DeimosC2"
censys_virtual_hosts: true
malware_name: "win.deimos_c2"
confidence_level: 100
tags: [C2]
---
name: "RisePro"
censys_query: "services.software.product: RisePro"
censys_virtual_hosts: false
malware_name: "win.risepro"
confidence_level: 100
tags: [C2]
---
name: "ERMAC"
censys_query: "services.software.product: ERMAC"
censys_virtual_hosts: false
malware_name: "apk.ermac"
confidence_level: 100
tags: [C2]
---
name: "Covenant"
censys_query: "services.software.product: Covenant"
censys_virtual_hosts: false
malware_name: "unknown"
confidence_level: 100
tags: [C2, Covenant]
---
name: "BitRAT"
censys_query: "services.software.product: BitRAT"
censys_virtual_hosts: true
malware_name: "win.bit_rat"
confidence_level: 100
tags: [C2, RAT]
---
name: "BlackDolphin"
censys_query: "services.software.product: BlackDolphin"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, BlackDolphin]
---
name: "Artemis Rat"
censys_query: "services.software.product: 'Artemis Rat'"
censys_virtual_hosts: false
malware_name: "unknown"
confidence_level: 100
tags: [C2, "Artemis Rat"]
---
name: "Godzilla Loader"
censys_query: "services.software.product: godzilla-loader"
censys_virtual_hosts: false
malware_name: win.godzilla_loader
confidence_level: 100
tags: [C2, GodzillaLoader, Loader]
---
name: "JinxLoader"
censys_query: 'services.software.product: JinxLoader'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, JinxLoader, Loader]
---
name: "Neptune Loader"
censys_query: 'services.software.product: neptune-loader'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, NeptuneLoader, Loader]
---
name: "NimPlant"
censys_query: "services.software.product: NimPlant"
censys_virtual_hosts: true
malware_name: "win.nimplant"
confidence_level: 100
tags: [C2]
---
name: "Ares RAT"
censys_query: 'services.software.product: "Ares RAT"'
censys_virtual_hosts: true
malware_name: "win.ares"
confidence_level: 90
tags: [C2, RAT]
---
name: "byob"
censys_query: "services.software.product: byob"
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, byob, Botnet]
---
name: "Vshell"
censys_query: "services.software: (vendor: Vshell and product: Vshell)"
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, Vshell]
---
name: "Gotham Stealer"
censys_query: "services.software.product: gotham-stealer"
censys_virtual_hosts: true
malware_name: "unknown"
confidence_level: 100
tags: [C2, stealer, GothamStealer]
---
name: "Lumma Stealer"
censys_query: 'services.software.product: lumma-stealer'
censys_virtual_hosts: false
malware_name: win.lumma
confidence_level: 100
tags: [C2, Stealer]
---
name: "Meduza Stealer"
censys_query: "services.software.product: meduza-stealer"
censys_virtual_hosts: true
malware_name: "win.meduza"
confidence_level: 100
tags: [C2, Stealer]
---
name: "Bandit Stealer"
censys_query: "services.software.product: bandit-stealer"
censys_virtual_hosts: false
malware_name: "win.bandit"
confidence_level: 100
tags: [C2, Stealer]
---
name: "Atomic Stealer"
censys_query: "services.software.product: atomic-stealer"
censys_virtual_hosts: false
malware_name: osx.amos
confidence_level: 100
tags: [C2, Stealer, Amos]
---
name: "Serpent Stealer"
censys_query: "services.software.product: serpent-stealer"
censys_virtual_hosts: true
malware_name: win.serpent
confidence_level: 100
tags: [C2, stealer, SerpentStealer]
---
name: "Axile Stealer"
censys_query: 'services.software.product: axile-stealer'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Stealer, AxileStealer]
---
name: "Vector Stealer"
censys_query: 'services.software.product: vector-stealer'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Stealer, VectorStealer]
---
name: "Mint Stealer"
censys_query: 'services.software.product: mint-stealer'
censys_virtual_hosts: true
malware_name: win.mintstealer
confidence_level: 100
tags: [C2, Stealer, MintStealer]
---
name: "Z3us Stealer"
censys_query: 'services.software.product: z3us-stealer'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Stealer, Z3usStealer]
---
name: "Rastro Stealer"
censys_query: 'services.software.product: rastro-stealer'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Stealer, RastroStealer]
---
name: "DarkEye Stealer"
censys_query: 'services.software.product: darkeye-stealer'
censys_virtual_hosts: true
malware_name: win.darkeye
confidence_level: 100
tags: [C2, Stealer, DarkEyeStealer]
---
name: "Agniane Stealer"
censys_query: 'services.software.product: agniane-stealer'
censys_virtual_hosts: true
malware_name: win.cinoshi
confidence_level: 100
tags: [C2, Stealer, AgnianeStealer]
---
name: "Epsilon Stealer"
censys_query: 'services.software.product: epsilon-stealer'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Stealer, EpsilonStealer]
---
name: "Kaiji"
censys_query: 'services.software.product: Kaiji'
censys_virtual_hosts: false
malware_name: elf.kaiji
confidence_level: 100
tags: [C2]
---
name: MooBot
censys_query: 'services.software.product: MooBot'
censys_virtual_hosts: false
malware_name: elf.moobot
confidence_level: 100
tags: [C2]
---
name: "Bahamut"
censys_query: 'services.software.product: Bahamut'
censys_virtual_hosts: true
malware_name: apk.bahamut
confidence_level: 100
tags: [C2]
---
name: "Unam Web Panel"
censys_query: 'services.software.product: UnamWebPanel'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Unam]
---
name: "Vidar"
censys_query: 'services.software.product: Vidar'
censys_virtual_hosts: false
malware_name: win.vidar
confidence_level: 100
tags: [C2]
---
name: "BlackNET RAT"
censys_query: 'services.software.product: "BlackNET RAT"'
censys_virtual_hosts: true
malware_name: "win.blacknet_rat"
confidence_level: 100
tags: [C2, RAT]
---
name: "Kraken RAT"
censys_query: 'services.software.product: kraken-rat'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, RAT, KrakenRAT, Banking]
---
name: Godfather
censys_query: services.http.response.favicons.md5_hash="e89cd917faec4357a5ad4f36960c6681"
censys_virtual_hosts: true
malware_name: apk.godfather
confidence_level: 100
tags: [C2]
---
name: "T34 Loader"
censys_query: services.http.response.body_hash="sha1:72f04cc3475d5cd6afcbf51ab3ff0f8dcd730618"
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 75
tags: [C2, T34loader, Loader]
---
name: Bumblebee
censys_query: 'services.software.product: Bumblebee'
censys_virtual_hosts: true
malware_name: win.bumblebee
confidence_level: 75
tags: [C2]
---
name: "Viper"
censys_query: 'services.software.product: Viper'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [Viper]
---
name: "EvilGinx"
censys_query: 'services.software.product: EvilGinx'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [Phishing, EvilGinx]
---
name: "GoPhish"
censys_query: 'services.software.product: GoPhish'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [Phishing, GoPhish]
---
name: "EvilGoPhish"
censys_query: 'services.software.product: EvilGoPhish'
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [Phishing, EvilGoPhish]
---
name: "Octopus"
censys_query: services.http.response.body="<title>Under development</title><center><h1>Under
  development server</h1></center>"
censys_virtual_hosts: false
malware_name: ps1.octopus
confidence_level: 100
tags: [C2]
# ---
# name: "DarkTrack RAT"
# censys_query: 'services.banner_hashes="sha256:4a991f13b7cbe3b35aeeecbf8a22c9e271b1ba58624dc8845454b8cb750406aa"'
# censys_virtual_hosts: false
# malware_name: win.darktrack_rat
# confidence_level: 75
# tags: [C2, RAT]
# ---
# name: "Extreme RAT"
# censys_query: services.banner_hashes="sha256:4b68ab3847feda7d6c62c1fbcbeebfa35eab7351ed5e78f4ddadea5df64b8015"
# censys_virtual_hosts: false
# malware_name: win.extreme_rat
# confidence_level: 100
# tags: [C2, RAT]
---
name: Copper
censys_query: services.http.response.body_hashes="sha1:0f862b28435c36c31531d66006a638d97a85f649"
censys_virtual_hosts: true
malware_name: unknown
confidence_level: 100
tags: [C2, Copper, Octo]
---
name: "EggShell"
censys_query: 'services.banner_hashes="sha256:ecc3bac73df1e6b837a175f2d850db9d2ed17e24312bf7f5a2d9db0b229ba01a"'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, EggShell]
---
name: "CloakNDaggerC2"
censys_query: 'services: (tls.certificates.leaf_data.subject_dn="C=CN, ST=GD, L=SZ,
  O=Acme\\, Inc., CN=Acme Root CA" and tls.certificates.leaf_data.names="example.com"
  and banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855")'
censys_virtual_hosts: false
malware_name: unknown
confidence_level: 100
tags: [C2, CloakNDaggerC2]
---
name: "Spynote"
censys_query: services.http.response.html_title={"Estafeta & Go", "BABYEON"}
censys_virtual_hosts: true
malware_name: "apk.spynote"
confidence_level: 100
tags: [C2]
---
name: GhostLocker
censys_query: 'services: (http.response.html_title="Affiliate Login" and software.product="Werkzeug")'
censys_virtual_hosts: true
malware_name: "win.ghost_locker"
confidence_level: 100
tags: [C2, locker, GhostLocker]
---
name: "Gafgyt"
censys_query: "services: (banner: `!* SCANNER ON` and port: 23)"
censys_virtual_hosts: false
malware_name: "elf.bashlite"
confidence_level: 90
tags: [C2, DDOS]
# ---
# name: "NetBus"
# censys_query: 'services.banner="NetBus 1.60 \r"'
# censys_virtual_hosts: false
# malware_name: "unknown"
# confidence_level: 100
# tags: [C2, NetBus]
# ---
# name: XTreme RAT
# censys_query:
#   'services.banner_hashes="sha256:22adaf058a2cb668b15cb4c1f30e7cc720bbe38c146544169db35fbf630389c4"
#   and services.port: 10001'
# censys_virtual_hosts: false
# malware_name: win.extreme_rat
# confidence_level: 100
# tags: [C2, RAT]
---
name: BianLian GO Trojan
censys_query:
  services:(banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  and tls.certificates.leaf_data.subject_dn=/C=[^,]{10,20}, O=[^,]{10,20}, OU=[^,]{10,20}/
  and tls.certificates.leaf_data.issuer_dn=/C=[^,]{10,20}, O=[^,]{10,20}, OU=[^,]{10,20}/
  and service_name:UNKNOWN)
censys_virtual_hosts: false
malware_name: win.bianlian
confidence_level: 100
tags: [C2]
---
name: Qakbot C2
censys_query:
  'services: (banner_hashes="sha256:e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  and tls.certificates.leaf_data.subject_dn: /C=[^,]+, OU=[^,]+, CN=[^,]+/ and tls.certificates.leaf_data.issuer_dn:/C=[^,]+,
  ST=[^,]+, L=[^,]+, O=[^,]+, CN=[^,]+/ and port: {443, 993, 995} and tls.certificates.leaf_data.names:
  /[a-z]{3,15}.[a-z]{2,5}/ and tls.ja3s: 475c9302dc42b2751db9edcac3b74891) and not
  operating_system.product: *'
censys_virtual_hosts: true
malware_name: win.qakbot
confidence_level: 100
tags: [C2]
---
name: Pikabot
censys_query:
  'services: (jarm.fingerprint: 21d19d00021d21d21c21d19d21d21dd188f9fdeea4d1b361be3a6ec494b2d2
  and tls.certificates.leaf_data.signature.self_signed: true and tls.certificates.leaf_data.issuer_dn:
  /C=[A-Z]{2}, ST=[A-Z]{2}, O=([A-Z][a-z]{2,})( [A-Z][a-z\.]{2,}){0,5}, OU=([A-Z][a-z]{2,})(
  [A-Z][a-z\.]{2,}){0,5}, L=([A-Z][a-z]{2,})( [A-Z][a-z]{2,}){0,2}, CN=.*/)'
censys_virtual_hosts: false
malware_name: win.pikabot
confidence_level: 75
tags: [C2]
---