daily update Fri 15 Oct 2021 06:30:19 PM UTC

drb-ra · friendlyc0de · Sep 19, 2021 · Sep 19, 2021 · Sep 20, 2021 · Sep 20, 2021
commit d7297d5ea8300847b7a63d8a48bd81da5a5187e8
diff --git a/C2_configs/cobaltstrike.csv b/C2_configs/cobaltstrike.csv
@@ -90657,3 +90657,17 @@ lang
 stype=role_path",0,"","Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)",0,"0.0.0.0",0
 "10/15/2021 13:50:02.051","111.229.90.183","Tencent cloud computing (Beijing) Co., Ltd.",HTTPS,"111.229.90.183,/dot.gif",443,60000,0,"Use IE settings","",,Cookie,"/submit.php","Content-Type: application/octet-stream
 id",0,"","Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)",305419896,"0.0.0.0",0
+"10/15/2021 18:00:02.922","47.104.101.102","CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.",HTTP,"47.104.101.102,/ptj",8006,60000,0,0,"",,Cookie,"/submit.php","Content-Type: application/octet-stream
+id",0,"Not Found","Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)",1359593325,"Not Found","Not Found"
+"10/15/2021 18:00:17.812","91.134.14.25",OVH,HTTPS,"us-time.us,/fam_newspaper",443,61314,37,"Use IE settings","Host: us-time.us",,"Host: us-time.us
+Connection: close
+reg_fb_gate=
+Cookie","/an","Host: us-time.us
+Connection: close
+Content-Type: text/plain
+__session__id=
+Cookie",0,"Not Found","Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202",305419776,"Not Found","Not Found"
+"10/15/2021 18:00:30.820","119.3.156.24","HWCSNET Huawei Cloud Service data center",HTTP,"192.168.8.104,/visit.js",8080,60000,0,"Use IE settings","",,Cookie,"/submit.php","Content-Type: application/octet-stream
+id",0,"","Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)",305419896,"0.0.0.0",0
+"10/15/2021 18:00:36.874","39.99.181.72","CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.",HTTP,"39.99.181.72,/activity",10010,60000,0,"Use IE settings","",,Cookie,"/submit.php","Content-Type: application/octet-stream
+id",0,"","Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)",0,"0.0.0.0",0

diff --git a/C2_configs/cobaltstrike.json b/C2_configs/cobaltstrike.json
@@ -18796,4 +18796,8 @@
 {"preview":false,"offset":18795,"result":{"FirstSeen":"10/15/2021 12:56:30.536","ip":"119.91.70.28","ASN":"CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited","BeaconType":"HTTPS","C2Server":"119.91.70.28,/ga.js","Port":"80","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"Not Found","UserAgent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)","Watermark":"426352781","DNS_Idle":"Not Found","DNS_Sleep":"Not Found"}}
 {"preview":false,"offset":18796,"result":{"FirstSeen":"10/15/2021 13:03:36.322","ip":"82.156.186.133","ASN":"CNNIC-TENCENT-NET-AP Shenzhen Tencent Computer Systems Company Limited","BeaconType":"HTTP","C2Server":"service-g96td04q-1304463737.hk.apigw.tencentcs.com,/activity","Port":"80","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUS)","Watermark":"0","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
 {"preview":false,"offset":18797,"result":{"FirstSeen":"10/15/2021 13:49:43.635","ip":"2.59.214.17","ASN":"ASBAXETN","BeaconType":"HTTPS","C2Server":"2.59.214.17,/file_data/70737c74c59f36d1f518a6946512f565.jpeg","Port":"80","SleepTime":"7000","Jitter":"50","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":["Accept: */*","keepgrowUserData=","ECSESSID=","Cookie"],"HttpPostUri":"/exec/front/eclog/main","HttpPost_Metadata":["Accept: */*","NaPm=ver","lang","stype=role_path"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0)","Watermark":"0","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
-{"preview":false,"offset":18798,"lastrow":true,"result":{"FirstSeen":"10/15/2021 13:50:02.051","ip":"111.229.90.183","ASN":"Tencent cloud computing (Beijing) Co., Ltd.","BeaconType":"HTTPS","C2Server":"111.229.90.183,/dot.gif","Port":"443","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)","Watermark":"305419896","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
+{"preview":false,"offset":18798,"result":{"FirstSeen":"10/15/2021 13:50:02.051","ip":"111.229.90.183","ASN":"Tencent cloud computing (Beijing) Co., Ltd.","BeaconType":"HTTPS","C2Server":"111.229.90.183,/dot.gif","Port":"443","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; NP06)","Watermark":"305419896","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
+{"preview":false,"offset":18799,"result":{"FirstSeen":"10/15/2021 18:00:02.922","ip":"47.104.101.102","ASN":"CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.","BeaconType":"HTTP","C2Server":"47.104.101.102,/ptj","Port":"8006","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"0","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"Not Found","UserAgent":"Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0; MALC)","Watermark":"1359593325","DNS_Idle":"Not Found","DNS_Sleep":"Not Found"}}
+{"preview":false,"offset":18800,"result":{"FirstSeen":"10/15/2021 18:00:17.812","ip":"91.134.14.25","ASN":"OVH","BeaconType":"HTTPS","C2Server":"us-time.us,/fam_newspaper","Port":"443","SleepTime":"61314","Jitter":"37","Proxy_Behavior":"Use IE settings","HostHeader":"Host: us-time.us","HttpGet_Metadata":["Host: us-time.us","Connection: close","reg_fb_gate=","Cookie"],"HttpPostUri":"/an","HttpPost_Metadata":["Host: us-time.us","Connection: close","Content-Type: text/plain","__session__id=","Cookie"],"KillDate":"0","PipeName":"Not Found","UserAgent":"Mozilla/5.0 (Linux; Android 8.0.0; SM-G960F Build/R16NW) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202","Watermark":"305419776","DNS_Idle":"Not Found","DNS_Sleep":"Not Found"}}
+{"preview":false,"offset":18801,"result":{"FirstSeen":"10/15/2021 18:00:30.820","ip":"119.3.156.24","ASN":"HWCSNET Huawei Cloud Service data center","BeaconType":"HTTP","C2Server":"192.168.8.104,/visit.js","Port":"8080","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0; .NET CLR 2.0.50727)","Watermark":"305419896","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
+{"preview":false,"offset":18802,"lastrow":true,"result":{"FirstSeen":"10/15/2021 18:00:36.874","ip":"39.99.181.72","ASN":"CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd.","BeaconType":"HTTP","C2Server":"39.99.181.72,/activity","Port":"10010","SleepTime":"60000","Jitter":"0","Proxy_Behavior":"Use IE settings","HostHeader":"","HttpGet_Metadata":"Cookie","HttpPostUri":"/submit.php","HttpPost_Metadata":["Content-Type: application/octet-stream","id"],"KillDate":"0","PipeName":"","UserAgent":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)","Watermark":"0","DNS_Idle":"0.0.0.0","DNS_Sleep":"0"}}
diff --git a/feeds/IPC2s-30day.csv b/feeds/IPC2s-30day.csv
@@ -1268,7 +1268,6 @@
 172.105.209.145,Possible Cobaltstrike C2 IP
 172.105.228.71,Possible Cobaltstrike C2 IP
 172.105.230.194,Possible Cobaltstrike C2 IP
-172.105.233.80,Possible Cobaltstrike C2 IP
 172.241.27.209,Possible Cobaltstrike C2 IP
 172.241.29.114,Possible Cobaltstrike C2 IP
 172.241.29.115,Possible Cobaltstrike C2 IP
@@ -1357,7 +1356,6 @@
 18.118.143.4,Possible Cobaltstrike C2 IP
 18.119.162.35,Possible Cobaltstrike C2 IP
 18.130.108.244,Possible Cobaltstrike C2 IP
-18.130.181.253,Possible Cobaltstrike C2 IP
 18.130.219.152,Possible Cobaltstrike C2 IP
 18.132.97.155,Possible Cobaltstrike C2 IP
 18.134.226.104,Possible Cobaltstrike C2 IP
@@ -1611,7 +1609,6 @@
 194.68.32.17,Possible Cobaltstrike C2 IP
 194.87.215.102,Possible Cobaltstrike C2 IP
 195.123.214.24,Possible Cobaltstrike C2 IP
-195.123.217.15,Possible Cobaltstrike C2 IP
 195.123.220.37,Possible Cobaltstrike C2 IP
 195.123.222.49,Possible Cobaltstrike C2 IP
 195.123.233.247,Possible Cobaltstrike C2 IP
@@ -2158,7 +2155,6 @@
 43.239.159.3,Possible Cobaltstrike C2 IP
 43.243.111.223,Possible Cobaltstrike C2 IP
 43.251.104.9,Possible Cobaltstrike C2 IP
-43.251.159.107,Possible Cobaltstrike C2 IP
 43.252.209.252,Possible Cobaltstrike C2 IP
 43.254.218.134,Possible Cobaltstrike C2 IP
 43.254.218.17,Possible Cobaltstrike C2 IP
@@ -2423,6 +2419,7 @@
 47.103.34.37,Possible Cobaltstrike C2 IP
 47.103.71.63,Possible Cobaltstrike C2 IP
 47.103.73.139,Possible Cobaltstrike C2 IP
+47.104.101.102,Possible Cobaltstrike C2 IP
 47.104.207.11,Possible Cobaltstrike C2 IP
 47.104.222.101,Possible Cobaltstrike C2 IP
 47.104.253.89,Possible Cobaltstrike C2 IP
@@ -2503,7 +2500,6 @@
 47.57.64.223,Possible Cobaltstrike C2 IP
 47.74.144.167,Possible Cobaltstrike C2 IP
 47.75.122.251,Possible Cobaltstrike C2 IP
-47.75.138.18,Possible Cobaltstrike C2 IP
 47.75.249.112,Possible Cobaltstrike C2 IP
 47.75.96.198,Possible Cobaltstrike C2 IP
 47.90.202.152,Possible Cobaltstrike C2 IP
@@ -2528,7 +2524,6 @@
 47.94.153.149,Possible Cobaltstrike C2 IP
 47.94.170.143,Possible Cobaltstrike C2 IP
 47.94.38.147,Possible Cobaltstrike C2 IP
-47.95.118.146,Possible Cobaltstrike C2 IP
 47.95.199.162,Possible Cobaltstrike C2 IP
 47.95.207.79,Possible Cobaltstrike C2 IP
 47.95.231.140,Possible Cobaltstrike C2 IP

diff --git a/feeds/IPC2s.csv b/feeds/IPC2s.csv
@@ -399,6 +399,7 @@
 120.131.5.115,Possible Cobaltstrike C2 IP
 120.132.81.146,Possible Cobaltstrike C2 IP
 120.132.81.147,Possible Cobaltstrike C2 IP
+120.132.81.151,Possible Cobaltstrike C2 IP
 120.132.81.158,Possible Cobaltstrike C2 IP
 120.132.81.166,Possible Cobaltstrike C2 IP
 120.132.81.194,Possible Cobaltstrike C2 IP
@@ -1650,6 +1651,7 @@
 47.103.34.37,Possible Cobaltstrike C2 IP
 47.103.71.63,Possible Cobaltstrike C2 IP
 47.103.73.139,Possible Cobaltstrike C2 IP
+47.104.101.102,Possible Cobaltstrike C2 IP
 47.104.207.11,Possible Cobaltstrike C2 IP
 47.104.222.101,Possible Cobaltstrike C2 IP
 47.104.253.89,Possible Cobaltstrike C2 IP
@@ -1887,6 +1889,7 @@
 79.141.169.220,Possible Cobaltstrike C2 IP
 8.129.123.77,Possible Cobaltstrike C2 IP
 8.129.212.57,Possible Cobaltstrike C2 IP
+8.129.227.26,Possible Cobaltstrike C2 IP
 8.129.237.254,Possible Cobaltstrike C2 IP
 8.129.24.62,Possible Cobaltstrike C2 IP
 8.131.237.224,Possible Cobaltstrike C2 IP