Skip to content

Instantly share code, notes, and snippets.

View MichaelKoczwara's full-sized avatar
🌴
On vacation

MichaelKoczwara

🌴
On vacation
136 followers · 20 following
View GitHub Profile
@MichaelKoczwara
MichaelKoczwara / CS beacon
Created September 19, 2021 16:09
209.249.134.12
{"x64": {"time": 1632046026055.9,
"sha1": "62862d22134c8b566d74e753f0215007ee95a8d1",
"sha256": "17eac46860fe0c853b245dd997eb45721073a0a2475249a6a2ae33d7e8a98cd4",
"config": {"HTTP Method Path 2": "\/api\/conversations.create",
"Polling": 30000,
"Watermark": 1192230662,
"Spawn To x86": "C:\\windows\\system32\\conhost.exe 0x4",
"Port": 443, "Beacon Type": "8 (HTTPS)",
"C2 Server": "www.davismemorialhospital.org,\/api\/channels\/replies",
"C2 Host Header": "Host: www.davismemorialhospital.org\r\n",
@MichaelKoczwara
MichaelKoczwara / beacon configs
Created September 13, 2021 08:47
Cobalt Strike C2 possibly linked to CVE-2021-40444 hosted on combahton.net
ip:
45.147.230.87
45.147.230.236
45.153.241.251
45.153.242.111
45.147.228.115
45.147.228.143
45.153.242.112
152.89.247.172
@MichaelKoczwara
MichaelKoczwara / beacon configs
Last active September 14, 2021 02:29
Cobalt Strike C2 possibly attributed to CVE 2021 40444
Cobalt Strike C2 running on 45.147.229[.]242 (Watermark: 1580103814)
HTTP/1.1 404 Not Found
Server: Microsoft-IIS/8.5
Content-Type: text/plain
Cache-Control: max-age=1
Connection: keep-alive
X-Powered-By: ASP.NET
Content-Length: 0
@MichaelKoczwara
MichaelKoczwara / Conti C2
Created August 10, 2021 10:35
Possible Conti C2 Cobalt Strike
162.244.80.229
fivezin.com,/jquery-3.3.1.min.js
162.244.82.77
soft.azureedge.net,/jquery-3.3.1.min.js
162.244.80.229
fivezin.com,/jquery-3.3.1.min.js
162.244.81.10
@MichaelKoczwara
MichaelKoczwara / Conti C2
Created August 9, 2021 10:50
Possible Conti C2 Cobalt Strike
Possible Conti C2 Cobalt Strike Infrastructure
----------------------------------
217.12.202.110
fivefkl.com,/jquery-3.3.1.min.js
185.203.116.231
amusient.com,/jquery-3.5.1.min.js
217.12.202.71
@MichaelKoczwara
MichaelKoczwara / Cobalt Strike - 3.136.160.122
Created May 6, 2021 11:51
Cobalt Strike - 3.136.160.122
{"x86": {"md5": "14b8702f70942381f3bf001986e5c410", "sha1": "65722b1f7a74309fb56d0b2bbe9f447f2cc02bff", "time": 1620300626962.9, "config": {"Beacon Type": "8 (HTTPS)", "Spawn To x64": "%windir%\\sysnative\\spoolsv.exe", "Method 1": "GET", "HTTP Method Path 2": "\/jquery-3.3.2.min.js", "Header 1": "", "C2 Server": "telemetry.wessonlabpartners.com,\/jquery-3.3.1.min.js,admitting.healthfitconnection.com,\/jquery-3.3.1.min.js,skilled_nursing.healthmanagementtoday.com,\/jquery-3.3.1.min.js", "User Agent": "Mozilla\/5.0 (Windows NT 6.3; Trident\/7.0; rv:11.0) like Gecko", "Max DNS": 255, "Polling": 60000, "DNS Idle": "3.136.160.122", "Pipe Name": "", "Method 2": "POST", "DNS Sleep": 0, "Port": 443, "Jitter": 37, "Spawn To x86": "%windir%\\syswow64\\spoolsv.exe", "Header 2": ""}, "sha256": "2c345b24fe0c5c275ed85580b50565ee6b376a02f81356c723f15eabc0f2884a"}, "x64": {"md5": "12ebf918714aaeeec66272e690596a09", "sha1": "a13194e306cf2df2fb628ea236879d326ef190ed", "time": 1620300629257.4, "config": {"Beacon Type": "8 (HTT
@MichaelKoczwara
MichaelKoczwara / Cobalt Strike - C2
Created May 3, 2021 16:47
Cobalt Strike/C2
{
"Ip": "42.193.225.116",
"Ports": ["42.193.225.116:22", "42.193.225.116:8888"],
"DefaultBeaconResponses": {
"http://42.193.225.116:8888/": "302/219"
},
"Jarm": "",
"Certificate": "",
"Beacons": null
}
@MichaelKoczwara
MichaelKoczwara / Cobalt Strike-C2
Created April 25, 2021 21:59
Cobalt Strike 195.206.181.208, 195.206.181.210, 195.206.181.213
http://195.206.181.210:80/aaa9 200 209981
{
"": "\u0004",
".cryptoscheme": "0",
".http-get.client": "\u0007\u0003\u0006\u0006Cookie",
".http-get.server.output": "\u0004",
".http-get.uri": "195.206.181.210,/ga.js",
".http-get.verb": "GET",
".http-post.client": "\n\u0026Content-Type: application/octet-stream\u0007\u0005\u0002id\u0007\u0001\u0004",
".http-post.uri": "/submit.php",
@MichaelKoczwara
MichaelKoczwara / Cobalt Strike - Office-C2
Created April 20, 2021 09:55
Cobalt Strike/C2
139.60.161.62
{"x64": {"md5": "76ea371a846882c14e1203da09dc6e11", "sha1": "208e53753c6435dcb02001d8a8c8f62fbb4ce79c", "time": 1618902720340.7, "config": {"DNS Sleep": 0, "Spawn To x64": "%windir%\\sysnative\\rundll32.exe", "Spawn To x86": "%windir%\\syswow64\\rundll32.exe", "C2 Server": "a.officecalendar.biz,\/owa\/", "Port": 443, "Beacon Type": "8 (HTTPS)", "Method 2": "GET", "Jitter": 20, "Header 2": "", "DNS Idle": "8.8.8.8", "HTTP Method Path 2": "\/OWA\/", "Max DNS": 235, "Header 1": "", "Method 1": "GET", "User Agent": "Mozilla\/5.0 (Windows NT 6.1) AppleWebKit\/537.36 (KHTML, like Gecko)", "Polling": 30000, "Pipe Name": ""}, "sha256": "2f256a1b4af0453ae3b7468528e9a21bd767d1b4c8fd86f655e29b5f177215bb"}, "x86": {"md5": "8082ddcf750b84602c0ad0eeff6625c3", "sha1": "f9b4bb659d6c348d1fe8f6c5155831d4b91b8bce", "time": 1618902717665.6, "config": {"DNS Sleep": 0, "Spawn To x64": "%windir%\\sysnative\\rundll32.exe", "Spawn To x86": "%windir%\\syswow64\\rundll32.exe", "C2 Server": "a.officecalendar.biz,\/owa\/"
@MichaelKoczwara
MichaelKoczwara / Cobalt Strike 218.132.147.207 - 18.130.120.177
Created April 17, 2021 10:11
Cobalt Strike/C2 218.132.147.207 - 18.130.120.177 c2: sage-salesforce.com/image
18.130.120.177
ec2-18-130-120-177.eu-west-2.compute.amazonaws.com
{"x64": {"md5": "2464855b99ecfd5a0700362a4e0d7656", "config": {"Method 1": "GET", "HTTP Method Path 2": "\/history\/", "Jitter": 0, "C2 Server": "sage-salesforce.com,\/image\/", "Polling": 5000, "Spawn To x86": "%windir%\\syswow64\\mstsc.exe", "Method 2": "GET", "Port": 443, "Beacon Type": "8 (HTTPS)", "Spawn To x64": "%windir%\\sysnative\\mstsc.exe"}, "sha256": "2d1082f1d75d8dc7e66268cf0611d3154d4fe9c43164386d15f64338328b3ccd", "sha1": "be3c6cab9996eee75b08b1d642bef033fee13b58", "time": 1618653337245.6}, "x86": {"md5": "7ffdc76fae6f5b9e2368aa9f6e91eb43", "config": {"Method 1": "GET", "HTTP Method Path 2": "\/history\/", "Jitter": 0, "C2 Server": "sage-salesforce.com,\/image\/", "Polling": 5000, "Spawn To x86": "%windir%\\syswow64\\mstsc.exe", "Method 2": "GET", "Port": 443, "Beacon Type": "8 (HTTPS)", "Spawn To x64": "%windir%\\sysnative\\mstsc.exe"}, "sha256": "ea8bbe9060f7c0e05a1efc648d72753a62e7ecbef1d8ad239c2ba83d43cd10fc", "sha1": "630d