20230402b

winl0gon · Apr 2, 2023 · 7517609 · 7517609
1 parent e1088d2
commit 7517609
Show file tree

Hide file tree

Showing 2 changed files with 170 additions and 90 deletions.
diff --git a/1768.json b/1768.json
@@ -1,72 +1,89 @@
 {
     "dLookupValues": {
-                         "LASTUPDATE": "2022/08/27",
+                         "LASTUPDATE": "2023/04/02",
                          "URL": "https://www.cobaltstrike.com/help-authorization-files",
                          "37": {
-																	"0": "trial or pirated? - Stats uniques -> ips/hostnames: 676 publickeys: 410",
-																	"1": "Finspy - Stats uniques -> ips/hostnames: 26 publickeys: 19",
-																	"100000": "Stats uniques -> ips/hostnames: 11 publickeys: 11",
-																	"1011266395": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1061821957": "Stats uniques -> ips/hostnames: 4 publickeys: 1",
-																	"1083092832": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"1200302529": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1225345476": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1234567890": "Stats uniques -> ips/hostnames: 178 publickeys: 152",
-																	"1293900656": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1330515036": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 228 publickeys: 160",
-																	"1360912112": "Stats uniques -> ips/hostnames: 3 publickeys: 3",
-																	"1453642741": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1485646134": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"153163702": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1548680553": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1580103814": "APT27/Qbot/IcedID/DarkSide/Conti/Hancitor/WizardSpider - Stats uniques -> ips/hostnames: 80 publickeys: 34",
-																	"1580103824": "Stats uniques -> ips/hostnames: 210 publickeys: 92",
-																	"1616449647": "Stats uniques -> ips/hostnames: 3 publickeys: 2",
-																	"1628610335": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"16777216": "Ryuk - Stats uniques -> ips/hostnames: 19 publickeys: 19",
-																	"1711276032": "Stats uniques -> ips/hostnames: 18 publickeys: 15",
-																	"1807886020": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"1857223080": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 35 publickeys: 28",
-																	"1880445158": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1895490765": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"1914732777": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"2002705334": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"206546002": "Stats uniques -> ips/hostnames: 45 publickeys: 23",
-																	"2091175951": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"289336829": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"294598720": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"305419776": "Stats uniques -> ips/hostnames: 49 publickeys: 19",
-																	"305419896": "Ryuk/TrickBot/Maze/EvilCorp/Pyxie/APT41 - Stats uniques -> ips/hostnames: 269 publickeys: 172",
-																	"388888888": "Stats uniques -> ips/hostnames: 5 publickeys: 5",
-																	"401466503": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"426352781": "Stats uniques -> ips/hostnames: 267 publickeys: 207",
-																	"472168751": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"475294171": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"508419252": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"540231004": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"555758901": "Stats uniques -> ips/hostnames: 3 publickeys: 2",
-																	"571338205": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"582298219": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"6": "Stats uniques -> ips/hostnames: 13 publickeys: 12",
-																	"666": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"666104495": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"666666": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
-																	"680943040": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"697620223": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"707557615": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"775423106": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"77771151": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"804449981": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
-																	"863200806": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"8848": "Stats uniques -> ips/hostnames: 8 publickeys: 8",
-																	"9527": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
-																	"96906161": "Stats uniques -> ips/hostnames: 4 publickeys: 1",
-																	"452436291": "REvil/Sodin/Sodinokibi - No stats",
-																	"3": "Cobalt Group - No stats",
-																	"849087011": "SolarStorm - No stats",
-																	"892810033": "Teardrop/SolarStorm - No stats"
+                                  "0": "trial or pirated? - Stats uniques -> ips/hostnames: 740 publickeys: 448",
+                                  "1": "Finspy - Stats uniques -> ips/hostnames: 29 publickeys: 21",
+                                  "100000": "Stats uniques -> ips/hostnames: 49 publickeys: 41",
+                                  "1011266395": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1049482653": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "1061821957": "Stats uniques -> ips/hostnames: 4 publickeys: 1",
+                                  "1083092832": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "1116519211": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1200302529": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1225345476": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "12345": "Stats uniques -> ips/hostnames: 7 publickeys: 7",
+                                  "1234567890": "Stats uniques -> ips/hostnames: 253 publickeys: 197",
+                                  "1293900656": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1330515036": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "1335920331": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1359593325": "TrickBot/SmokeLoader/Nobelium/APT29 - Stats uniques -> ips/hostnames: 238 publickeys: 169",
+                                  "1360912112": "Stats uniques -> ips/hostnames: 3 publickeys: 3",
+                                  "1453642741": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1485646134": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "153163702": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1548680553": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1580103814": "APT27/Qbot/IcedID/DarkSide/Conti/Hancitor/WizardSpider - Stats uniques -> ips/hostnames: 80 publickeys: 34",
+                                  "1580103824": "Stats uniques -> ips/hostnames: 263 publickeys: 114",
+                                  "1616449647": "Stats uniques -> ips/hostnames: 3 publickeys: 2",
+                                  "1628610335": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "1670873463": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "16777216": "Ryuk - Stats uniques -> ips/hostnames: 19 publickeys: 19",
+                                  "1711276032": "Stats uniques -> ips/hostnames: 19 publickeys: 16",
+                                  "172432245": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "1807886020": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "1857223080": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1873433027": "TA511/Hancitor - Stats uniques -> ips/hostnames: 35 publickeys: 28",
+                                  "1880445158": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1895490765": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "1914732777": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "2002705334": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "206546002": "Stats uniques -> ips/hostnames: 80 publickeys: 33",
+                                  "2091175951": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "2130772225": "Stats uniques -> ips/hostnames: 3 publickeys: 3",
+                                  "289336829": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "294598720": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "305419776": "Stats uniques -> ips/hostnames: 62 publickeys: 20",
+                                  "305419896": "Ryuk/TrickBot/Maze/EvilCorp/Pyxie/APT41 - Stats uniques -> ips/hostnames: 284 publickeys: 179",
+                                  "3324337203": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "388888888": "Stats uniques -> ips/hostnames: 5 publickeys: 5",
+                                  "391144938": "Stats uniques -> ips/hostnames: 49 publickeys: 45",
+                                  "401466503": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "426352781": "Stats uniques -> ips/hostnames: 303 publickeys: 232",
+                                  "472168751": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "475294171": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "508419252": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "527324335": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "540231004": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "555758901": "Stats uniques -> ips/hostnames: 3 publickeys: 2",
+                                  "563527380": "Stats uniques -> ips/hostnames: 4 publickeys: 4",
+                                  "571338205": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "574247": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "582298219": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "6": "Stats uniques -> ips/hostnames: 19 publickeys: 18",
+                                  "666": "Stats uniques -> ips/hostnames: 2 publickeys: 2",
+                                  "666104495": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "666666": "Stats uniques -> ips/hostnames: 11 publickeys: 11",
+                                  "668694132": "Stats uniques -> ips/hostnames: 7 publickeys: 7",
+                                  "674054486": "Stats uniques -> ips/hostnames: 25 publickeys: 24",
+                                  "680943040": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "697620223": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "707557615": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "775423106": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "77771151": "Stats uniques -> ips/hostnames: 5 publickeys: 1",
+                                  "804449981": "Stats uniques -> ips/hostnames: 3 publickeys: 1",
+                                  "806236289": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "863200806": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "8848": "Stats uniques -> ips/hostnames: 8 publickeys: 8",
+                                  "921421590": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "9527": "Stats uniques -> ips/hostnames: 2 publickeys: 1",
+                                  "96906161": "Stats uniques -> ips/hostnames: 4 publickeys: 1",
+                                  "987654321": "Stats uniques -> ips/hostnames: 24 publickeys: 21",
+                                  "452436291": "REvil/Sodin/Sodinokibi - No stats",
+                                  "3": "Cobalt Group - No stats",
+                                  "849087011": "SolarStorm - No stats",
+                                  "892810033": "Teardrop/SolarStorm - No stats"
                                },
                          "7": {
                                   "30819f300d06092a864886f70d010101050003818d003081890281810080fa8dc59ec39b73d49523c640c1cdfabbb0f0b15e943f2429c0c360862c938fb474523a0116f2ea71877f24218fc85cd959017cd0f987ec443a731a4d29a7a8fe1312d2edace8a736515d120c8f7b5e0008b7403ee3511435367f223c474ec2c0913c1dede6c1124b5089dc2aec3ef37ce24009a590ef4b8398f52e75c1f2ed020301000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000": {"normal": "Has known private key", "verbose": "30820275020100300d06092a864886f70d01010105000482025f3082025b0201000281810080fa8dc59ec39b73d49523c640c1cdfabbb0f0b15e943f2429c0c360862c938fb474523a0116f2ea71877f24218fc85cd959017cd0f987ec443a731a4d29a7a8fe1312d2edace8a736515d120c8f7b5e0008b7403ee3511435367f223c474ec2c0913c1dede6c1124b5089dc2aec3ef37ce24009a590ef4b8398f52e75c1f2ed02030100010281800d789de81f1df515930584b8073976c7126577ae3edfa2fca6f3c0344baf4a363f35cb04cdea54b2d1eac207c70d9a72c02cc0b005af9a57be0490d3156e1d59ac7837c74987a296671f4264781050d39ccc16f5f5024699fe6f3aad9b77e874117e213b369ef6c58c43a4423585db42eb022251914f3110b52532620fe82dad024100f6c00bf6a8e14566029cfdfef39a77c50511056f235a0dc71b46c5d5b17b6494c290496a3d76635d5ae21f615bc5e04e2a2a2001957fec6b3ce88c0ca9a36aaf02410085d04e59788f32150b4039fc0140fa06a66181cb463cdec2d573111e8904fd4aadffa63e8f2f2063c7e212bef5981c1ed2ff6f1163a04662d483067658ceb32302403b44035b9a528935a83906f4be9402626b061c95061bb2257992b51fcf8240b54e4a13a815dd229ea09ea144e42311ee14488be9757c054ff8902e5b383f8cf702407fcd78d74926f2bd58968a0adf23b0e8a30623d2028e666f8d2fae1d0cdec010106947dd1e21f37c794eb97abad4019f8b043d8f4d28a9b100a8f78616c1ac2302403e247b8970b1e457b2c82759d3427a24edfa7d309a4a619ebfcab16cb2593a67564fe7c4d68b73958f856831e9fe1d4ba2ec4281234a2a903b4b07a50084b3d5"},