Update onimai-rat-c2.yaml
parent
3348d8cbd8
commit
3d44553a8c
|
@ -7,19 +7,20 @@ info:
|
|||
description: |
|
||||
Onimai is a relatively new closed-source Remote Administration Trojan (RAT) based on Quasar.
|
||||
metadata:
|
||||
verified: "true"
|
||||
verified: true
|
||||
max-request: 1
|
||||
shodan-query: ssl.cert.subject.cn:"Onimai Academies CA"
|
||||
censys-query: 'services.tls.certificates.leaf_data.subject.common_name: {"Onimai Academies CA"}'
|
||||
tags: c2,ir,osint,malware,onimai,rat
|
||||
|
||||
ssl:
|
||||
- address: "{{Host}}:{{Port}}"
|
||||
|
||||
matchers:
|
||||
- type: word
|
||||
part: issuer_cn
|
||||
words:
|
||||
- "Onimai Academies CA"
|
||||
condition: or
|
||||
|
||||
extractors:
|
||||
- type: json
|
||||
|
|
Loading…
Reference in New Issue