Update onimai-rat-c2.yaml

patch-12
Ritik Chaddha 2024-09-24 12:31:56 +04:00 committed by GitHub
parent 3348d8cbd8
commit 3d44553a8c
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 3 additions and 2 deletions

View File

@ -7,19 +7,20 @@ info:
description: |
Onimai is a relatively new closed-source Remote Administration Trojan (RAT) based on Quasar.
metadata:
verified: "true"
verified: true
max-request: 1
shodan-query: ssl.cert.subject.cn:"Onimai Academies CA"
censys-query: 'services.tls.certificates.leaf_data.subject.common_name: {"Onimai Academies CA"}'
tags: c2,ir,osint,malware,onimai,rat
ssl:
- address: "{{Host}}:{{Port}}"
matchers:
- type: word
part: issuer_cn
words:
- "Onimai Academies CA"
condition: or
extractors:
- type: json