id: viper-c2

info:
  name: Viper C2 - Detect
  author: pussycat0x
  severity: info
  description: |
    Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration.
  reference:
    - https://twitter.com/MichalKoczwara/status/1635724410274414596
  metadata:
    verified: "true"
    max-request: 1
    shodan-query: http.html_hash:1015055567
    censys-query: 057f3b5488605b4d224d038e340866e2cdfed4a3
  tags: tech,viper,c2,malware,ir,panel

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: dsl
        dsl:
          - "status_code == 404"
          - "(\"057f3b5488605b4d224d038e340866e2cdfed4a3\" == sha1(body))"
        condition: and

# digest: 4a0a00473045022048363acbfdf74cf2d5818b88c21ec61d8d357f18064c49df6adbf11c91421ac0022100f1897abf0a6dd7fd9e132c38a9e142c7e1997a1408790487d4a7a9163b2d4c56:922c64590222798bb761d5b6d8e72950