{
    "type": "bundle",
    "id": "bundle--4ce77fdd-19a8-4037-ac75-4ece0c05d63f",
    "objects": [
        {
            "type": "identity",
            "spec_version": "2.1",
            "id": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:32:21.000Z",
            "modified": "2021-01-05T14:32:21.000Z",
            "name": "CIRCL",
            "identity_class": "organization"
        },
        {
            "type": "report",
            "spec_version": "2.1",
            "id": "report--4ce77fdd-19a8-4037-ac75-4ece0c05d63f",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:32:21.000Z",
            "modified": "2021-01-05T14:32:21.000Z",
            "name": "C2-JARM - A list of JARM hashes for different ssl implementations used by some C2 tools.",
            "published": "2021-01-05T14:32:45Z",
            "object_refs": [
                "observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
                "url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
                "x-misp-object--ced5e867-1f14-4ffb-9689-8b567dc4fc67",
                "x-misp-object--e93aa5ee-e092-4ef5-8e41-3429a83d2abe",
                "x-misp-object--e6dd5ea7-3f49-4a62-bb21-b9ce07651d20",
                "x-misp-object--a758246f-0986-4fe6-b97e-5abaa78aaa1c",
                "x-misp-object--14941eb1-e8eb-424e-baec-9bbe3484c37c",
                "x-misp-object--149bb42e-13f3-40cd-86f2-a777bcd48e5c",
                "x-misp-object--71540ec8-7ab5-4101-833b-9581fa00aec3",
                "x-misp-object--2167582f-1957-42e4-b487-07ab72472ebd",
                "x-misp-object--8217d319-e5d7-4060-84ac-3cf744310696",
                "x-misp-object--34e5ca1e-c73e-4d3c-a0b6-d4050ed3333c",
                "x-misp-object--673d0d58-9054-4746-88e6-4e6a0ba0dec6",
                "x-misp-object--961dd2b0-5313-4148-bb63-9b5ed35da7c0",
                "x-misp-object--3858ea64-da2d-4f65-a09e-8f6b8d6221aa",
                "x-misp-object--992020a7-615a-444c-b1f7-7770dbd88f3d",
                "x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
                "relationship--f4a208d3-5eb8-4f3d-8ed3-bb7816d65e21"
            ],
            "labels": [
                "Threat-Report",
                "misp:tool=\"MISP-STIX-Converter\"",
                "type:OSINT",
                "osint:lifetime=\"perpetual\"",
                "osint:certainty=\"50\"",
                "cycat:type=\"fingerprint\"",
                "cycat:scope=\"investigation\"",
                "misp-galaxy:tool=\"Cobalt Strike\"",
                "misp-galaxy:tool=\"metasploit\""
            ],
            "object_marking_refs": [
                "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9"
            ]
        },
        {
            "type": "observed-data",
            "spec_version": "2.1",
            "id": "observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:18:43.000Z",
            "modified": "2021-01-05T14:18:43.000Z",
            "first_observed": "2021-01-05T14:18:43Z",
            "last_observed": "2021-01-05T14:18:43Z",
            "number_observed": 1,
            "object_refs": [
                "url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc"
            ],
            "labels": [
                "misp:type=\"link\"",
                "misp:category=\"External analysis\""
            ]
        },
        {
            "type": "url",
            "spec_version": "2.1",
            "id": "url--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc",
            "value": "https://github.com/cedowens/C2-JARM"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--ced5e867-1f14-4ffb-9689-8b567dc4fc67",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T13:56:11.000Z",
            "modified": "2021-01-05T13:56:11.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "db1bef7e-6b94-40a6-94eb-e5b8c47ff6c5"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Mythic",
                    "category": "Other",
                    "uuid": "2c127d4d-5c31-47c4-94fb-bff1bbb00674"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/its-a-feature/Mythic",
                    "category": "External analysis",
                    "uuid": "6cfc5cd7-4bec-479d-96d2-05c708aafd77"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "61ad29ea-41a7-45ad-81c6-6ac7c737254f"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3 w/aiohttp 3",
                    "category": "Other",
                    "uuid": "c1257f87-04cc-412b-8643-bd77b0b3f620"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--e93aa5ee-e092-4ef5-8e41-3429a83d2abe",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T13:58:49.000Z",
            "modified": "2021-01-05T13:58:49.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "07d14d16d21d21d00042d43d000000aa99ce74e2c6d013c745aa52b5cc042d",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "a764fde0-771a-49f3-9702-f553f0daa10b"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Metasploit ssl listener",
                    "category": "Other",
                    "uuid": "706d348d-6db7-4fa9-afc3-1c79baeaf25b"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/rapid7/metasploit-framework",
                    "category": "External analysis",
                    "uuid": "4df63fc2-8887-4744-b28f-d9fe004434ce"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "c05806f2-43a0-4895-81f4-85c6e255f4f9"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "ruby 2.7.0p0",
                    "category": "Other",
                    "uuid": "10aff875-65e8-4d18-a105-bdd98197629d"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--e6dd5ea7-3f49-4a62-bb21-b9ce07651d20",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:00:10.000Z",
            "modified": "2021-01-05T14:00:10.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "07d14d16d21d21d07c42d43d000000f50d155305214cf247147c43c0f1a823",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "b50ff3c6-6cd9-4371-be55-8a89a7fc545e"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Metasploit ssl listener",
                    "category": "Other",
                    "uuid": "2fa1d211-4cb4-4b04-afae-4c51e96e08ff"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/rapid7/metasploit-framework",
                    "category": "External analysis",
                    "uuid": "fe088a1c-acc5-426c-9337-d756b9a98531"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "0cd2a53a-27f3-47d6-98c0-97c68ea4eb47"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "ruby",
                    "category": "Other",
                    "uuid": "2a80b9e7-8403-426e-8b7e-d8b10430e3a8"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--a758246f-0986-4fe6-b97e-5abaa78aaa1c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:05:35.000Z",
            "modified": "2021-01-05T14:05:35.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "07d14d16d21d21d07c42d41d00041d24a458a375eef0c576d23a7bab9a9fb1",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "449c5134-2c5a-411d-b700-064ce3d0d5a1"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Cobalt Strike",
                    "category": "Other",
                    "uuid": "34040bae-2bad-4dd3-8dec-219ae06f87fb"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://www.cobaltstrike.com/",
                    "category": "External analysis",
                    "uuid": "5a8c65ce-a5ee-4a30-a05e-ccc4764bde6c"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "94f82e21-704d-4b5d-bdfb-673d7d7d6210"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "Java 11",
                    "category": "Other",
                    "uuid": "7f3f56cf-14e1-42c0-97e3-809fe3e7ad0c"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--14941eb1-e8eb-424e-baec-9bbe3484c37c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:10:04.000Z",
            "modified": "2021-01-05T14:10:04.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "29d21b20d29d29d21c41d21b21b41d494e0df9532e75299f15ba73156cee38",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "08ca7b92-8172-4739-ac7c-3f972cc8a328"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Merlin",
                    "category": "Other",
                    "uuid": "fad3fccb-ef05-4c4c-bd93-7dd5ea0d216a"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/Ne0nd0g/merlin",
                    "category": "External analysis",
                    "uuid": "99f11535-af75-480e-b4e5-23750e58a893"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "1887a168-ee89-4ce1-81a3-7ee8c64a0fa3"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "go 1.15.2 linux/amd64",
                    "category": "Other",
                    "uuid": "1a340b19-e004-4912-8b89-a786b6eaf10e"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--149bb42e-13f3-40cd-86f2-a777bcd48e5c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:11:05.000Z",
            "modified": "2021-01-05T14:11:05.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "00000000000000000041d00000041d9535d5979f591ae8e547c5e5743e5b64",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "89af9cc4-f17a-4aae-b816-467f6fb4410b"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Deimos",
                    "category": "Other",
                    "uuid": "9553b5f5-cd91-415f-9f3e-eb4ff4fb2e41"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/DeimosC2/DeimosC2",
                    "category": "External analysis",
                    "uuid": "de402bf3-2c76-48dd-bbc4-1175f681b4e6"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "5559888d-fc30-4f6f-9410-9b779fd6aca7"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "go 1.15.2 linux/amd64 with github.com/gorilla/websocket package",
                    "category": "Other",
                    "uuid": "c1bbab5c-0986-406e-b8d3-ef943c916417"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--71540ec8-7ab5-4101-833b-9581fa00aec3",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:12:09.000Z",
            "modified": "2021-01-05T14:12:09.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad2ad0002ad2ad22c42d42d000000faabb8fd156aa8b4d8a37853e1063261",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "0d79a2ce-2bcc-4972-a162-edceab95f71e"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "MacC2",
                    "category": "Other",
                    "uuid": "a13f2baf-9827-489d-9674-3b06a5d06804"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/cedowens/MacC2",
                    "category": "External analysis",
                    "uuid": "42f879f6-629d-4e43-8d5b-aaa98a0c9c03"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "8644069d-b351-4d10-904e-5783aaae069b"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3.8.6 w/aiohttp 3",
                    "category": "Other",
                    "uuid": "d6f89037-50c0-4460-b1ca-b89311d5419b"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--2167582f-1957-42e4-b487-07ab72472ebd",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:13:00.000Z",
            "modified": "2021-01-05T14:13:00.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "ba06f416-b663-481e-89f7-eff6bd163088"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "MacC2",
                    "category": "Other",
                    "uuid": "c73119c6-0185-4ce4-9236-65d290d0873f"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/cedowens/MacC2",
                    "category": "External analysis",
                    "uuid": "90b06fa0-129e-4218-b4e7-bca7209df738"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "c841489d-53f6-4a0c-a9c1-76368f92ebaf"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3.8.2 w/aiohttp 3",
                    "category": "Other",
                    "uuid": "918e6d7a-670e-48c3-ae5e-2eaa1dbba809"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--8217d319-e5d7-4060-84ac-3cf744310696",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:13:49.000Z",
            "modified": "2021-01-05T14:13:49.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad000000000000000000000000000eeebf944d0b023a00f510f06a29b4f46",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "d0c773b3-60a6-4f65-afee-9b62c8e7917e"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "MacShellSwift",
                    "category": "Other",
                    "uuid": "ce2cd483-5478-413c-954d-09e0ccae2f19"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/cedowens/MacShellSwift",
                    "category": "External analysis",
                    "uuid": "1e917e1a-8cfd-4f4d-8b4f-a9680a92b872"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "73e97aac-333e-46a0-82ff-96ef1fe6143d"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3.8.6 socket",
                    "category": "Other",
                    "uuid": "9ad1e43d-ed19-4e62-84f5-60e65fe943b4"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--34e5ca1e-c73e-4d3c-a0b6-d4050ed3333c",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:14:34.000Z",
            "modified": "2021-01-05T14:14:34.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad000000000000000000000000000eeebf944d0b023a00f510f06a29b4f46",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "eb638ebb-b415-42a5-a0ec-e921aba3e8f0"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "MacShell",
                    "category": "Other",
                    "uuid": "8ad8e0cc-ca3b-4254-bf54-27806f22587f"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/cedowens/MacShellSwift",
                    "category": "External analysis",
                    "uuid": "c54ba9b9-0bba-4068-8008-8adc23303b91"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "c0ff2c54-cb3b-47e5-8583-0a21bca31678"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3.8.6 socket",
                    "category": "Other",
                    "uuid": "c26b76fa-3580-43a3-9249-fcefe4d87388"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--673d0d58-9054-4746-88e6-4e6a0ba0dec6",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:15:29.000Z",
            "modified": "2021-01-05T14:15:29.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad2ad0002ad2ad00041d2ad2ad41da5207249a18099be84ef3c8811adc883",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "05fa1dff-6273-470a-b49c-431994743fdb"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Sliver",
                    "category": "Other",
                    "uuid": "e9af814d-14bc-427b-bfff-4405779c931a"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/BishopFox/sliver",
                    "category": "External analysis",
                    "uuid": "21e9691b-95be-41a4-971b-11b08bf0fdea"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "133624cd-879e-4695-a0fd-0423467dd688"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "go 1.15.2 linux/amd64",
                    "category": "Other",
                    "uuid": "351e1c90-ee5f-4ea4-8f2a-71246084365c"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--961dd2b0-5313-4148-bb63-9b5ed35da7c0",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:16:37.000Z",
            "modified": "2021-01-05T14:16:37.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "20d14d20d21d20d20c20d14d20d20daddf8a68a1444c74b6dbe09910a511e6",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "8c3f9ef9-70f8-44ee-9884-c963b2917b2c"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "EvilGinx2",
                    "category": "Other",
                    "uuid": "ebf3ebf0-9d01-490b-a91e-587b2be69cd8"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/kgretzky/evilginx2",
                    "category": "External analysis",
                    "uuid": "9e987aac-60ed-490a-9250-a952a2dcda82"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "d62d2f32-f935-4f48-9121-c064cb2e06f8"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "go 1.10.4 linux/amd64",
                    "category": "Other",
                    "uuid": "ef99db24-fa12-44f6-8ebe-ec984577bd87"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--3858ea64-da2d-4f65-a09e-8f6b8d6221aa",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:17:25.000Z",
            "modified": "2021-01-05T14:17:25.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "2ad2ad0002ad2ad00042d42d000000ad9bf51cc3f5a1e29eecb81d0c7b06eb",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "7814567b-ad50-4351-8d2d-21ce8a382dd3"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Shad0w",
                    "category": "Other",
                    "uuid": "5e0e2530-9051-460a-8990-bb03e4791a90"
                },
                {
                    "type": "link",
                    "object_relation": "reference",
                    "value": "https://github.com/bats3c/shad0w",
                    "category": "External analysis",
                    "uuid": "fc29c257-02dc-4c94-b27d-bbd4f2caa13f"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "1365786b-5c55-4ec2-b140-5dfda158e75b"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "python 3.8 flask",
                    "category": "Other",
                    "uuid": "7db599cc-c1a7-478b-9ea6-95d585ce5643"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--992020a7-615a-444c-b1f7-7770dbd88f3d",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:18:09.000Z",
            "modified": "2021-01-05T14:18:09.000Z",
            "labels": [
                "misp:name=\"jarm\"",
                "misp:meta-category=\"network\""
            ],
            "x_misp_attributes": [
                {
                    "type": "jarm-fingerprint",
                    "object_relation": "jarm",
                    "value": "07d19d12d21d21d07c07d19d07d21da5a8ab90bcc6bf8bbc6fbec4bcaa8219",
                    "category": "Network activity",
                    "to_ids": true,
                    "uuid": "3991d211-7c60-4c55-bf9d-1e8cb0e26eed"
                },
                {
                    "type": "text",
                    "object_relation": "tool",
                    "value": "Get2",
                    "category": "Other",
                    "uuid": "4ba185ae-af87-4a08-959d-3a6c1e2f83c1"
                },
                {
                    "type": "text",
                    "object_relation": "scope",
                    "value": "Malicious - C2",
                    "category": "Other",
                    "uuid": "b2963c66-ff54-41fd-8484-a9271d710be2"
                },
                {
                    "type": "text",
                    "object_relation": "tls-implementation",
                    "value": "N/A",
                    "category": "Other",
                    "uuid": "814aaeef-74ae-48de-aaf5-745cc3e42a90"
                }
            ],
            "x_misp_meta_category": "network",
            "x_misp_name": "jarm"
        },
        {
            "type": "x-misp-object",
            "spec_version": "2.1",
            "id": "x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
            "created_by_ref": "identity--55f6ea5e-2c60-40e5-964f-47a8950d210f",
            "created": "2021-01-05T14:30:42.000Z",
            "modified": "2021-01-05T14:30:42.000Z",
            "labels": [
                "misp:name=\"report\"",
                "misp:meta-category=\"misc\""
            ],
            "x_misp_attributes": [
                {
                    "type": "text",
                    "object_relation": "summary",
                    "value": "A list of JARM hashes for different ssl implementations used by some C2 tools. Also adding other useful red team tools that use ssl (ex: EvilGinx2).\r\n\r\nFor more info on JARM hashing, check out the work by the Salesforce security team on their JARM github link here: https://github.com/salesforce/jarm\r\n\r\nThis is a neat way to fingerprint ssl servers by the software implementation. This alone would not be sufficient to detect C2 in a high fidelity manner, but JARM hashes coupled with other high value indicators would certainly be of value. This also highlights the need for red teams to ensure their C2 infra is not exposed for public access.\r\n\r\nI plan to add more to this list over time. Feel free to contribute!!",
                    "category": "Other",
                    "uuid": "631bc767-1690-4513-bbb7-ab93acb34a34"
                }
            ],
            "x_misp_meta_category": "misc",
            "x_misp_name": "report"
        },
        {
            "type": "relationship",
            "spec_version": "2.1",
            "id": "relationship--f4a208d3-5eb8-4f3d-8ed3-bb7816d65e21",
            "created": "1970-01-01T00:00:00.000Z",
            "modified": "1970-01-01T00:00:00.000Z",
            "relationship_type": "references",
            "source_ref": "x-misp-object--4d3e74f4-45fc-48b5-bed2-df9fee9a7546",
            "target_ref": "observed-data--f572abd2-6032-4d7b-a43a-b7e3c02ec2cc"
        },
        {
            "type": "marking-definition",
            "spec_version": "2.1",
            "id": "marking-definition--613f2e26-407d-48c7-9eca-b8e91df99dc9",
            "created": "2017-01-20T00:00:00.000Z",
            "definition_type": "tlp",
            "name": "TLP:WHITE",
            "definition": {
                "tlp": "white"
            }
        }
    ]
}