# Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)

> Embee Research documents practical FOFA search queries that fingerprint malware command-and-control servers by TLS certificate values, favicon hashes and HTML titles. The queries cover AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic and Supershell. This is a hunting-technique reference; no CVE, named actor or active exploitation is reported.

- **Published:** 2026-11-01T08:30:43Z
- **Last reviewed:** 2026-11-01T08:30:43Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4978
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4978.png
- **ID:** TL-2026-4978
- **Severity:** LOW
- **Category:** THREAT_INTEL
- **Status:** MONITORING
- **Detections:** 9 (1 shown free below) · **IOCs:** 14 (3 shown free below)

## Description

The Embee Research article (author credited as Matthew, dated 2024-01-01) shows how defenders can use the FOFA internet-scanning search engine to locate C2 infrastructure for eight malware families and frameworks. The approach relies on the fact that many operators deploy default or tell-tale configurations. These leave searchable artifacts such as self-signed TLS certificate subject/issuer values, favicon hashes of web panels, and HTML page titles.

Queries published in the article: AsyncRAT - cert.subject.cn or cert.issuer.cn equal to "AsyncRAT Server". Cobalt Strike - cert.issuer.cn="Major Cobalt Strike" and cert.issuer.org="cobaltstrike". Amadey Bot - cert.subject.cn="desas.digital". Quasar RAT - cert.subject.cn="Quasar Server CA". Laplas Clipper - cert.subject.cn="Laplas.app" and icon_hash="1123908622". Sliver - cert.subject.cn="multiplayer" && cert.issuer.cn="operators". Mythic - icon_hash="-859291042" and title=="Mythic". Supershell botnet - icon_hash="-1010228102" and title="Supershell".

Corroborating public research supports the approach. Censys (2026-01-29) found 57 exposed AsyncRAT hosts, 98% of which used the default "AsyncRAT Server" certificate (a Chinese-localized variant also exists), commonly on ports 8808, 6606 and 7707, hosted mostly on budget VPS providers; one host ran several instances on sequential ports. Team Cymru found about 90% of internet-facing Mythic servers kept default settings, including port 7443 and an "O=Mythic" certificate issuer. Sliver exposes a gRPC multiplayer interface on port 31337. Cyble documented Laplas Clipper (180+ samples since 2022-10-24) distributed via SmokeLoader, a clipboard-hijacking crypto clipper that registers with its C2 via GET request using an XOR-encrypted guid/key. Amadey is a modular malware-as-a-service loader and botnet sold on Russian-language forums since 2018 that communicates over HTTP POST to .php C2 paths and drops follow-on payloads. AhnLab ASEC reports Supershell, a Chinese-language web-based reverse-shell C2 panel, deployed against poorly managed Linux SSH servers.

The article lists no concrete victim, campaign or IOC server values; the IOCs recorded here are the detection artifacts (certificate values, favicon hashes, titles) and the sourced Censys example host. These are infrastructure-hunting pivots and should be validated against current scan data before blocking, since certificate strings and favicons can also be used by legitimate red teams and researchers.

## MITRE ATT&CK

- T1595 Active Scanning
- T1596.005 Search Open Technical Databases: Scan Databases
- T1583.003 Acquire Infrastructure: Virtual Private Server
- T1588.001 Obtain Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1566 Phishing
- T1071.001 Application Layer Protocol: Web Protocols
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1219 Remote Access Tools

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TLS Certificate Fingerprints of Known C2 Frameworks (AsyncRAT, Quasar, Cobalt Strike, Sliver, Mythic, Amadey, Laplas)** (`TL-2026-4978-SPL-003`)

TL-2026-4978: matches Zeek TLS handshakes whose subject or issuer carries the default certificate values used to fingerprint C2 servers in the Embee FOFA queries: AsyncRAT Server, Quasar Server CA, Major Cobalt Strike / cobaltstrike, multiplayer+operators (Sliver), O=Mythic, desas.digital (Amadey) and Laplas.app (Laplas Clipper). Gives defenders an egress-side view of the same pivots used to hunt this infrastructure (T1573.002, T1071.001, T1588.001, T1588.002).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1573.002, T1071.001, T1588.001, T1588.002
- **Data sources:** zeek_ssl, corelight
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=zeek sourcetype="bro:ssl:json" earliest=-24h (subject="*AsyncRAT Server*" OR issuer="*AsyncRAT Server*" OR subject="*Quasar Server CA*" OR issuer="*Major Cobalt Strike*" OR issuer="*cobaltstrike*" OR subject="*desas.digital*" OR subject="*Laplas.app*" OR issuer="*O=Mythic*" OR (subject="*multiplayer*" AND issuer="*operators*")) | eval cert=lower(coalesce(subject,"")." ".coalesce(issuer,"")) | eval c2_family=case(like(cert,"%asyncrat server%"),"AsyncRAT", like(cert,"%quasar server ca%"),"Quasar RAT", like(cert,"%cobalt strike%") OR like(cert,"%cobaltstrike%"),"Cobalt Strike", like(cert,"%desas.digital%"),"Amadey", like(cert,"%laplas.app%"),"Laplas Clipper", like(cert,"%mythic%"),"Mythic", like(cert,"%multiplayer%") AND like(cert,"%operators%"),"Sliver", true(),"unknown") | rename id.orig_h as src_ip, id.resp_h as dest_ip, id.resp_p as dest_port | stats count min(_time) as first_seen max(_time) as last_seen values(server_name) as sni by src_ip, dest_ip, dest_port, c2_family | convert ctime(first_seen) ctime(last_seen) | table src_ip dest_ip dest_port c2_family sni count first_seen last_seen
```

### Microsoft KQL

```kql
Corelight_v2_ssl_CL
| where TimeGenerated > ago(24h)
| extend cert = tolower(strcat(subject_s, ' ', issuer_s))
| where cert has_any ('asyncrat server','quasar server ca','major cobalt strike','cobaltstrike','desas.digital','laplas.app','o=mythic') or (cert has 'multiplayer' and cert has 'operators')
| extend c2_family = case(cert has 'asyncrat server','AsyncRAT', cert has 'quasar server ca','Quasar RAT', cert has_any ('cobalt strike','cobaltstrike'),'Cobalt Strike', cert has 'desas.digital','Amadey', cert has 'laplas.app','Laplas Clipper', cert has 'mythic','Mythic', 'Sliver')
| project TimeGenerated, SrcIp = id_orig_h_s, DestIp = id_resp_h_s, DestPort = id_resp_p_d, server_name_s, c2_family, subject_s, issuer_s
| order by TimeGenerated desc
```

### Sigma

```yaml
title: TLS Certificate Matching Known C2 Framework Defaults
id: a94d3e70-1c58-4b2f-b6d9-0e7f5a2c8d03
status: experimental
description: Detects TLS sessions whose certificate subject or issuer matches default values of AsyncRAT, Quasar RAT, Cobalt Strike, Sliver, Mythic, Amadey and Laplas Clipper C2 servers (TL-2026-4978).
references:
    - https://www.embeeresearch.io/threat-intel-queries-with-fofabot/
    - https://team-cymru.com/post/mythic-case-study-assessing-common-offensive-security-tools
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/01
tags:
    - attack.command_and_control
    - attack.t1573.002
    - attack.t1071.001
    - attack.resource_development
    - attack.t1588.001
    - attack.t1588.002
    - attack.tool.cobalt_strike
    - attack.tool.sliver
    - attack.tool.mythic
logsource:
    product: zeek
    service: ssl
detection:
    selection_subject:
        subject|contains:
            - 'AsyncRAT Server'
            - 'Quasar Server CA'
            - 'desas.digital'
            - 'Laplas.app'
    selection_issuer:
        issuer|contains:
            - 'AsyncRAT Server'
            - 'Major Cobalt Strike'
            - 'cobaltstrike'
            - 'O=Mythic'
    selection_sliver:
        subject|contains: 'multiplayer'
        issuer|contains: 'operators'
    condition: 1 of selection_*
falsepositives:
    - Authorized red team or purple team exercises using default framework certificates
    - Security researchers and sandboxes connecting to these frameworks
level: high
```

**Known false positives:**

- Authorized red team or purple team engagements using default Cobalt Strike, Sliver or Mythic certificates
- Researchers or sandboxes intentionally contacting these frameworks

**Tuning notes:** Adjust index, sourcetype and field names (subject, issuer, id.*) to your Zeek/Corelight ingest; the KQL assumes Corelight_v2_ssl_CL column names. Allowlist red-team source ranges and consider adding the AsyncRAT certificate SHA256 136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe via the Zeek x509 certificate fingerprint field if logged. Certificate strings are leads, not verdicts: corroborate with SPL-001/KQL-003 endpoint telemetry.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Linux Download-and-Execute From Temp Directories (Supershell Implant Deployment) (locked: unlock with TL Creds)
- Run Key or Startup Folder Persistence From User-Writable Path (AsyncRAT / Quasar RAT / Amadey) (locked: unlock with TL Creds)
- Non-Browser Connection To Default C2 Ports or Community-Observed C2 IPs (AsyncRAT, Mythic, Sliver) (locked: unlock with TL Creds)
- Script Host Executing From Downloads, Temp or AppData (Loader Delivery for Amadey / SmokeLoader / Laplas Clipper) (locked: unlock with TL Creds)
- Defender Exclusion For User-Writable Path via PowerShell or reg.exe (Amadey / AsyncRAT Post-Exploitation) (locked: unlock with TL Creds)
- HTTP POST To .php or Payload Download From Bare IP Host (Amadey Bot C2 Check-in and Follow-on Tasking) (locked: unlock with TL Creds)
- Office or Script Host Spawning Downloader Shell (SmokeLoader / Amadey / AsyncRAT / Quasar RAT Delivery) (locked: unlock with TL Creds)
- Scheduled Task or Run-Key Persistence From User-Writable Path via schtasks/reg.exe (AsyncRAT / Amadey / Quasar RAT) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 14)

Defanged, TLP:CLEAR.

- IP address: `185.196.9[.]158`
- Domain: `desas[.]digital`
- File hash: `136fbfd2d255a7fc69c16fe115138d7a53ed0a7db8302017ee0e692b42d82ffe`

Full set of 14 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Practical Queries for Identifying Malware Infrastructure With FOFA (Embee Research)](https://www.embeeresearch.io/threat-intel-queries-with-fofabot/)
- [FOFA internet asset search engine](https://en.fofa.info/)
- [AsyncRAT C2 Activity at Internet Scale (Censys)](https://censys.com/blog/asyncrat-c2-activity-at-internet-scale)
- [New Laplas Clipper Distributed by SmokeLoader (Cyble)](https://cyble.com/blog/new-laplas-clipper-distributed-by-smokeloader/)
- [Laplas Clipper Malware Targeting Cryptocurrency Users via SmokeLoader (The Hacker News)](https://thehackernews.com/2022/11/new-laplas-clipper-malware-targeting.html)
- [Mythic Case Study: Assessing Common Offensive Security Tools (Team Cymru)](https://team-cymru.com/post/mythic-case-study-assessing-common-offensive-security-tools)
- [Supershell Malware Being Distributed to Linux SSH Servers (AhnLab ASEC)](https://asec.ahnlab.com/en/83232/)
- [The Supershell and its widespread Botnet (Botconf)](https://www.botconf.eu/?p=4184)
- [Amadey Malware Explained: How the Windows Botnet Loader and RAT Work (Picus Security)](https://www.picussecurity.com/resource/blog/amadey-malware-explained-how-the-windows-botnet-loader-and-rat-work)
- [Amadey and StealC: Malware-as-a-Service Unavailable (Bitsight)](https://www.bitsight.com/blog/bitsight-aids-disruption-efforts-on-amadey-malware-and-stealc-malware)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4978