Awesome C2 Panel Favicon Hashes

 

Threat hunters continually look for efficient ways to identify command-and-control (C2) servers, open directories (often recognizable by the phrase “Index of”), and phishing infrastructure. Open directories frequently expose sensitive data, malware, or threat actor tools, making them useful indicators in threat investigations.

To aid in this effort, I’ve assembled favicon hashes queries aimed at detecting:

• Active or staging C2 panels

• These queries are designed to enhance threat visibility and help analysts detect malicious infrastructure before it becomes a more serious threat.

C2 Name Favicon Hash :

•  Mythic -859291042  
• StartKillerC2 1866124853  
• Covenant -737603591  
• Hak5 C2 1294130019  
• PandaC2 -296385002  
• SuperShell -1010228102  
• Amadey 177506569  
• Umam Web Panel -1278680098  
• Matanbuchus -896203607  
• HookBot -367464266  
• Chaos -1102365062  
• Neptune -958975266  
• LokiBot -1145833218  
• Gomorrah 396707644  
• Azorult 650045425  
• Meduza -11109774  
• Nixscare -1126091140  
• 1312 689047450  
• Luma 766102803  
• Keitaro -1804006560  
• ImBotNet -1172624919  
• Veety 1014760131  
• Lucifer -927152043  
• VSHELL -2040870717  
• E-VENOM 1617616672  
• 0DEBUG -1260841736  
• Paradox 1933374787  
• NT -1019581987  
• Phemedrone -1816223030  
• Ailuphire 512263181  
• Nosviak4 -1019336754  
• Stealc -1224085109  
• VIDAR -1466590509  
• LoaderBot -979767377  
• Hellsday 1188006441  
• DarkAngels 118872218  
• Fenix -1412714605  
• Seidr 28823707  
• Poseidon 1010865262  
• Lumar 740979502  
• AnonVNC -1264543487  
• LootBot -148270395  
• MARS -2079607263  
• ERMAC -1831231668  
• Joker -1822965004  
• ByakuGan -1308945818  
• Fltechen -1581742910  
• Asuka -630680996  
• Darkness -1150023683  
• ARES 203604610  
• Risepro -1819134017