SHA-256 C2 ( Command and Control Server ) Hashes

 

In the evolving landscape of cyber threats, uncovering early signs of attacker infrastructure is critical. Threat hunters often focus on spotting command-and-control (C2) servers, open directories typically identified by the phrase “Index of” and phishing components. These elements can reveal operational footprints such as malware staging areas, stolen data repositories, or even attacker control panels.

To streamline this process, I’ve compiled a list of SHA-256 Hashes to assist in detecting:

• Active or dormant C2 management panels

• These queries provide a strong foundation for proactively identifying malicious infrastructure and strengthening defensive visibility.

| # | Name | Hash |
|----|----------------|-------------------------------------------------------------------|
| 1 | OSKI | 2c734ee8e4088246ab6eacbb8d1668abc28c3a0a3d2d8ff0b7b8fa360fd322a1 |
| 2 | RAPTOR | 0eab354108b488db4b50ce2b676f73286fe52eb785cf6edfa130b23994cc04e0 |
| 3 | Tevirnox | a790436a3bffbf90c463e17b1c285d596f658d72cbf83dd2cc618b523c2b6420 |
| 4 | Grandorerio | 29eead7afb3b0b02359824bc84caea7a9d0cf0cd02125974ea96adfc070b73ab |
| 5 | Lilith | 2d7bb3f53169fc20a23fbab9b316d4f137dccf171b52e7f734ef2d4e2967b4bf |
| 6 | Lapsas | 539ecf03e072d187376ab646cc9c1b84a97415e3f676294a3331b5fbc608474a |
| 7 | Saint | 4f1564a2977b531c529a11357f6dfa6268efed81017bd316fd759444983faca8 |
| 8 | Erbuim | a53a4ded212535c850644bcc486e4ab3f7b298ba8a35d6b8b151c7813649bc56 |
| 9 | Channel | 37165ef650ed07f85d9c081bf9d301b3ab5b138ca8cbb6ca1d57c2754fab37d0 |
| 10 | Atsengie | 76e573b1e7c598a567903289f87c667a7ff71d7a070f642bb8c38386cdc24dc8 |
| 11 | Anubis | 6a8433d53b84ade495e2f8de0ce9c75b4172c2495bdd767110e033bb2d40d5b7 |
| 12 | Vertex | 2e8bda064b1b0f81d9329b05c8440d143e712fbefe6eb4b01ee348fa6226396c |
| 13 | PenyWise | e699aafd292dbb6a4c38aa96ada79c5ba7fb87894213e32f8645ef141bd86eea |
| 14 | Kraken | fb911e5ed09ebe399bc2f6c586c12c7ea13b95d9a88c7276c28cf7e8c9d337c9 |
| 15 | LoaderJS | a123392bbec134ea57d89b27dc4dbb79b2bbbf2878d14bbb00c23bc520360a66 |
| 16 | Predator | b064187ebdc51721708ad98cd89dacc346017cb0fb0457d530032d387f1ff20e |
| 17 | BlackGuard | 4bc4817c823321ae2bff3860895ed0e03f76b279db2aefc6364352534ea0654c |
| 18 | Avatar | 24061b006fd4c94c9d279ddab3c2800ba8799772ee3416e144bc7aeebccc2c2c |
| 19 | Lighting | 2aa40baf2e14d9f8ede5fccc0e6c23c880347d4c5a0464a4f6c6ba6de49b0652 |
| 20 | Misha | 9092f63924c3f69c026391d3377e253f00a7ad41d0ee889f4389fba1303f5311 |
| 21 | LightHttp | 1faee24993b7d6a5e292e8e6c56f1640bba7a1e429237c24cbc30777e1699b1d |
| 22 | VkLogger | fa74106a36da380cdcf180b817c6822dc7b3c2f2cd045a726ce0c0e37b8be04c |
| 23 | Vulturi | 66f3aa76bf05043a38ed082e59ff054bb22213931e4fb8448634d80b678257b6 |
| 24 | Zeus | af47ec90f9b69ce21c23de705be61f809bdfb30c5d9b6675466fd21f4b07b48d |
| 25 | MassLogger | 037c5220a1810f68e5dcfa027c13f07c93091fc3b2a6a3b71beddf71cb4b25c0 |
| 26 | DaimondFox | 3479161cc4732022761002dce3cb9182dc7900fcf7bfc5a0822cf38ebebf76be |
| 27 | Cypress | 173a837bc748f31a2097a70986bba5d8de47f6e02570e041898113f86813b1e1 |
| 28 | ZLoader | 2304d11da36ff6b4cc785a4418b33e8fb1a2b2a2b545f48a93e59f640624a52d |
| 29 | Colibri | 5719a3f267a58bf84072bbe83f9ba909dcbae74c79dabf1568ca7badc46ae33f |
| 30 | Sh1zo1der | 40748e27be000f6c52c292b1546ed0e9b7a0750230030fa3a45c596a5dfbdae8 |
| 31 | Qudox | aef51a33f3bab372c137bdad9435fe90f1da0b779daf071362838488fbcccd1b |
| 32 | Hydra | 6062997d92b9eeea19efac9cdf7e1ceeab7d7b72012b04a72610e008b6c1c3dc |
| 33 | StealthWorker | f59430b241ef6c8aff317cdf92b75f4382c57d5e6dac87c32a14f4fd65d18da9 |
| 34 | AtsEngine | 76e573b1e7c598a567903289f87c667a7ff71d7a070f642bb8c38386cdc24dc8 |
| 35 | Sichrheirat | 9d9eda094ca420ed3a65e4eb330f908f2f38f9a70a4dc2017631b98f561f1ebb |
| 36 | EvilBear | d8eccb2fd541315a43a839517c287b3f3ecb93b2f94274bc1ad0c767b3b50034 |
| 37 | Plague | 5a2db9e43c7a26c5c485cc57d0a8088ab0b9ba430a75bf6c9816aafdd7488f97 |
| 38 | Redirected | b1b606bed5d9b1934dbf5b97eb1e961d13ce7dbeb18cdfbdd0bca15d1b8af818 |
| 39 | Bloody | 74bccb734d88e3ed964c3e0c29d93c2dcac6ff4745d68ca79842e496a570afa3 |
| 40 | DataCollector | da0015b1627061e579e1b298c74d1c41404ec3b8e01fc260907a36c5f55895f3 |
| 41 | Kpot | 914b011065fbe07c808d50f6a402c9b453fcb9626cc6bdb7bc801d240fee816b |
| 42 | Fakecop | e1e3856ebcbc02135db8357e5bdec1436b7228efd95e469be87ec3fab0be0272 |
| 43 | BetaBot | 439707b71fc0142966ed3fbaa3a821f130b478f5158b74e5cdc13a77f3167e41 |
| 44 | Zdts | 350a14aab3a3d0333fa5d1c5f1678610d2b86a280a30259ec5587e8edf0ce24a |
| 45 | Taurus | 36b312c98bcdced4cbdc2b5b444b15a1fadbdb2911dd55e005a5d35daf78398c |
| 46 | Tiurmphloader | c53aa80583764386c958b05c6e1078c5a165c0904dd7e431f8b17ab5f998fab0 |
| 47 | BlueBotNet | 4dbb17663d1d98673341d6fc511348ab9ce1e175d11119fd9d04bb5b77ac6f09 |
| 48 | ParasiteHTTP | 6b320a1b914e44d65e5cb1a179bce9b4a613fa9c038e9a6cfebbfcbb1f9dc736 |
| 49 | ProxyCB | 66b3a9abd4bc8b727692f5b4093ad0b129b0f5c80b88f10223b98ac0fac7d417 |
| 50 | Nova | adad5f2daed15398f6eb2cdaf119dda8ef7cbef9500d326cddc9e2c9f06fa89c |
| 51 | CloudPanel | 1f53514735a5c3ed9e07855e2ca95f6a2ced912c9772b4173c67da060118209c |
| 52 | Amos | bbf343836be9944f9f1e98844a451d44b464032e72b41cceb070f11c34515d2b |
| 53 | ARS | f60e6bff24e3924147fe5d03322c2872835b7b3aed9e45f28607cd655df3f5e0 |
| 54 | AB | b62832ee99520844a46d56b8aef7d1ea8fc6a9d1912b70b65e8b0c84a88dce20 |
| 55 | IRIS | ef29c4d8e3c7ff07a5f9186f0aac0119e0b80df7af0ad0b520356974aabad72a |
| 56 | Rezo | 8f1fdf118583da70a96b6f68ae7a3aeba19b53d5a2398fb0100ef4a5ec7c5421 |
| 57 | Citadel | af47ec90f9b69ce21c23de705be61f809bdfb30c5d9b6675466fd21f4b07b48d |
| 58 | TreasureHunter | 4ac5ace4b9139a52417eb86b2abfaa7c4c6acb2f4c04f5627a2cca62d6b7ab38 |
| 59 | KeyBase | 9809e21863f13e900b33026f59fac3a40a2b969acb830eb8663f7b8441b11a9c |
| 60 | Zyklon | 9b006f8b60e9a55f61354a6f7d7c20c35a789bca0ce9a134b12eac830fa1a7a1 |
| 61 | h1n1n | 7c621668c041bd4cd84fedd5ed3c7c628db7c3365f871d82af782f162286a8ed |
| 62 | GauDox | 4f6e2b65a0adce1b4786bac0e81928f7353ff052e2c2730b881d8f4fa15f3e41 |
| 63 | ManaBot | 842334f2e86825bc3fd6fc05c43fcf64f30c8d4db2a1f4a2f64b087d6daca20a |
| 64 | POS | 405bbc18547c818b7484f3c717f52a11831cba5631aa59f4a0971cf7bc659d13 |
| 65 | MagicPOS | f97d39d2c2d7d279dea4aacb4cd2e22828b3d72d233cd1727d809cbe4c71b6ae |
| 66 | PowrMiner | 089cde6c73453c250b823a4560ffecb5e498ce7036c2e5f5853ba72dc295ec11 |
| 67 | JackPOS | e7cb8c76cdf9cc058db09139c4715b0f3c413de2c60184c8da3fb6234623bc7b |
| 68 | Fastloader | b48d6de9319548d0818cd29ba9ae3f6d144c4fe2b73220366e4e244e7d79ffb0 |
| 69 | DarkRat | ffd6656c51326f7cdd037a59097260ca6128bd2096254c92d739d96bbc24eaa1 |
| 70 | Borr | 9c5f7c80449d44a199d01b82c28741b9b970622baca5620f59db15506f21e639 |
| 71 | FinderBOT | 111389d98971a9add1395ac50ce826b15081d15090afb027019d8ef17b01c01a |
| 72 | L0RDIX | 769b994a9ae3db1b2124bc09cf7ba00f7ff531e12731134fe0346715291f4fb6 |
| 73 | Krown | d582b074a067757c923d79b956af8bc459c83a853caf465de328b42851c1dc4e |
| 74 | Niki | 17d668a0d3cb62c3de278d306717e7766b06e6dac427e4a586e343a0c390ae4f |
| 75 | GlitchPOS | aa465eb5d081b41927d969b66551ccb5bba2516c02bd4734087d018c71f74a71 |
| 76 | Tables | d70821dd50939a2533395340455e90cef982dd3d5497772b9af4a5869b15f48d |
| 77 | HVNC | 8190e9efb61998095998f0104bf6571ac3f39aa2db01b220aee3da1c1e20f20c |
| 78 | CrownAdsPro | 93fee278a682e3afb44b857305508269f27bdc59d04bf6faa81bf79cda6c7700 |