cobaltstrikebot 🌻

I drink and I look for Cobalt Strike.

[cobaltstrikebot 🌻 @cobaltstrikebot]

Well, it's been a fun project, but sadly it appears that the end is here. Due to the restrictions on Twitter API access, the bot can no longer tweet, and it may be a good time to wind the project down.

[cobaltstrikebot 🌻 @cobaltstrikebot]

50 Cobalt Strike stage 2 IP's, with 47 unique configurations, identified today. Find them here: https://t.co/SNwsA3yIvd

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

45 Cobalt Strike C2's identified today. Find them here: https://t.co/RHrVU6TOW4

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 least common Spawn_to values:
%windir%\sysnative\wermgr.exe
%windir%\sysnative\gpupdate.exe
%windir%\system32\rundll32.exe
c:\windows\system32\rundll32.exe
%windir%\sysnative\rundll32.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 most common Spawn_to values:
%windir%\sysnative\rundll32.exe
c:\windows\system32\rundll32.exe
%windir%\system32\rundll32.exe
%windir%\sysnative\gpupdate.exe
%windir%\sysnative\wermgr.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common watermarks:
100000, 14
0, 7
391144938, 6
12345, 4
426352781, 3
1580103824, 3
1049482653, 2
2130772225, 1
897093148, 1
668694132, 1

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common second stage ASNs:
AS40065, 20
AS36352, 12
AS8075, 8
AS29551, 6
AS132203, 6
AS14061, 4
AS64050, 4
AS45102, 4
AS142403, 4
AS14618, 4

[cobaltstrikebot 🌻 @cobaltstrikebot]

139 Cobalt Strike stage 2 IP's, with 137 unique configurations, identified today. Find them here: https://t.co/6yiY9JbeLH

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

133 Cobalt Strike C2's identified today. Find them here: https://t.co/spRYOrQ5Po

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 least common Spawn_to values:
%windir%\sysnative\wermgr.exe
%windir%\sysnative\gpupdate.exe
%windir%\system32\rundll32.exe
%windir%\sysnative\wuauclt.exe
c:\windows\system32\rundll32.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 most common Spawn_to values:
%windir%\sysnative\rundll32.exe
c:\windows\system32\rundll32.exe
%windir%\sysnative\wuauclt.exe
%windir%\system32\rundll32.exe
%windir%\sysnative\gpupdate.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common watermarks:
100000, 30
1234567890, 30
391144938, 18
0, 18
305419896, 12
426352781, 7
987654321, 5
12345, 3
666666, 3
1580103824, 3

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common second stage ASNs:
AS45090, 116
AS37963, 41
AS40065, 20
AS55990, 14
AS36352, 12
AS8075, 8
AS132203, 6
AS131685, 6
AS4812, 4
AS64050, 4

[cobaltstrikebot 🌻 @cobaltstrikebot]

142 Cobalt Strike stage 2 IP's, with 142 unique configurations, identified today. Find them here: https://t.co/n1X04Or1ES

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

136 Cobalt Strike C2's identified today. Find them here: https://t.co/VQaEkigT5W

Warning: These IP's have not been vetted, block at your own risk.

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 least common Spawn_to values:
%windir%\system32\rundll32.exe
%windir%\sysnative\wermgr.exe
%windir%\sysnative\gpupdate.exe
c:\windows\system32\rundll32.exe
%windir%\sysnative\rundll32.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 5 most common Spawn_to values:
%windir%\sysnative\rundll32.exe
c:\windows\system32\rundll32.exe
%windir%\sysnative\gpupdate.exe
%windir%\sysnative\wermgr.exe
%windir%\system32\rundll32.exe

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common watermarks:
1234567890, 32
100000, 29
391144938, 21
0, 18
305419896, 12
426352781, 7
987654321, 7
12345, 3
1580103824, 3
1049482653, 2

[cobaltstrikebot 🌻 @cobaltstrikebot]

Today's 10 most common second stage ASNs:
AS45090, 118
AS37963, 39
AS40065, 20
AS55990, 14
AS36352, 14
AS8075, 8
AS132203, 6
AS131685, 6
AS45102, 4
AS14618, 4

[cobaltstrikebot 🌻 @cobaltstrikebot]

139 Cobalt Strike stage 2 IP's, with 140 unique configurations, identified today. Find them here: https://t.co/YVr2A9Uyi0

Warning: These IP's have not been vetted, block at your own risk.