Release of new tool importing JA3 fingerprints to MISP


JA3 is a method for creating SSL/TLS client fingerprints that should be easy to produce on any platform and can be easily shared for threat intelligence. I is developed and maintained by Salesforce (

Systems supporting JA3 fingerprints:

  • Moloch

  • Trisul NSM

  • NGiNX

  • MISP

  • Darktrace

  • Suricata

  • Packetbeat

  • Splunk

  • MantisNet


  • Redsocks

  • NetWitness

  • ExtraHop

  • Vectra Cognito Platform

  • Corvil

  • Java

The project was open sourced in 2017 (

For more details on what you can see and do with JA3 and JA3S, please see this DerbyCon 2018 talk:

MISP Support for JA3 fingerprints

The support has been added into MISP, and with the latest release (v2.4.99 (af8d2007d2e80eb1d8229960eff52a7e3fc93800)  ) - the JA3 fingerprint has been updated to have its own data type. In the previous versions the JA3 fingerprint was mapped to data type MD5, but are now getting its own “ja3-fingerprint-md5” -datatype.

For customers with access to the eCrimeLabs Cratos REST API you can now extract these as well, for import into your security components or toolbox.


eCrimeLabs has created a small python script that takes an pcap file as input and extracts the JA3 fingerprints. When these are extracted they are either added to an existing event or a new is created.

Source code can be downloaded here

Execution of the ja3toMISP

Based on the run from the Python script two MISP JA3 objects is created.

Detecting IceID(BOKBOT) with JA3

As an example of the effectiveness of the JA3 fingerprints PCAP’s from two different campaigns of the IceID malware was used in the below example:

Taking the PCAP’s from the two articles I found 4 that was mentioned to be related to IceID, all realted to different samples and C2’servers.

  • 2018-09-06-Emotet-infection-with-IcedID-and-AZORult.pcap

  • 2018-09-06-Hancitor-malspam-infection-traffic.pcap

  • 2018-12-03-Emotet-infection-with-IcedID.pcap

  • 2018-12-05-Emotet-infection-with-IcedID.pcap

  • 2018-12-07-Emotet-infection-with-IcedID.pcap

This resulted in detection of 4 different IP’s that was related to IceID C2 severs, but in common was it that they generated the same JA3 fingerprint: 1d095e68489d3c535297cd8dffb06cb9