Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

GoldFactory (threat actor)

Risk

Critical

29 techniques 40 tools/malware 0 vulnerabilities 40 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587.001

Malware resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1059.003

Windows Command Shell execution

›

5 Installation

T1016

System Network Configuration Discovery discovery

T1046

Network Service Discovery discovery

T1082

System Information Discovery discovery

T1217

Browser Information Discovery discovery

T1136.001

Local Account persistence

T1505.003

Web Shell persistence

›

6 Command & Control

T1119

Automated Collection collection

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1105

Ingress Tool Transfer command and control

T1572

Protocol Tunneling command and control

›

7 Actions on Objectives

T1036.005

Match Legitimate Resource Name or Location stealth

T1036.010

Masquerade Account Name stealth

T1134.001

Token Impersonation/Theft stealth

T1414

T1417.002

T1456

T1481

T1512

T1517

T1521.001

T1533

T1544

T1636.003

T1655

T1660

Stage risk: Critical High Medium None

Tools & Malware (40)

Banking Trojans Curl Gadget Ghost RAT Gigabud GitHub Global GodPotato GoldDigger GoldFinder GoldPickaxe Hook Hooks IceApple Interception Leverage Malicious APK Malware Matrix Mobile malware Payload Payload Play PowerShell Remo STOP SUNBURST Signal Social engineering tactics SolarWinds TinyTurla Trojan Trojans Turla Web Shells WhatsApp WildFire cmd.exe phishing web shell

Indicators of Compromise (40)

Domain

ynsftkg.top b-ty.com www.vvpolo.top baknx.xyz nxbcak.xyz zoyee.cn evnspccskh.com Zeroed.tech +7 more

Filename

web.config machine.config txp.exe txpm.exe w3wp.exe base.apk cmd.exe updf.exe +1 more

SHA-256 Hash

87bd7e24af5f10fe1e01cfa640ce26e9160b0e0e13488d7ee655e83118d16697 d3752e85216f46b76aaf3bc3f219b6bf7745fe0195076e991cf29dcc65f09723 4b6211de6a9b8b780537f4d0dcac7f5ba29af597b4b416d7ad40dbd5e6d3e360 d75ca4b69e3ad9a6f2f4168f5713a049c310fee62ee0bba037ba4c24174d25c4 d47246c9bd4961f692cef6e3d8cdc5aa5f64e16946104cc9c194eb47077fd897 0de69fad50b9e0800ba0120fe2b2f7ebb414e1ae335149a77dae3544b0a46139 68fb18d67bb2314ff70a0fb42e05c40463cceb9657c62682179e62809429ad99 9ada0f54f0eaa0349c63759172848fcb1dd123d892ece8d74002f96d6f095a43 +2 more

IPv4 Address

18.140.4.4 47.237.9.119 47.236.246.131 195.123.240.233 13.214.19.168

URL

http://:443/atm

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (1)

M1038 Execution Prevention

Installation (6)

M1018 User Account Management M1026 Privileged Account Management M1030 Network Segmentation M1031 Network Intrusion Prevention M1032 Multi-factor Authentication +1 more

Command & Control (4)

M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information

Actions on Objectives (6)

M1018 User Account Management M1022 Restrict File and Directory Permissions M1026 Privileged Account Management M1038 Execution Prevention M1045 Code Signing +1 more

Detection Coverage

17 strategies

6/7 stages covered

Weaponization (1)

DET0872 Detection of Malware

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0202 Behavioral Detection of Windows Command...

Installation (6)

DET0013 Detection of Local Browser Artifact Acce... DET0195 Behavioral Detection of System Network C... DET0376 Behavioral Detection Strategy for Networ... DET0394 Web Shell Detection via Server Behavior... DET0447 T1136.001 Detection Strategy - Local Acc... +1 more

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0186 Automated File and API Collection Detect... DET0444 Detection of Command and Control Over Ap... DET0538 Detection Strategy for Protocol Tunnelin...

Actions on Objectives (3)

DET0347 Detection Strategy for Masquerading via... DET0383 Detection Strategy for Masquerading via... DET0482 Behavior-chain detection for T1134.001 A...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

GoldFactory

Type: Unknown Active

UNC961 Prophet Spider Iron Hunter Venomous Bear

Infrastructure 21 IOC(s)

50%

Domain

ynsftkg.top b-ty.com www.vvpolo.top baknx.xyz nxbcak.xyz +10

IPv4 Address

18.140.4.4 47.237.9.119 47.236.246.131 195.123.240.233 13.214.19.168

URL

http://:443/atm

Artifacts (19)

web.config machine.config txp.exe txpm.exe w3wp.exe base.apk +13

Capability

50%

29 technique(s) 40 tool(s)/malware

Banking Trojans Curl Gadget Ghost RAT Gigabud GitHub Global GodPotato +32

T1414 T1417.002 T1456 T1481 +8

collection

T1119

command and control

T1071 T1071.001 T1105 T1572

discovery

T1016 T1046 T1082 T1217

Victim

70%

Targeted Sectors

government financial-services energy transportation healthcare non-profit manufacturing defense retail critical-infrastructure

Targeted Countries

Indonesia Peru Philippines South Africa Thailand VN GB KP BR MX RU US DE UA

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587.001

Capability (Malware)

Banking Trojans Curl Gadget

Infrastructure

ynsftkg.top b-ty.com www.vvpolo.top

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Banking Trojans Curl Gadget

Infrastructure

ynsftkg.top b-ty.com www.vvpolo.top

4 Exploitation

Capability (Techniques)

T1059.003

Capability (Malware)

Banking Trojans Curl Gadget

Infrastructure

ynsftkg.top b-ty.com www.vvpolo.top

5 Installation

Capability (Techniques)

T1016 T1046 T1082 T1217 T1136.001

Capability (Malware)

Banking Trojans Curl Gadget

Infrastructure

ynsftkg.top b-ty.com www.vvpolo.top

6 Command & Control

Capability (Techniques)

T1119 T1071 T1071.001 T1105 T1572

Capability (Malware)

Banking Trojans Curl Gadget

Infrastructure

ynsftkg.top b-ty.com www.vvpolo.top