Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Edalat-e Ali (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Backdoors Buhtrap Chollima Cobalt DEADEYE Dark DarkHotel Educated Manticore EvilPlayout Global Hellsing Hidden Cobra Jackal Machete Malware Matrix Mirage Naikon Nexus Nitro OilRig Play Poseidon Predator RUBYCARP Samurai Shamoon Shark Sponsor TeamSpy Tsunami Turla Tycoon Unknown VICEROY Void WinScreeny Wiper malware gcman phishing

Indicators of Compromise (40)

Domain

author.name

Filename

Recycle.Bin SimplePlayout.exe Avar.exe SimplePlayout.ini msdskint.exe HttpService4.exe playjfalcfgcdq.bat QTV.CG.Server.exe +18 more

MD5 Hash

307e7440a15c8eed720566f067a2e96b 1fc57ccec4668bbcbebaa9c734a437ba

SHA-256 Hash

42ed646eed4f949c456c637a222e7d94dd8ac67ed5ebda5e63c7b7979076d9cf 8bdf6e262966a59a7242d279e511dd694467f07d1d76c456a0c26d0db2ec48a8 427c105859c3dc62ece790e41a42b0f6ae587496a07d3bd190143179cdf6c6bd e3d61cbbfbe41295dd52acff388d1d8b1d414a143d77def4221fd885aae6cd83 41e0c19cd6a66b4c48cc693fd4be96733bc8ccbe91f7d92031d08ed7ff69759a 13a016b8f502c81e172c09114f25e4d8a8632768aefd56c5f6d147e9b6466216 ea740894227ae1df923997edb7bda3a00f523fbff7cc02d3b5e6b3de19d672fc e9e4a8650094e4de6e5d748f7bc6f605c23090d076338f437a9a70ced4a9382d +3 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Edalat-e Ali

Type: Unknown Active

APT34 the Newscaster Team The Voice television services in Iran cpyy +15 more

Infrastructure 1 IOC(s)

50%

Domain

author.name

Artifacts (39)

Recycle.Bin SimplePlayout.exe Avar.exe SimplePlayout.ini msdskint.exe HttpService4.exe +33

Capability

50%

40 tool(s)/malware 1 CVE(s)

Backdoors Buhtrap Chollima Cobalt DEADEYE Dark DarkHotel Educated Manticore +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit media energy telecommunications aerospace education maritime information-technology transportation manufacturing think-tank healthcare pharmaceutical nuclear chemical mining aviation food-agriculture hospitality legal-services entertainment

Targeted Countries

IR US CN GB IN JP DE KR SA RU TW IL FR CA TR AU KZ PK VN UA PL SY AE SG NL BR ES IQ BY IT MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges