Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Saad Tycoon (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla AiTM Phishing Kit Buhtrap Chollima Cobalt DEADEYE Dark DarkHotel Global Hellsing Jackal Lynx Malware Matrix Mirage Naikon Nexus Nitro Phishing Kit Phishing campaigns Phishing kits Poseidon Predator RUBYCARP Samurai Shamoon Sponsor TeamSpy Telegram Trojan Tsunami Turla Tycoon Tycoon 2FA Phishing Kit Unknown VICEROY Void gcman phishing phishing emails

Indicators of Compromise (40)

Domain

emaillink.link.sendsay.ru asimn.nexvias.com.de codecrafterspro.com codecrafters.su tycoongroup.ws j06l2j.oqtezn.ru ricardo.ch-sweiz.cfd

Filename

pages-head-top-web.min.js jquery-3.6.0.min.js api.js attachee21.pdf pages-head-web.min.js

SHA-256 Hash

474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9 b9fa2d52a4ffabb438b56184131b893b04655b01f336066415d4fe839efe64e7 75da533888189d13fc340d40637b9fc07a3f732e3fcf33ec300f4c7268790a62 907f2709d1d3c8fa26294938f4080bc477e62281c4c50a082c22db0195cda663 22ca9415e294d9c3ec3384b9d08cdaf5164af73b4e4c251559e09e529c843ea6

IPv4 Address

2.23.246.9 2.16.204.153 172.66.44.78 104.18.23.222 150.171.109.194 23.11.40.157 48.209.6.48 104.18.94.41 +12 more

URL

http://i9152.cisele0.com/NOZcbtTxxEiGj/X http://i9152.cisele0.com/NOZcbtTxxEiGj/”

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Saad Tycoon

Type: Unknown Active

the Saad Tycoon Group cpyy APT3 Gothic Panda UPS Team +13 more

Infrastructure 29 IOC(s)

50%

Domain

emaillink.link.sendsay.ru asimn.nexvias.com.de codecrafterspro.com codecrafters.su tycoongroup.ws +2

IPv4 Address

2.23.246.9 2.16.204.153 172.66.44.78 104.18.23.222 150.171.109.194 +15

URL

http://i9152.cisele0.com/NOZcbtTxxEiGj/X http://i9152.cisele0.com/NOZcbtTxxEiGj/”

Artifacts (11)

pages-head-top-web.min.js jquery-3.6.0.min.js api.js attachee21.pdf pages-head-web.min.js 474d668707f1cb929fef1e3798b71b632e50675bd1a9dceaab90c9587f72f680 +5

Capability

50%

40 tool(s)/malware 1 CVE(s)

Agent Tesla AiTM Phishing Kit Buhtrap Chollima Cobalt DEADEYE Dark DarkHotel +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit energy telecommunications aerospace media education information-technology maritime healthcare manufacturing think-tank pharmaceutical chemical mining construction hospitality legal-services nuclear entertainment

Targeted Countries

US CN GB IN DE JP KR IR RU SA FR CA TW IL TR AU KZ PK VN UA PL ES AE SG NL BR IQ BY IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges