Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Bignosa (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2015-1701

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

Agent Tesla Anchor Buhtrap Cassandra Protector Chollima Cobalt DEADEYE Dark DarkHotel Global Hidden Cobra Jackal Lynx Malware Matrix Mirage Mythic Naikon Nexus Nitro OilRig Phishing campaigns Poseidon Predator Samurai SeaDuke Shamoon Shark Spear-phishing Sponsor TeamSpy Trojan Tsunami Turla Unknown VICEROY Void crimson gcman phishing

Indicators of Compromise (40)

Domain

sterdiffa-steel.ddndsfree.com kernel.org chserver.top

Filename

list.doc

SHA-256 Hash

87709f72683c5ffc166f348212b37aadb7943b5653419f2f0edf694fb50f1878 8ba55cc754638714764780542eefd629c55703ecf63ae20d5eb65b8c14d3e645 691761d401a6650872d724c30b7ef5972e3792e9a2ba88fdca98b4312fb318d8

IPv4 Address

79.110.48.6 105.161.75.138 105.161.81.79 197.237.92.228 41.90.176.165 41.90.179.140 41.90.180.123 41.90.180.219 +25 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Bignosa

Type: Unknown Active

cpyy APT3 Gothic Panda UPS Team TG-0110 +12 more

Infrastructure 36 IOC(s)

50%

Domain

sterdiffa-steel.ddndsfree.com kernel.org chserver.top

IPv4 Address

79.110.48.6 105.161.75.138 105.161.81.79 197.237.92.228 41.90.176.165 +28

Artifacts (4)

list.doc 87709f72683c5ffc166f348212b37aadb7943b5653419f2f0edf694fb50f1878 8ba55cc754638714764780542eefd629c55703ecf63ae20d5eb65b8c14d3e645 691761d401a6650872d724c30b7ef5972e3792e9a2ba88fdca98b4312fb318d8

Capability

50%

40 tool(s)/malware 1 CVE(s)

Agent Tesla Anchor Buhtrap Cassandra Protector Chollima Cobalt DEADEYE Dark +32

Victim

70%

Targeted Sectors

government defense financial-services non-profit telecommunications energy aerospace media education healthcare information-technology pharmaceutical manufacturing maritime think-tank chemical entertainment hospitality mining nuclear gaming legal-services retail transportation construction food-agriculture

Targeted Countries

US CN GB IN JP KR DE RU AU IR SA FR CA IL TW TR PK KZ ES UA PL SG VN NL BR IT BY AE IQ MX RO SY AZ EG LB

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges