Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Earth Freybug (threat actor)

Risk

Medium

0 techniques 40 tools/malware 1 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2019-3396

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (40)

BARIUM Backdoors C2 infrastructure CROSSWALK Cobalt Cobalt Strike DEMODEX Dark FishMaster GHOSTSPIDER GRAYRABBIT Global HIGHNOON Hook Impacket Jackal KEYPLUG Kimsuky Leverage Malware Payload Payload PlugX PowerShell RansomHub RedCurl SNAPPYBEE ShadowHammer ShadowPad ShadowPad Malware SideWalk Spear-phishing UNAPIMON Unknown Void Wicked Winnti phishing schtasks schtasks.exe

Indicators of Compromise (40)

Domain

dsqurey.com updata.dsqurey.com dscriy.chtq.net bcs.dsqurey.com

Filename

usysdiag.dat cq.exe McUtil.dll cmd.exe SentinelMemoryScanner.exe SentinelAgentCore.dll vmtoolsd.exe Logger.exe +18 more

SHA-256 Hash

f50de0fae860a5fd780d953a8af07450661458646293bfd0fed81a1ff9eb4498 9df4624f815d9b04d31d9b156f7debfd450718336eb0b75100d02cb45d47bd9a 28d78e52420906794e4059a603fa9f22d5d6e4479d91e9046a97318c83998679 bdf019bc6cfb239f0beae4275246216cd8ae8116695657a324497ec96e538aac 41128b82fa12379034b3c42bdecf8e3b435089f19a5d57726a2a784c25e9d91f c8268641aecad7bd32d20432da49bb8bfc9fe7391b92b5b06352e7f4c93bc19e e06710652fa3c8b45fd0fece3b59e7614ad59a9bc0c570f4721aee3293ecd2d1 f4e8841a14aa38352692340729c3ed6909d7521dd777518f12b8bd2d15ea00c5 +1 more

IPv4 Address

108.61.163.91

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Earth Freybug

Type: Unknown Active

Earth Baku Blackfly APT41 BlackTech PLEAD +13 more

Infrastructure 5 IOC(s)

50%

Domain

dsqurey.com updata.dsqurey.com dscriy.chtq.net bcs.dsqurey.com

IPv4 Address

108.61.163.91

Artifacts (35)

usysdiag.dat cq.exe McUtil.dll cmd.exe SentinelMemoryScanner.exe SentinelAgentCore.dll +29

Capability

50%

40 tool(s)/malware 1 CVE(s)

BARIUM Backdoors C2 infrastructure CROSSWALK Cobalt Cobalt Strike DEMODEX Dark +32

Victim

70%

Targeted Sectors

financial-services defense government telecommunications education manufacturing transportation energy healthcare construction critical-infrastructure chemical pharmaceutical gaming oil-gas maritime retail hospitality media think-tank

Targeted Countries

CN TW JP KR US IN PK UA

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges