Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Stargazer Goblin (threat actor)

Risk

Critical

25 techniques 89 tools/malware 0 vulnerabilities 40 IOCs 5/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1190

Exploit Public-Facing Application initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

T1566.003

Spearphishing via Service initial access

›

4 Exploitation

T1059

Command and Scripting Interpreter execution

T1059.001

PowerShell execution

T1059.003

Windows Command Shell execution

T1204

User Execution execution

T1204.002

Malicious File execution

›

5 Installation

T1082

System Information Discovery discovery

T1098.001

Additional Cloud Credentials persistence

T1133

External Remote Services persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.004

DNS command and control

T1102

Web Service command and control

T1105

Ingress Tool Transfer command and control

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1027

Obfuscated Files or Information stealth

T1055

Process Injection stealth

T1078

Valid Accounts stealth

T1078.004

Cloud Accounts stealth

T1064

T1193

Stage risk: Critical High Medium None

Tools & Malware (89)

1inch-bot 7zip App_aeIGCY3g.exe Atlantida Atlantida Stealer AutoBot AutoIt AutoIt3 Backdoors BitMEX-trading-bot Bitfinex-bot Cobalt Cobalt Strike Cobeacon Dark Discord-Nitro-Alt-Generator-Free Discord-Vbot Expand Firefox GO Downloader Ghost RAT GitHub Global Grabber HUI Loader HVNC Crack Htlx-Gen-Check Impress_V1.0.2.hta InfoStealer.Win.Atlantida InfoStealer.Wins.Lumma Information-stealing malware Infostealer Injector.Win.RunPE.C KuCoin-trading-bot Loader.Wins.GoBitLoader.A Lumma Stealer MESSAGETAP Mail-Ac-Gen Malicious files NEAR-HOT-WALLET-AUTOBOT Nexus OneDrive Payload Payload Pictore.exe PowerShell PowerShell scripts RedLine RedLine Stealer ReiBoot-Pro-Crack-Download-Free Rhadamanthys Rhadamanthys loader RisePro RisePro Stealer RisePro-Stealer-HVNC-Crack Rogue SEED-SEARCHER-Crypto-Checker-30-Wallets STOP Sakura RAT Sandbox-CryptoBot SectopRAT SeptopRAT Setup_v1.1.2.exe ShibaShootout-CryptoBot Sliver Snapster-autobot Sonatype Nexus Repository Stargazers Ghost Network TeamViewer-Latest-Crack-2024 Top-Osu-Hacks-2024-Aim-Assist-Bots-and-More Trojan Trojan.WIN32.AtlantidaStealer Trojan.Win32.RedLine Stealer Trojan.Wins.Imphash.taim.LV Trovo-Toolkit TwT-Genr Vidar ViewBot Voicemod-2024-Crack-Full-Version Ytb-Dwnld Zscaler and many others bludmooncutie2 cmd.exe malware distribution nsis7z.dll phishing regasm soulkeeper500

Indicators of Compromise (40)

Domain

Fabric.com HealthPulse.url pro.php network.mojom.NetworkService Trojan.WIN32.AtlantidaStealer products.click InfoStealer.Wins.Lumma.ta README.md +10 more

Filename

AutoIt3.exe cmd.exe Pictore.exe HealthPulse.js nsis7z.dll HumanitarianProvinces.exe Scielfic.exe Signup.cmd +2 more

SHA-256 Hash

98B7488B1A18CB0C5E360C06F0C94D19A5230B7B15D0616856354FB64929B388

IPv4 Address

89.23.98.116 91.202.233.18 84.200.24.26 192.142.10.246 185.172.128.95 147.45.44.73

URL

http://github.com/soulkeeper500/soulkeeper500/releases/tag/lat http://github.com/magupdate http://pmpdm.com http://lakeplacidluxuryhomes.com http://github.com/xumuk71discoatoh/xumuk71discoatoh/releases/tag/new

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

26 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (15)

M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more

Exploitation (11)

M1017 User Training M1021 Restrict Web-Based Content M1026 Privileged Account Management M1031 Network Intrusion Prevention M1033 Limit Software Installation +6 more

Installation (7)

M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation M1032 Multi-factor Authentication +2 more

Command & Control (3)

M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (13)

M1013 Application Developer Guidance M1015 Active Directory Configuration M1017 User Training M1018 User Account Management M1026 Privileged Account Management +8 more

Detection Coverage

23 strategies

5/7 stages covered

Delivery (5)

DET0080 Exploit Public-Facing Application – mult... DET0107 Detection Strategy for Spearphishing Lin... DET0115 Detection Strategy for Spearphishing via... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (5)

DET0202 Behavioral Detection of Windows Command... DET0294 User Execution – Malicious File via down... DET0455 Abuse of PowerShell for Arbitrary Execut... DET0478 User Execution – multi-surface behavior... DET0516 Behavioral Detection of Command and Scri...

Installation (3)

DET0354 Behavior-chain detection for T1133 Exter... DET0525 System Discovery via Native and Remote U... DET0531 Detection Strategy for Additional Cloud...

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0400 Behavioral Detection of DNS Tunneling an... DET0425 Suspicious Use of Web Services for C2 DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (5)

DET0348 Detection Strategy for Exfiltration Over... DET0378 Behavioral Detection of Obfuscated Files... DET0508 Behavioral Detection of Process Injectio... DET0546 Detection of Abused or Compromised Cloud... DET0560 Detection of Valid Account Abuse Across...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Stargazer Goblin

Type: Unknown Active

000 between 2022 2024

Infrastructure 29 IOC(s)

50%

Domain

Fabric.com HealthPulse.url pro.php network.mojom.NetworkService Trojan.WIN32.AtlantidaStealer +13

IPv4 Address

89.23.98.116 91.202.233.18 84.200.24.26 192.142.10.246 185.172.128.95 +1

URL

Artifacts (11)

AutoIt3.exe cmd.exe Pictore.exe HealthPulse.js nsis7z.dll HumanitarianProvinces.exe +5

Capability

50%

25 technique(s) 89 tool(s)/malware

1inch-bot 7zip App_aeIGCY3g.exe Atlantida Atlantida Stealer AutoBot AutoIt AutoIt3 +81

T1064 T1193

command and control

T1071 T1071.001 T1071.004 T1102 +1

discovery

T1082

execution

T1059 T1059.001 T1059.003 T1204 +1

Victim

70%

Targeted Sectors

financial-services media defense pharmaceutical mining aviation energy healthcare gaming critical-infrastructure utilities

Targeted Countries

BR MX US

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1190 T1566.001 T1566.002 T1566.003

Capability (Malware)

1inch-bot 7zip App_aeIGCY3g.exe

Infrastructure

Fabric.com HealthPulse.url pro.php

4 Exploitation

Capability (Techniques)

T1059 T1059.001 T1059.003 T1204 T1204.002

Capability (Malware)

1inch-bot 7zip App_aeIGCY3g.exe

Infrastructure

Fabric.com HealthPulse.url pro.php

5 Installation

Capability (Techniques)

T1082 T1098.001 T1133

Capability (Malware)

1inch-bot 7zip App_aeIGCY3g.exe

Infrastructure

Fabric.com HealthPulse.url pro.php

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1071.004 T1102 T1105

Capability (Malware)

1inch-bot 7zip App_aeIGCY3g.exe

Infrastructure

Fabric.com HealthPulse.url pro.php

7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

1inch-bot 7zip App_aeIGCY3g.exe

Infrastructure

Fabric.com HealthPulse.url pro.php