Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

SAMBASPIDER (threat actor)

Risk

High

7 techniques 73 tools/malware 0 vulnerabilities 39 IOCs 3/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1189

Drive-by Compromise initial access

T1566.001

Spearphishing Attachment initial access

T1566.002

Spearphishing Link initial access

›

4 Exploitation

No data

›

5 Installation

T1003

OS Credential Dumping credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1041

Exfiltration Over C2 Channel exfiltration

T1486

Data Encrypted for Impact impact

T1086

Stage risk: Critical High Medium None

Tools & Malware (73)

APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Akira Backdoor.JAVA.SAMBASPY.THIBOBD Backdoors BlackCat Brute Ratel COATHOOK Carbanak Clop Cobalt Cobalt Strike Custom malware Dark DarkGate DarkGate malware DarkSide Ferocious Gazer Global Guard HTRAN Hafnium Hermit Hive IcedID (BokBot) Indrik Spider Jackal Kimsuky Latency Ratel downloader LockBit Lotus loader Malwarebytes Medusa MiniDionis MuddyWater Nautilus Net Neuron Nexus PLAY Phishing campaigns PowerShell QUICKBALL QuickPulse REvil Ryuk SOGU STOP SentinelOne Social engineering tactics Spear-phishing Systeminfo TWOCHAINS Tasklist Tavdig Trojan Turla Uroburos WhiteBear Wicked Winnti Wipbot Zero-day exploits credential stealers such as WCE gpresult gsecdump phishing pwdump wce

Indicators of Compromise (39)

Domain

Backdoor.JAVA.SAMBASPY.THIBOBD TEMP.Hermit TEMP.Veles TEMP.Zagros TEMP.Jumper TEMP.Periscope TEMP.Hex TEMP.hermit +23 more

Email Address

rocke@live.cn

Filename

Autohotkey.exe AutoHotKey.exe entry.client-BB3wyzmd.js

MD5 Hash

2ddea77933e345319f335529d35b6c1a

SHA-256 Hash

4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503 08d606e87da9ec45d257fcfc1b5ea169b582d79376626672813b964574709cba

IPv4 Address

78.142.18.222

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

20 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Actions on Objectives (4)

M1031 Network Intrusion Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup M1057 Data Loss Prevention

Detection Coverage

6 strategies

3/7 stages covered

Delivery (3)

DET0107 Detection Strategy for Spearphishing Lin... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Installation (1)

DET0234 Credential Dumping via Sensitive Memory...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

SAMBASPIDER

Type: Unknown Active

other aliases 0mid16B APT28 several other aliases ALPHV +47 more

Infrastructure 32 IOC(s)

50%

Domain

Backdoor.JAVA.SAMBASPY.THIBOBD TEMP.Hermit TEMP.Veles TEMP.Zagros TEMP.Jumper +26

IPv4 Address

78.142.18.222

Artifacts (7)

rocke@live.cn Autohotkey.exe AutoHotKey.exe entry.client-BB3wyzmd.js 2ddea77933e345319f335529d35b6c1a 4b45b01bedd0140ced78e879d1c9081cecc4dd124dcf10ffcd3e015454501503 +1

Capability

57%

7 technique(s) 73 tool(s)/malware

APT38 ATI-Agent AdobeARM Agent.btz Agent.dne Akira Backdoor.JAVA.SAMBASPY.THIBOBD Backdoors +65

T1086

credential access

T1003

exfiltration

T1041

impact

T1486

Victim

70%

Targeted Sectors

government financial-services defense telecommunications healthcare critical-infrastructure education manufacturing media non-profit energy aviation hospitality aerospace pharmaceutical think-tank retail gaming transportation information-technology legal-services mining chemical maritime utilities nuclear entertainment oil-gas construction aerospace & defense legal

Targeted Countries

CN US RU IR IL VN IN AU SA JP UA KP BR GB KR PK TW AE MX SG DE TR BY NG ES PL CA RO FR IT LB AZ KZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

government

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1189 T1566.001 T1566.002

Capability (Malware)

APT38 ATI-Agent AdobeARM

Infrastructure

Backdoor.JAVA.SAMBASPY.THIBOBD TEMP.Hermit TEMP.Veles

5 Installation

Capability (Techniques)

T1003

Capability (Malware)

APT38 ATI-Agent AdobeARM

Infrastructure

Backdoor.JAVA.SAMBASPY.THIBOBD TEMP.Hermit TEMP.Veles

7 Actions on Objectives

Capability (Techniques)

T1041 T1486

Capability (Malware)

APT38 ATI-Agent AdobeARM

Infrastructure

Backdoor.JAVA.SAMBASPY.THIBOBD TEMP.Hermit TEMP.Veles