Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

Larva-208 (threat actor)

Risk

High

8 techniques 52 tools/malware 1 vulnerabilities 51 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2025-26633

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1036.001: Masquerading – System Software Name

T1041: Exfiltration Over Command and Control Channel

T1059.001: PowerShell

T1063: Permission Groups Discovery

T1074: Data Staging

T1110: Brute Force (Credential Access)

T1204: User Execution

T1547: Boot or Logon Autostart Execution

Stage risk: Critical High Medium None

Tools & Malware (52)

Amadey AnyDesk Backdoors BlackSuit CALENDAR Chameleon ConnectWise Crisis Custom Powershell scripts Dark DarkWisp DarkWisp backdoor EncryptHub Stealer Variant A EncryptHub Stealer Variant B EncryptHub Stealer Variant C Explorer GitHub Global Information Stealers Kematian Stealer Kematian‑Stealer Lumma Stealer MMc.exe MSC EvilTwin Loader Malicious files Microsoft Teams Nefilim PLAY Payload Payload Phishing campaigns PowerShell PowerShell commands PowerShell scripts RansomHub Rhadamanthys Rhadamanthys Stealer ScreenConnect SilentPrism SilentPrism backdoor Social engineering tactics Spear-phishing Stealc TeamViewer Telegram Trojan WEXTRACT.EXE.MUI Zoho Assist axplong.exe phishing skotes.exe whoami

Indicators of Compromise (51)

Domain

Meeting.msi QQTalk.msi 6.38.122510801.msi 0TUb7JrZEvpr.vbs invoker.exe PowerShellScriptLauncher.dll powershell.exe runnerw.exe +12 more

Filename

PowerShellScriptLauncher.dll runnerw.exe powershell.exe mmc.exe invoker.exe mshta.exe 0TUb7JrZEvpr.vbs 6.38.122510801.msi +4 more

MD5 Hash

99a80820ae6dc60c9e9307e6ed8ef211 f0df469c3459a6a3b98b7b69b07bf61b 87792cf4bd370f483a293a23c4247c50 abaa46bc704842d6cc6f494c21546ae6 239e8a3ee1fafe452d0b59eadb32247b e59a025f9310d266190b91f5330fde8d

SHA-1 Hash

ffb72adff6e099a9deb418c5d40abd8cf9b12c42 87c46845f57dc9ca8136b730c08b5b5916ca0ad3 b38a0478aefa9d9d77282dd82ada51d7a47fe6f5 1377a69ae519d1cf000fa51869454e31ba92056d 2e4ae2af76c6239eb4191853221b4a40139cc122 a225bee48074feac53c7cb2f3929a41f7b4a71d3

SHA-256 Hash

725df91a9db2e077203d78b8bef95b8cf093e7d0ee2e7a4f55a30fe200c3bf8f 0ac748baaad6017e331a8d99aae9e5449a96ba76fb7374f5d8c678ae52b7db9f f381a3877028f29ec7865b505b5c85ce77d4947d387d3f30071159fa991f009a db3fe436f4eeb9c20dc206af3dfdff8454460ad80ef4bab03291528e3e0754ad 983506186590f7118cb507d29f12f163afb536a03e6d0f4fb441df8afe49ede1 cbb84155467087c4da2ec411463e4af379582bb742ce7009156756482868859c

IPv4 Address

82.115.223.182

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

Larva-208

Type: Unknown Active

EncryptHub aka Larva-208 Evil Corp tracked as ZDI-25-150 +5 more

Infrastructure 21 IOC(s)

50%

Domain

Meeting.msi QQTalk.msi 6.38.122510801.msi 0TUb7JrZEvpr.vbs invoker.exe +15

IPv4 Address

82.115.223.182

Artifacts (30)

PowerShellScriptLauncher.dll runnerw.exe powershell.exe mmc.exe invoker.exe mshta.exe +24

Capability

50%

8 technique(s) 52 tool(s)/malware 1 CVE(s)

Amadey AnyDesk Backdoors BlackSuit CALENDAR Chameleon ConnectWise Crisis +44

T1036.001: Masquerading – System Software Name T1041: Exfiltration Over Command and Control Channel T1059.001: PowerShell T1063: Permission Groups Discovery +4

Victim

70%

Targeted Sectors

financial-services defense critical-infrastructure

Targeted Countries

RU US IR

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges