Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

INJ3CTOR3 (threat actor)

Risk

Critical

12 techniques 47 tools/malware 9 vulnerabilities 40 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

T1659

Content Injection initial access

›

4 Exploitation

CVE CVE-2007-5064

CVE CVE-2007-5722

CVE CVE-2008-0647

CVE CVE-2014-7235

CVE CVE-2019-19006

CVE CVE-2021-45461

CVE CVE-2025-64328

CVE CVE-2026-25202

CVE CVE-2026-41089

›

5 Installation

T1003

OS Credential Dumping credential access

›

6 Command & Control

No data

›

7 Actions on Objectives

T1070.004

File Deletion stealth

T1003: OS Credential Dumping – credential collection for lateral move

T1059.003: Command-Line Interface – PowerShell back‑door

T1070.004: Indicator Removal on Host – file deletion

T1077: Windows Admin Shares – lateral movement via SMB (if used)

T1190.001: Exploit Public-Facing Application – FreePBX CVEs

T1543.003: Create or Modify System Process – cron job persistence

T1552.002: Unsecured Credentials – .conf file extraction

T1659: Content Injection – compromised upstream traffic

Stage risk: Critical High Medium None

Tools & Malware (47)

AdWind BLINDINGCAN Backdoor malware Backdoors Banking Trojans Cobalt Cobalt Strike Custom brute‑force login scanners for Elastix/Issabel Denis Disco EncystPHP EncystPHP web shell Ghost RAT GitHub Global Handala JOMANGY JOMANGY PHP shell family KASPERAGENT and MICROPSIA Leverage Lumma Stealer LummaC2 Microsoft Teams Mobile malware Nefilim Nefilim Ransomware Nitro PHP webshell Payload Payload Persistence mechanisms PlugX PowerShell PowerShell back‑door scripts Sshdinjector Telegram Trojan Unknown WannaCry Web Shell Web Shells WildFire ZenharR curl npm packages phishing route

Indicators of Compromise (40)

Domain

noroot.php Hunt.io root.php ajax.php k.php ANY.RUN config.php rr.php +7 more

Email Address

soc_goulash@infosec.exchange

SHA-256 Hash

8068cf1011f8668f741e2ec61676fa9ce6a23e62ee5b3bdf014540cff06b1ebe ecc5a8b0192995673bb2c471074a3326bbeba431e189654c90afaddf570fb514 d8ab22ceab199512aaada36af245d6621208d887ae0b6510fa198d6075777043 c3b805ffe6c988db4c8843625ab2f40cb5196935e727db658b68408b7965de59 7c6cf2e4badbc3d4d29f4e6ed118a77d5f6e0f819244ad25b760329f25f20dd1 f1060a686155fbbe7274073c557c24648cdf30a3f3ef2cbb184ccfc41d99fd3b

IPv4 Address

134.119.213.127 134.119.214.141 134.119.218.49 5.133.27.47 37.61.220.243 40.85.249.243 45.143.220.115 45.143.220.116 +9 more

URL

http:///new/k.php

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

17 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Delivery (10)

M1016 Vulnerability Scanning M1021 Restrict Web-Based Content M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network +5 more

Installation (9)

M1015 Active Directory Configuration M1017 User Training M1025 Privileged Process Integrity M1026 Privileged Account Management M1027 Password Policies +4 more

Detection Coverage

4 strategies

3/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0349 Detection Strategy for Content Injection

Installation (1)

DET0234 Credential Dumping via Sensitive Memory...

Actions on Objectives (1)

DET0140 Behavioral Detection of Malicious File D...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

60%

INJ3CTOR3

Type: Unknown Active

tracked as No associated aliases LummaC2 Stealer

Infrastructure 33 IOC(s)

50%

Domain

noroot.php Hunt.io root.php ajax.php k.php +10

IPv4 Address

134.119.213.127 134.119.214.141 134.119.218.49 5.133.27.47 37.61.220.243 +12

URL

http:///new/k.php

Artifacts (7)

soc_goulash@infosec.exchange 8068cf1011f8668f741e2ec61676fa9ce6a23e62ee5b3bdf014540cff06b1ebe ecc5a8b0192995673bb2c471074a3326bbeba431e189654c90afaddf570fb514 d8ab22ceab199512aaada36af245d6621208d887ae0b6510fa198d6075777043 c3b805ffe6c988db4c8843625ab2f40cb5196935e727db658b68408b7965de59 7c6cf2e4badbc3d4d29f4e6ed118a77d5f6e0f819244ad25b760329f25f20dd1 +1

Capability

50%

12 technique(s) 47 tool(s)/malware 9 CVE(s)

AdWind BLINDINGCAN Backdoor malware Backdoors Banking Trojans Cobalt Cobalt Strike Custom brute‑force login scanners for Elastix/Issabel +39

T1003: OS Credential Dumping – credential collection for lateral move T1059.003: Command-Line Interface – PowerShell back‑door T1070.004: Indicator Removal on Host – file deletion T1077: Windows Admin Shares – lateral movement via SMB (if used) +4

credential access

T1003

initial access

T1190 T1659

stealth

T1070.004

Victim

70%

Targeted Sectors

financial-services government defense energy non-profit information-technology critical-infrastructure

Targeted Countries

BY BR CN

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1659

Capability (Malware)

AdWind BLINDINGCAN Backdoor malware

Infrastructure

noroot.php Hunt.io root.php

5 Installation

Capability (Techniques)

T1003

Capability (Malware)

AdWind BLINDINGCAN Backdoor malware

Infrastructure

noroot.php Hunt.io root.php