Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
alh1mik (threat actor)
Risk
76
Critical
20 techniques 43 tools/malware 0 vulnerabilities 39 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
1
T1566.002
Spearphishing Link initial access
›
4 Exploitation
2
T1059.004
Unix Shell execution
T1204.002
Malicious File execution
›
5 Installation
7
T1539
Steal Web Session Cookie credential access
T1552.001
Credentials In Files credential access
T1552.004
Private Keys credential access
T1555.003
Credentials from Web Browsers credential access
T1083
File and Directory Discovery discovery
T1087
Account Discovery discovery
T1543.001
Launch Agent persistence
›
6 Command & Control
5
T1005
Data from Local System collection
T1056.001
Keylogging collection
T1119
Automated Collection collection
T1071.001
Web Protocols command and control
T1573.002
Asymmetric Cryptography command and control
›
7 Actions on Objectives
5
T1041
Exfiltration Over C2 Channel exfiltration
T1036.005
Match Legitimate Resource Name or Location stealth
T1140
Deobfuscate/Decode Files or Information stealth
T1564.001
Hidden Files and Directories stealth
T1562.001
T1562.001
Stage risk: Critical High Medium None

Tools & Malware (43)

AMOS Aurora Aurora Stealer BANSHEE BRAIN ClickFix Cthulhu Stealer Dark Exodus Expand Explorer FileZilla Firebase infrastructure Firefox Formbook Garble GitHub Infostealer Luca Stealer LummaC2 MacSync Malicious files Odyssey Stealer Payload Payload Poseidon Poseidon Stealer RedLine Systeminfo Telegram Titan Trojan Unknown VBScript WhatsApp XLoader Zero-day exploits and many others curl malware distribution notnullOSX phishing rock

Indicators of Compromise (39)

Domain
coockie.pro wallpapermacos.com wallspaceapp.com com.apple.quarantine README.txt mactest-6b2ab-default-rtdb.firebaseio.com cdn.filestackcontent.com Install.sh +4 more
MD5 Hash
85870d9889492e3df9fbec630bbb5fde 48ac3d7ed39152844b8b3112563cfcf7 c4c249ee87fbda08834e5883f8626db1 a1f06c2c83835259998f2d9d518ee2f6 ddf5c959ef9d990152d39c90b5efbfde
SHA-256 Hash
a1e36c1b872fa4b2f39ff497a6c597769044e6275e0bb1ca1c1c9ae94a32cf80 7210ce47323d4bdeb99bd27b22f00099000c473a04048e2c90576f81d1194647 7a6c0b683961869fc159bf8da1b4c86bc190ee07b0ad5eb09f99deaac4db5c69 92791b72b06e7d1eddd796c2afed565391a451d5daee5cc5083b86477acba8db 95b554f13d27126d04504cf35da185f572cfd6497cd86d6be0f21eb98fc4c75c b2a5b16d6c36cf6f50c0fabada8ceb5d1973af2bd7f8c9194f1f19b4efb0bd4f d556042c8a77ba52d39e211f208a27fe52f587047140d9666bbeca6032eae604 00284601ed89be5b44d9a4219f7ee271dfd68186937b41a26c283a6a129e7a28 +9 more
IPv4 Address
83.217.209.88 111.90.149.111 45.142.122.92 154.216.18.135
URL
http://:8080/installer

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

19 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (5)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1047 Audit M1054 Software Configuration
Exploitation (3)
M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint
Installation (11)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1022 Restrict File and Directory Permissions M1027 Password Policies +6 more
Command & Control (6)
M1020 SSL/TLS Inspection M1029 Remote Data Storage M1031 Network Intrusion Prevention M1037 Filter Network Traffic M1041 Encrypt Sensitive Information +1 more
Actions on Objectives (5)
M1022 Restrict File and Directory Permissions M1031 Network Intrusion Prevention M1038 Execution Prevention M1045 Code Signing M1057 Data Loss Prevention

Detection Coverage

19 strategies
5/7 stages covered

Delivery (1)

DET0107 Detection Strategy for Spearphishing Lin...

Exploitation (2)

DET0294 User Execution – Malicious File via down... DET0384 Behavioral Detection of Unix Shell Execu...

Installation (7)

DET0037 Detect Suspicious Access to Browser Cred... DET0307 Detect Access to Unsecured Credential Fi... DET0370 Recursive Enumeration of Files and Direc... DET0434 Detection of Launch Agent Creation or Mo... DET0509 Detection of Web Session Cookie Theft vi... +2 more

Command & Control (5)

DET0027 Detection of Web Protocol-Based C2 Over... DET0089 Behavioral Detection of Keylogging Activ... DET0186 Automated File and API Collection Detect... DET0380 Detection of Local Data Collection Prior... DET0543 Detection Strategy for Encrypted Channel...

Actions on Objectives (4)

DET0032 Detection Strategy for Hidden Files and... DET0275 Detect Adversary Deobfuscation or Decodi... DET0347 Detection Strategy for Masquerading via... DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

alh1mik

Type: Unknown Active
tracked as it Mischief Night reachable AMO then AMOS active until March 2024 +5 more
Infrastructure 17 IOC(s)
50%
Domain
coockie.pro wallpapermacos.com wallspaceapp.com com.apple.quarantine README.txt +7
IPv4 Address
83.217.209.88 111.90.149.111 45.142.122.92 154.216.18.135
URL
http://:8080/installer
Artifacts (22)
85870d9889492e3df9fbec630bbb5fde 48ac3d7ed39152844b8b3112563cfcf7 c4c249ee87fbda08834e5883f8626db1 a1f06c2c83835259998f2d9d518ee2f6 ddf5c959ef9d990152d39c90b5efbfde a1e36c1b872fa4b2f39ff497a6c597769044e6275e0bb1ca1c1c9ae94a32cf80 +16
Capability
50%
20 technique(s) 43 tool(s)/malware
AMOS Aurora Aurora Stealer BANSHEE BRAIN ClickFix Cthulhu Stealer Dark +35
T1562.001
collection
T1005 T1056.001 T1119
command and control
T1071.001 T1573.002
credential access
T1539 T1552.001 T1552.004 T1555.003
Victim
70%

Targeted Sectors

financial-services media

Targeted Countries

Spain Taiwan TW ES RU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1566.002

Capability (Malware)

AMOS Aurora Aurora Stealer
4 Exploitation

Capability (Techniques)

T1059.004 T1204.002

Capability (Malware)

AMOS Aurora Aurora Stealer
5 Installation

Capability (Malware)

AMOS Aurora Aurora Stealer
6 Command & Control

Capability (Malware)

AMOS Aurora Aurora Stealer
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

AMOS Aurora Aurora Stealer
Leaving Threaticon

This link opens an external site that isn't part of the platform.