Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

bandcampro (threat actor)

Risk

High

4 techniques 45 tools/malware 5 vulnerabilities 21 IOCs 4/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1587

Develop Capabilities resource development

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2013-3307

CVE CVE-2026-50522

CVE CVE-2026-50746

CVE CVE-2026-50747

CVE CVE-2026-50748

›

5 Installation

No data

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

›

7 Actions on Objectives

T1036

Masquerading stealth

Stage risk: Critical High Medium None

Tools & Malware (45)

0APT Ransomware AsyncRAT BRAIN Backdoor malware Beacon BlueSky Botnet malware Botnets Codex Custom Backdoor Custom malware Dark Expand Explorer Gemini CLI GitHub Global GoSerpent Infostealer Jackskid KV-Botnet Kazuar Kimwolf Langflow LockBit Nexus PLAY Payload Payload PowerShell Python scripts RansomHub Shai-Hulud SocGholish Telegram Telegram channels Trojan Turla TuxBot v3 Evolution ValleyRAT WannaCry WhatsApp npm packages phishing route

Indicators of Compromise (21)

Domain

vebrf.digital payloads.tralalarkefe.com 7zip.com GEMINI.md Venice.ai CREDENTIALS.md SKILL.md Kamikaze.sh

Email Address

commercial@malwarepatrol.net

Filename

GA.js Svchost.exe StellarMonSetup.exe powershell.exe Next.js svchost.exe Node.js

IPv4 Address

35.192.41.201 107.150.106.14 34.34.57.141 213.165.51.115 34.34.81.129

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

11 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (8)

M1017 User Training M1018 User Account Management M1022 Restrict File and Directory Permissions M1038 Execution Prevention M1040 Behavior Prevention on Endpoint +3 more

Detection Coverage

4 strategies

3/7 stages covered

Weaponization (1)

DET0853 Detection of Develop Capabilities

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0444 Detection of Command and Control Over Ap...

Actions on Objectives (1)

DET0127 Behavioral Detection of Masquerading Acr...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

bandcampro

Type: Unknown Active

Popa tracked as Gallium has a nearly TeamPCP +11 more

Infrastructure 13 IOC(s)

50%

Domain

vebrf.digital payloads.tralalarkefe.com 7zip.com GEMINI.md Venice.ai +3

IPv4 Address

35.192.41.201 107.150.106.14 34.34.57.141 213.165.51.115 34.34.81.129

Artifacts (8)

commercial@malwarepatrol.net GA.js Svchost.exe StellarMonSetup.exe powershell.exe Next.js +2

Capability

50%

4 technique(s) 45 tool(s)/malware 5 CVE(s)

0APT Ransomware AsyncRAT BRAIN Backdoor malware Beacon BlueSky Botnet malware Botnets +37

command and control

T1071 T1071.001

resource development

T1587

stealth

T1036

Victim

70%

Targeted Sectors

financial-services healthcare defense government critical-infrastructure education telecommunications manufacturing energy aerospace maritime retail hospitality entertainment

Targeted Countries

United States of America US CA CN IN NG GB RU KP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1587

Capability (Malware)

0APT Ransomware AsyncRAT BRAIN

Infrastructure

vebrf.digital payloads.tralalarkefe.com 7zip.com

6 Command & Control

Capability (Techniques)

T1071 T1071.001

Capability (Malware)

0APT Ransomware AsyncRAT BRAIN

Infrastructure

vebrf.digital payloads.tralalarkefe.com 7zip.com