Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

sukob (threat actor)

Risk

Medium

0 techniques 44 tools/malware 3 vulnerabilities 40 IOCs 1/7 stages covered Deepest: Exploitation

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2017-0199

CVE CVE-2026-43284

CVE CVE-2026-43500

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

No data

Stage risk: Critical High Medium None

Tools & Malware (44)

Arti Tor client Backdoor malware Backdoors CALENDAR CoinTicker Crisis Dark Embargo Emotet Exploit code Explorer GitHub Global Guard HellCat Ransomware Hook JavaScript-based Malware Keyloggers Malwarebytes Mokes Monero Miner Morpheus Nexus NotPetya NotPetya ransomware PLAY Payload Payload PowerShell PowerShell scripts Rootkit STOP Smoke Loader SocGholish Spear-phishing Trojan Unknown XMRIG ZLib inter mshta npm packages phishing systemd

Indicators of Compromise (40)

Domain

cisa.gov package.json build.rs pyproject.toml Backdoor.Win32.Mokes settings.json todlfavo4lhvwgvuy6akeutlawypmdf6wkwpdxq74rncy26rsx7sivid.onion CMakeLists.txt +4 more

Email Address

s.js.bc.ak.sggs.ksv@gmail.com newvirus@kaspersky.com

Filename

index.js scroBj.dll regsvr32.exe mshta.exe odbcconf.exe m11.xls

SHA-256 Hash

0a424531b7c46a72a6f1e2b5a0449b487d30b2f5389a2b86720e278f07ae976b cc452646fd25653738be3ec264b55598d681838a2ceaa2208bdae0506587a183 25c46c068dbee7bd77cf762ed140c80ddaf439d118f51080e92478f982848a30 2d23b519931072632b8b6c0c9560d95414dd1639df895694dff7e5ea19fe5182 52d69c91fba8435398870d480f37e87f0a9f7ee721473c98659f5b94b1c91abb ff94ded03a42857c7c534229859b99e034745177184791df3084b6dde66b29e6 4e73334972d6b01650c572fd58596479e68edeb8337962a19e0a76579a9b4ecc 81c400f0345b5b84fc484b4446b1b7fec5598083056c8012a308f8d38d44667e +2 more

IPv4 Address

207.90.194.2

URL

http://mail.maincdn.biz/s1/p11.db http://mail.maincdn.biz/info/changelog.txt http://wecloud.biz/mail/changelog.txt http://mail.maincdn.biz/s1/v111.xls http://wecloud.biz/mail/ajax.php http://mail.webmaster-1.kz/include/changelog.txt http://getupdates.kz/ch582/changelog.txt http://address-in.kz/client/changelog.txt +1 more

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

sukob

Type: Unknown Active

network software application tracked as is a contrast The Wedding Curse +4 more

Infrastructure 22 IOC(s)

50%

Domain

cisa.gov package.json build.rs pyproject.toml Backdoor.Win32.Mokes +7

IPv4 Address

207.90.194.2

URL

http://mail.maincdn.biz/s1/p11.db http://mail.maincdn.biz/info/changelog.txt http://wecloud.biz/mail/changelog.txt http://mail.maincdn.biz/s1/v111.xls http://wecloud.biz/mail/ajax.php +4

Artifacts (18)

s.js.bc.ak.sggs.ksv@gmail.com newvirus@kaspersky.com index.js scroBj.dll regsvr32.exe mshta.exe +12

Capability

50%

44 tool(s)/malware 3 CVE(s)

Arti Tor client Backdoor malware Backdoors CALENDAR CoinTicker Crisis Dark Embargo +36

Victim

70%

Targeted Sectors

financial-services government mining construction energy education manufacturing critical-infrastructure

Targeted Countries

US RU CN JP KP

Diamond Model Meta-Features

Phase

Exploitation

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges