Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
SLIME88 (threat actor)
Risk
66
High
8 techniques 47 tools/malware 3 vulnerabilities 35 IOCs 4/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
No data
›
3 Delivery
2
T1190
Exploit Public-Facing Application initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
5
T1203
Exploitation for Client Execution execution
T1068
Exploitation for Privilege Escalation privilege escalation
CVE CVE-2015-1701
CVE CVE-2024-32114
CVE CVE-2026-34197
›
5 Installation
No data
›
6 Command & Control
2
T1090
Proxy command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
2
T1486
Data Encrypted for Impact impact
T1490
Inhibit System Recovery impact
Stage risk: Critical High Medium None

Tools & Malware (47)

AdaptixC2 BLINDINGCAN Buhtrap Cobalt CobaltStrike DEADEYE Dark DarkHotel Decryptor Tools ELMER GOBLIN14 Ghost RAT Global Hafnium Hellsing Hidden Cobra Hive IRONHALO Jackal LockBit Lynx Matrix Mirage Mythic Naikon Nexus Nitro Poseidon Predator RansomHub Ransomware variants Samurai Sednit Shamoon Shark Solar SoxAgent SoxAgent RAT Spear-phishing TeamSpy Tsunami Turla Unknown VICEROY Void gcman phishing

Indicators of Compromise (35)

Domain
org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions ResourceXmlApplicationContext.java Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo TEMP.Zhenbao TEMP.Beanie TEMP.Noble +20 more
Email Address
commercial@malwarepatrol.net
Filename
Age-Bestiary.pdf GA.js
SHA-256 Hash
c5eacffa5c909209f97f720740802024761c432e8ebbd2d6e5b30fe0e79e19de 968ec5e0c4aa7e15f0a04c5e7f96393aa7cbf12d2125dfe7dd20351408dd0615 60521e103bb134aea3169da6d3dfdcdae8e4d5e82df265a377b648bae39aca5f
IPv4 Address
103.201.131.121

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

21 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Delivery (15)
M1016 Vulnerability Scanning M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1026 Privileged Account Management +10 more
Exploitation (5)
M1019 Threat Intelligence Program M1038 Execution Prevention M1048 Application Isolation and Sandboxing M1050 Exploit Protection M1051 Update Software
Command & Control (3)
M1020 SSL/TLS Inspection M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (5)
M1018 User Account Management M1028 Operating System Configuration M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1053 Data Backup

Detection Coverage

8 strategies
4/7 stages covered

Delivery (2)

DET0080 Exploit Public-Facing Application – mult... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0514 Detection Strategy for Exploitation for...

Command & Control (2)

DET0060 Detect Ingress Tool Transfers via Behavi... DET0445 Detection of Proxy Infrastructure Setup...

Actions on Objectives (2)

DET0215 Detection of Multi-Platform File Encrypt... DET0329 Behavioral Detection for T1490 - Inhibit...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
60%

SLIME88

Type: Unknown Active
APT28 Pawn Storm Fancy Bear tracked as cpyy +22 more
Infrastructure 29 IOC(s)
50%
Domain
org.apache.xbean.spring.context.ResourceXmlApplicationContext.loadBeanDefinitions ResourceXmlApplicationContext.java Cyber.Anarchy.Squad TEMP.Avengers TEMP.Hippo +23
IPv4 Address
103.201.131.121
Artifacts (6)
commercial@malwarepatrol.net Age-Bestiary.pdf GA.js c5eacffa5c909209f97f720740802024761c432e8ebbd2d6e5b30fe0e79e19de 968ec5e0c4aa7e15f0a04c5e7f96393aa7cbf12d2125dfe7dd20351408dd0615 60521e103bb134aea3169da6d3dfdcdae8e4d5e82df265a377b648bae39aca5f
Capability
50%
8 technique(s) 47 tool(s)/malware 3 CVE(s)
AdaptixC2 BLINDINGCAN Buhtrap Cobalt CobaltStrike DEADEYE Dark DarkHotel +39
command and control
T1090 T1105
execution
T1203
impact
T1486 T1490
initial access
T1190 T1566.001
Victim
70%

Targeted Sectors

government defense financial-services non-profit healthcare telecommunications energy manufacturing aerospace education information-technology media critical-infrastructure maritime think-tank pharmaceutical chemical hospitality mining entertainment legal-services nuclear retail

Targeted Countries

US CN IN GB KR JP DE RU FR IR TW SA CA IL TR AU KZ PK VN UA PL AE SG NL BR ES IQ BY KP IT SY MX RO EG AZ

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Resources

unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

3 Delivery

Capability (Techniques)

T1190 T1566.001

Capability (Malware)

AdaptixC2 BLINDINGCAN Buhtrap
4 Exploitation

Capability (Techniques)

T1203 T1068

Capability (Malware)

AdaptixC2 BLINDINGCAN Buhtrap
6 Command & Control

Capability (Techniques)

T1090 T1105

Capability (Malware)

AdaptixC2 BLINDINGCAN Buhtrap
7 Actions on Objectives

Capability (Techniques)

T1486 T1490

Capability (Malware)

AdaptixC2 BLINDINGCAN Buhtrap
Leaving Threaticon

This link opens an external site that isn't part of the platform.