Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

uat-7810 (threat actor)

Risk

Critical

14 techniques 43 tools/malware 8 vulnerabilities 38 IOCs 6/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

T1584.008

Network Devices resource development

›

3 Delivery

T1190

Exploit Public-Facing Application initial access

›

4 Exploitation

T1053.003

Cron execution

CVE CVE-2020-22653

CVE CVE-2020-22658

CVE CVE-2023-25717

CVE CVE-2025-0994

CVE CVE-2025-20333

CVE CVE-2025-20362

CVE CVE-2025-2492

CVE CVE-2026-59309

›

5 Installation

T1505.003

Web Shell persistence

›

6 Command & Control

T1071

Application Layer Protocol command and control

T1071.001

Web Protocols command and control

T1071.002

File Transfer Protocols command and control

T1071.003

Mail Protocols command and control

T1071.004

DNS command and control

T1090.001

Internal Proxy command and control

T1090.003

Multi-hop Proxy command and control

T1105

Ingress Tool Transfer command and control

T1572

Protocol Tunneling command and control

›

7 Actions on Objectives

T1055

Process Injection stealth

Stage risk: Critical High Medium None

Tools & Malware (43)

Backdoors Chaos CloudSorcerer v3 Cuba Custom malware DOGLEASH DracuLoader Expand Explorer FINALDRAFT FinalDraft/SquidDoor GitHub Global Hades Impacket JARLEASH LEASHTEST LONGLEASH Leash Microsoft Teams NetDraft Netcat Nexus Payload Payload PowerShell Qilin SHORTLEASH SNAPPYBEE SNAPPYBEE/DeedRAT SNOWLIGHT STOP STOWAWAY ShortLeash UAT-8302 Unknown VShell ZingDoor certutil ipconfig route schtasks whoami

Indicators of Compromise (38)

Domain

Win.Tool.dddd adconnectdump.py result.dat test.ini components.DOGLEASH Win.Loader.CloudSorcerer Boost.Asio Unix.Backdoor.Agent +11 more

Filename

run.bat cmd.exe rar.exe explorer.exe spoolsv.exe wagent.exe

SHA-256 Hash

755fcee1337a252203002ecfdf673a08cfadeda8d738bef2d518a08e0626aa4f 3b89d183eb014e29d9d0d4e45fc2b784a7fcfcf31dd48fd3bde30f8d956383d1 1b5649b479fd625de5c8120873644b5eb669cc89cd504582c18e0ae350fd8823 c2ab9adaba93ff094b8f3fc37d906014d870582039d276b7bd03e6fd583d8a15 e799d72929d7ccc7f6b6109742b8cc482838303207efc989543b6e1ca6d16e9c

IPv4 Address

3.6.2.0 85.209.156.3 38.54.32.244 45.135.135.100 217.15.164.147 217.15.160.247 194.233.92.26 95.182.100.231

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

14 MITRE ATT&CK mitigations cover detected techniques

Browse all →

Weaponization (1)

M1056 Pre-compromise

Delivery (8)

M1016 Vulnerability Scanning M1026 Privileged Account Management M1030 Network Segmentation M1035 Limit Access to Resource Over Network M1037 Filter Network Traffic +3 more

Exploitation (2)

M1018 User Account Management M1047 Audit

Installation (2)

M1018 User Account Management M1042 Disable or Remove Feature or Program

Command & Control (2)

M1031 Network Intrusion Prevention M1037 Filter Network Traffic

Actions on Objectives (2)

M1026 Privileged Account Management M1040 Behavior Prevention on Endpoint

Detection Coverage

14 strategies

6/7 stages covered

Weaponization (1)

DET0859 Detection of Network Devices

Delivery (1)

DET0080 Exploit Public-Facing Application – mult...

Exploitation (1)

DET0290 Cross-Platform Detection of Cron Job Abu...

Installation (1)

DET0394 Web Shell Detection via Server Behavior...

Command & Control (9)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi... DET0075 Internal Proxy Behavior via Lateral Host... DET0135 Detection of Mail Protocol-Based C2 Acti... DET0359 Multi-hop Proxy Behavior via Relay Node... +4 more

Actions on Objectives (1)

DET0508 Behavioral Detection of Process Injectio...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

uat-7810

Type: Unknown Active

tracked as JARLEASH LEASHTEST NosyDoor

Infrastructure 27 IOC(s)

50%

Domain

Win.Tool.dddd adconnectdump.py result.dat test.ini components.DOGLEASH +14

IPv4 Address

3.6.2.0 85.209.156.3 38.54.32.244 45.135.135.100 217.15.164.147 +3

Artifacts (11)

run.bat cmd.exe rar.exe explorer.exe spoolsv.exe wagent.exe +5

Capability

50%

14 technique(s) 43 tool(s)/malware 8 CVE(s)

Backdoors Chaos CloudSorcerer v3 Cuba Custom malware DOGLEASH DracuLoader Expand +35

command and control

T1071 T1071.001 T1071.002 T1071.003 +5

execution

T1053.003

initial access

T1190

persistence

T1505.003

Victim

70%

Targeted Sectors

government critical-infrastructure manufacturing oil-gas retail construction telecommunications

Targeted Countries

CN AE JP

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Techniques)

T1584.008

Capability (Malware)

Backdoors Chaos CloudSorcerer v3

Infrastructure

Win.Tool.dddd adconnectdump.py result.dat

3 Delivery

Capability (Techniques)

T1190

Capability (Malware)

Backdoors Chaos CloudSorcerer v3

Infrastructure

Win.Tool.dddd adconnectdump.py result.dat

4 Exploitation

Capability (Techniques)

T1053.003

Capability (Malware)

Backdoors Chaos CloudSorcerer v3

Infrastructure

Win.Tool.dddd adconnectdump.py result.dat

5 Installation

Capability (Techniques)

T1505.003

Capability (Malware)

Backdoors Chaos CloudSorcerer v3

Infrastructure

Win.Tool.dddd adconnectdump.py result.dat

6 Command & Control

Capability (Techniques)

T1071 T1071.001 T1071.002 T1071.003 T1071.004

Capability (Malware)

Backdoors Chaos CloudSorcerer v3

Infrastructure

Win.Tool.dddd adconnectdump.py result.dat