Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses

armored likho (threat actor)

Risk

High

3 techniques 49 tools/malware 4 vulnerabilities 21 IOCs 2/7 stages covered Deepest: Actions on Objectives

1 Reconnaissance

No data

›

2 Weaponization

No data

›

3 Delivery

No data

›

4 Exploitation

CVE CVE-2025-66376

CVE CVE-2025-9491

CVE CVE-2026-42897

CVE CVE-2026-50522

›

5 Installation

No data

›

6 Command & Control

No data

›

7 Actions on Objectives

T1497

Virtualization/Sandbox Evasion stealth

T1497.001

System Checks stealth

T1497.003

Time Based Checks stealth

Stage risk: Critical High Medium None

Tools & Malware (49)

AnyDesk ArcBridge Backdoors BridgeHead BusySnake Stealer CALENDAR CHINACHOPPER Cobalt Cobalt Strike Custom malware Dark Daxin Expand GitHub Go2Tunnel GoSerpent HOLLOWGRAPH Havex RAT Hermes Information Stealers Infostealer Leverage LucidRook MINIRECON Mirage Mirage Kitten MuddyWater Nexus NightLedger Nimbus Manticore OctLurk OilRig Payload Payload Phishing campaigns Phishing emails PowerShell Rogue STOWAWAY SideWinder SilkLurk Snake Spear-phishing Spear-phishing Campaigns Trojan Unknown WhatsApp phishing sqlmap

Indicators of Compromise (21)

Domain

fr24cast.com EasySend.co Backdoor.Win64.Agent.kah Backdoor.Win64.Agent BI.ZONE ikhwancast.com ghazacast.com

Email Address

newvirus@kaspersky.com

Filename

Venezuela.zip srt64.sys a.dll kbdus1.dll kbdus.dll

MD5 Hash

C5B9C10FFFD62F4C5A5AB9592E6F62FA A26043DD720EDBF540A56B899CB36872 8D5F490E0A4CB4604666EA56A1B17CBD 4959F1EB570E5FA6E788C3C4E3324117 E4726173DFD0C9A6B9399269E3F31DA6

IPv4 Address

1.1.4.6 1.1.5.0 1.1.4.4

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Detection Coverage

3 strategies

1/7 stages covered

Actions on Objectives (3)

DET0046 Detection Strategy for T1497 Virtualizat... DET0141 Detect Time-Based Evasion via Sleep, Tim... DET0168 Virtualization/Sandbox Evasion via Syste...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness

4/4

Adversary

Confidence

55%

armored likho

Type: Unknown Active

Eagle Werewolf tracked as APT29 Cozy Bear CL-STA-1114 +27 more

Infrastructure 10 IOC(s)

50%

Domain

fr24cast.com EasySend.co Backdoor.Win64.Agent.kah Backdoor.Win64.Agent BI.ZONE +2

IPv4 Address

1.1.4.6 1.1.5.0 1.1.4.4

Artifacts (11)

newvirus@kaspersky.com Venezuela.zip srt64.sys a.dll kbdus1.dll kbdus.dll +5

Capability

50%

3 technique(s) 49 tool(s)/malware 4 CVE(s)

AnyDesk ArcBridge Backdoors BridgeHead BusySnake Stealer CALENDAR CHINACHOPPER Cobalt +41

stealth

T1497 T1497.001 T1497.003

Victim

70%

Targeted Sectors

government energy financial-services defense telecommunications critical-infrastructure aerospace non-profit education hospitality healthcare aviation maritime oil-gas

Targeted Countries

Brazil Kazakhstan Russian Federation RU UA BR KZ CN IN IR PK TW EG BY CA US AU

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability

Adversary → Infrastructure

Capability → Victim

Infrastructure → Victim

Diamond Model edges