Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started

Kill Chain & Diamond Model Analysis

Map a threat actor or campaign across the Cyber Kill Chain and Diamond Model of Intrusion.

Saved analyses
operation c-major (threat actor)
Risk
71
High
16 techniques 53 tools/malware 0 vulnerabilities 38 IOCs 5/7 stages covered Deepest: Actions on Objectives
1 Reconnaissance
No data
›
2 Weaponization
8
T1583
Acquire Infrastructure resource development
T1583.001
Domains resource development
T1583.003
Virtual Private Server resource development
T1583.004
Server resource development
T1584
Compromise Infrastructure resource development
T1584.001
Domains resource development
T1584.003
Virtual Private Server resource development
T1584.004
Server resource development
›
3 Delivery
3
T1189
Drive-by Compromise initial access
T1566
Phishing initial access
T1566.001
Spearphishing Attachment initial access
›
4 Exploitation
2
T1203
Exploitation for Client Execution execution
T1204.002
Malicious File execution
›
5 Installation
No data
›
6 Command & Control
2
T1071.001
Web Protocols command and control
T1105
Ingress Tool Transfer command and control
›
7 Actions on Objectives
1
T1041
Exfiltration Over C2 Channel exfiltration
Stage risk: Critical High Medium None

Tools & Malware (53)

APT38 AhMyth Android RAT AndroRAT Attor Backdoors Bahamut Buhtrap Capra Tube CapraRAT China Chopper Cobalt ControlR remote management tool Crimson Crimson RAT CrimsonRAT Custom Backdoor Custom backdoors DONOT Dark Gelsemium Global InvisiMole KONNI Kimsuky MSIL/Crimson RAT Mimikatz MuddyWater Mythic ObliqueRAT ObliqueRat OilRig Phishing campaigns Phishing emails PowerShell ReverseRAT RoundCube Sednit SentinelOne ShadowPad SheetAgent RAT Spear-phishing Spear-phishing Campaigns StealthAgent StrongPity Trojan Turla Unknown VERMIN Winnti XDSpy Zebrocy phishing route

Indicators of Compromise (38)

Domain
android.viral91.xyz tbd.TITLE.Connect document.documentElement Array.isArray e.map i.classList.remove i.classList.add i.setAttribute +15 more
Filename
1More-details.doc dlrarhsiva.exe signed.apk transparent-tribe-threat-insight-en.pdf mdkhm.zip
SHA-1 Hash
c307f523a1d1aa928fe3db2c6c3ede6902f1084b dba9f88ba548cebfa389972cddf2bec55b71168b 74bd7b456d9e651fc84446f65041bef1207c408d fff24e9f11651e0bdbee7c5cd1034269f40fc424 28bc3b3d8878be4267ee08f20b7816a6ba23623e
SHA-256 Hash
d9979a41027fe790399edebe5ef8765f61e1eb1a4ee1d11690b4c2a0aa38ae42
IPv4 Address
209.127.19.241 173.212.206.227 173.249.50.243 5.189.145.248

ATT&CK Tactic Coverage

Reconnaissance Resource Development Initial Access Execution Persistence Privilege Escalation Defense Evasion Credential Access Discovery Lateral Movement Collection Command & Control Exfiltration Impact

Recommended Mitigations

15 MITRE ATT&CK mitigations cover detected techniques

Browse all →
Weaponization (1)
M1056 Pre-compromise
Delivery (10)
M1017 User Training M1018 User Account Management M1021 Restrict Web-Based Content M1031 Network Intrusion Prevention M1047 Audit +5 more
Exploitation (6)
M1017 User Training M1038 Execution Prevention M1040 Behavior Prevention on Endpoint M1048 Application Isolation and Sandboxing M1050 Exploit Protection +1 more
Command & Control (2)
M1031 Network Intrusion Prevention M1037 Filter Network Traffic
Actions on Objectives (2)
M1031 Network Intrusion Prevention M1057 Data Loss Prevention

Detection Coverage

16 strategies
5/7 stages covered

Weaponization (8)

DET0838 Detection of Virtual Private Server DET0854 Detection of Virtual Private Server DET0863 Detection of Domains DET0871 Detection of Server DET0874 Detection of Server +3 more

Delivery (3)

DET0070 Detection Strategy for Phishing across p... DET0176 Drive-by Compromise — Behavior-based, Mu... DET0236 Detection Strategy for Spearphishing Att...

Exploitation (2)

DET0287 Exploitation for Client Execution – cros... DET0294 User Execution – Malicious File via down...

Command & Control (2)

DET0027 Detection of Web Protocol-Based C2 Over... DET0060 Detect Ingress Tool Transfers via Behavi...

Actions on Objectives (1)

DET0348 Detection Strategy for Exfiltration Over...

Diamond Model of Intrusion

Adversary · Capability · Infrastructure · Victim

Completeness
4/4
Adversary
Confidence
55%

operation c-major

Type: Unknown Active
C-Major Transparent Tribe Mythic Leopard ProjectM APT36 +89 more
Infrastructure 27 IOC(s)
50%
Domain
android.viral91.xyz tbd.TITLE.Connect document.documentElement Array.isArray e.map +18
IPv4 Address
209.127.19.241 173.212.206.227 173.249.50.243 5.189.145.248
Artifacts (11)
1More-details.doc dlrarhsiva.exe signed.apk transparent-tribe-threat-insight-en.pdf mdkhm.zip c307f523a1d1aa928fe3db2c6c3ede6902f1084b +5
Capability
50%
16 technique(s) 53 tool(s)/malware
APT38 AhMyth Android RAT AndroRAT Attor Backdoors Bahamut Buhtrap Capra Tube +45
command and control
T1071.001 T1105
execution
T1203 T1204.002
exfiltration
T1041
initial access
T1189 T1566 T1566.001
Victim
70%

Targeted Sectors

government education defense telecommunications non-profit financial-services energy think-tank media healthcare aerospace manufacturing transportation critical-infrastructure pharmaceutical maritime legal-services information-technology chemical nuclear aviation entertainment hospitality utilities mining

Targeted Countries

British Indian Ocean Territory India RU US CN UA PK IN AE IL VN BY KR SA PL LB TR IR KZ JP TW IQ DE IT FR GB RO

Diamond Model Meta-Features

Phase

Actions on Objectives

Result

Active

Direction

Adversary → Infrastructure → Victim

Methodology

Unknown

Adversary → Capability
Adversary → Infrastructure
Capability → Victim
Infrastructure → Victim
Diamond Model edges

Activity Threads Kill chain phase → Diamond Model event mapping

2 Weaponization

Capability (Malware)

APT38 AhMyth Android RAT AndroRAT
3 Delivery

Capability (Techniques)

T1189 T1566 T1566.001

Capability (Malware)

APT38 AhMyth Android RAT AndroRAT
4 Exploitation

Capability (Techniques)

T1203 T1204.002

Capability (Malware)

APT38 AhMyth Android RAT AndroRAT
6 Command & Control

Capability (Techniques)

T1071.001 T1105

Capability (Malware)

APT38 AhMyth Android RAT AndroRAT
7 Actions on Objectives

Capability (Techniques)

T1041

Capability (Malware)

APT38 AhMyth Android RAT AndroRAT
Leaving Threaticon

This link opens an external site that isn't part of the platform.