Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
Excerpt
https://www.scmagazine.com/inside-diamondfox/article/578478/ Inside DiamondFox By SC Staff Published: 2016-12-12 · Archived: 2026-10-18 02:35:12 UTC Content December 12, 2016 Last time we looked at the overview of the latest release – Crystal Version – and we got a good look at what the bot is supposed to be doing. We also got a top-level look at the architecture. Then, as promised, I turned it over to our reversing guru, Hasherezade for a closer look at DF's internals. After…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →22 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://www.sadteam.net/umutdb/ | High | Score 67/100 | First seen |
| URL | https://1lidoo.ml/fox/Panel/ | High | Score 67/100 | First seen |
| Domain | urlquery.net | High | Score 67/100 | First seen |
| URL | https://www.securityupdates.online/Cicada/ | High | Score 67/100 | First seen |
| MD5 | 8f77d92060389f5733905710714556ce | High | Score 67/100 | First seen |
| IP | 216.58.192.142 | High | Score 67/100 | First seen |
| URL | https://www.sadteam.net/udb/ | High | Score 67/100 | First seen |
| URL | https://www.sadteam.net/panel/ | High | Score 67/100 | First seen |
| IP | 216.58.216.78 | High | Score 67/100 | First seen |
| URL | https://steamtoday.ru/diamond/ | High | Score 67/100 | First seen |
| URL | https://www.sec.parmankulov.com/ | High | Score 67/100 | First seen |
| URL | https://www.vb-decompiler.org | High | Score 67/100 | First seen |
| URL | https://www.vidyasagar.com/wp-content/themes/pindol/wp-logs/p/ | High | Score 67/100 | First seen |
| IP | 23.194.88.172 | High | Score 67/100 | First seen |
| IP | 216.58.192.174 | High | Score 67/100 | First seen |
| URL | https://www.rekings.com | High | Score 67/100 | First seen |
| URL | https://195.133.145.239/install.php | High | Score 67/100 | First seen |
| Domain | dnsbl.ahbl.org | High | Score 67/100 | First seen |
| IP | 216.58.192.170 | High | Score 67/100 | First seen |
| Domain | tor.ahbl.org | High | Score 67/100 | First seen |
| Domain | avgthreatlabs.com | High | Score 67/100 | First seen |
| URL | https://185.145.129.207/Host/ | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…