MALICIOUS — [10.000.006]_[Ulp]_[Secretline.top]_[@StarLinkClouds].txt

MALICIOUS — [10.000.006]_[Ulp]_[Secretline.top]_[@StarLinkClouds].txt is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the Group10 family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: 31ef909d05b34c4d56afb02c5dbba5960c36d1a386ccde98431218db15a12ba5
• SHA-1: e8717d09c39e220d899f9576005b18fbc0ede24c
• MD5: b493c9f86cb80c806b877679fd5c08a6
• ssdeep: 49152:A/rb/5S/Tog6TIfrE1KY/TTz81p+30GJHK8qoEWVx1zSHIH0dfUDS6rrrrkVRd5z:xGSXHHko00
• TLSH: T18E7727273F747B770E351A10B1A0911867639B1E2CBDDF4DA130B6DA6A34A212864F4F
• Submitted as: [10.000.006]_[Ulp]_[Secretline.top]_[@StarLinkClouds].txt
• File type: unknown · Size: 33554432 bytes
• Verdict: malicious (96/100) · Family: Group10

Detections (5 of 53 engines)

• capa (capabilities): capability:execution/powershell
• YARA: ESET research: IIS_Group10
• YARA: ReversingLabs: RL_RedLine_Stealer
• YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
• YARA: Yara-Rules community: YR_AntiVM_Sandbox

MITRE ATT&CK

• T1059.001
• T1497

Why this verdict

The malicious score of 96/100 is the fusion of 8 weighted signals:

• YARA: ReversingLabs flagged RL_RedLine_Stealer (rule RL_RedLine_Stealer) - engine signal, weight 0.80, confidence 0.70
• YARA: ESET research flagged IIS_Group10 (rule IIS_Group10) - engine signal, weight 0.70, confidence 0.70
• YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.50, confidence 0.70
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.40, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://secretline.top/, https://t.me/StarLinkClouds, https://t.me/StarLinkClub - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://secretline.top/
• https://t.me/StarLinkClouds
• https://t.me/StarLinkClub
• https://t.me/+DGtk-2Nwrv9hNjM6
• https://t.me/+2_UcTjBO44ZkNTEy
• https://t.me/+YSvQb9NNpjo3MWIy
• https://t.me/+qCUc3TUXSos1M2Ey
• https://t.me/+dKJRpEqmjLA5NTQy

Embedded domains

• secretline.top
• t.me
• amazon.com
• gmail.com
• target.com
• augi.com
• yahoo.com
• kongregate.com
• escapefromtarkov.com
• girandoporsalas.com
• dondiaza.com
• monkatana.fr
• adampivolon.com
• hazingfun.com
• kabasakalonline.com
• sso.garmin.com
• wish.com
• hotmail.com
• passport.bilibili.com
• unifrog.org
• web.bookipi.com
• mariaflor.org.br
• beta.dashboard.sandbox.pagar.me
• peoplehub.mindtree.com
• amazon.com.mx

Embedded IP addresses

• 192.168.1.1
• 172.16.20.44
• 10.1.1.18
• 10.6.5.60
• 192.168.0.1
• 47.241.176.207
• 192.168.183.201
• 202.47.116.8
• 192.168.10.26
• 192.168.8.1
• 192.168.210.167
• 209.99.16.227
• 41.33.1.108
• 192.168.0.8
• 23.2.1.251
• 192.168.1.234
• 2.1.1.6
• 1.246.241.16
• 192.168.1.128
• 117.202.18.6
• 189.16.87.100
• 118.107.129.64
• 159.69.124.55
• 192.168.9.1
• 181.57.32.240

More Group10 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report