Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

6477e8cb9c716.zip

ZIP Format

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 1, 2023, 9:51 a.m.	June 1, 2023, 9:53 a.m.

Size	2.2MB
Type	Zip archive data, at least v2.0 to extract
MD5	`faace9f6881e329d12abcb306512fbcd`
SHA256	`21b25b8f09bca95d3f73a52c08faa9b728160d8d4943a59f82ce428f6e0399d9`
CRC32	`467CDD00`
ssdeep	`49152:1Q6J3WM202p5GutgAJuIxyxWCIZnS85PWZ5FvcBW:e89i7JDmWjzP+UW`
Yara	zip_file_format - ZIP file format

Name	Response	Post-Analysis Lookup
geo.netsupportsoftware.com	A 51.142.119.24 CNAME geography.netsupportsoftware.com A 62.172.138.67	51.142.119.24
balibumba1.com	A 91.215.85.180	91.215.85.180

IP Address	Status	Action
164.124.101.2	Active	Moloch
51.142.119.24	Active	Moloch
91.215.85.180	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49167 -> 91.215.85.180:5222	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 192.168.56.102:49168 -> 51.142.119.24:80	2034559	ET POLICY NetSupport GeoLocation Lookup Request	Potential Corporate Privacy Violation
TCP 91.215.85.180:5222 -> 192.168.56.102:49167	2035895	ET INFO NetSupport Remote Admin Response	Misc activity
TCP 192.168.56.102:49167 -> 91.215.85.180:5222	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 91.215.85.180:5222 -> 192.168.56.102:49167	2035895	ET INFO NetSupport Remote Admin Response	Misc activity
TCP 192.168.56.102:49167 -> 91.215.85.180:5222	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 192.168.56.102:49167 -> 91.215.85.180:5222	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 192.168.56.102:49167 -> 91.215.85.180:5222	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity

Suricata TLS

No Suricata TLS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://geo.netsupportsoftware.com/location/loca.asp

Performs some HTTP requests (1 event)

request

GET http://geo.netsupportsoftware.com/location/loca.asp