6481937ec937d.zip| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6402 | June 8, 2023, 5:54 p.m. | June 8, 2023, 5:56 p.m. |
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| balibumba1.com | 91.215.85.180 | |
| geo.netsupportsoftware.com | 62.172.138.67 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.102:49169 -> 51.142.119.24:80 | 2034559 | ET POLICY NetSupport GeoLocation Lookup Request | Potential Corporate Privacy Violation |
| TCP 192.168.56.102:49170 -> 91.215.85.180:5222 | 2035892 | ET INFO NetSupport Remote Admin Checkin | Misc activity |
| TCP 91.215.85.180:5222 -> 192.168.56.102:49170 | 2035895 | ET INFO NetSupport Remote Admin Response | Misc activity |
| TCP 192.168.56.102:49170 -> 91.215.85.180:5222 | 2035892 | ET INFO NetSupport Remote Admin Checkin | Misc activity |
| TCP 91.215.85.180:5222 -> 192.168.56.102:49170 | 2035895 | ET INFO NetSupport Remote Admin Response | Misc activity |
| TCP 192.168.56.102:49170 -> 91.215.85.180:5222 | 2035892 | ET INFO NetSupport Remote Admin Checkin | Misc activity |
| TCP 192.168.56.102:49170 -> 91.215.85.180:5222 | 2035892 | ET INFO NetSupport Remote Admin Checkin | Misc activity |
Suricata TLS
No Suricata TLS
| suspicious_features | GET method with no useragent header | suspicious_request | GET http://geo.netsupportsoftware.com/location/loca.asp | ||||||
| request | GET http://geo.netsupportsoftware.com/location/loca.asp |