Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

tndv.zip

ZIP Format

Category	Machine	Started	Completed
FILE	s1_win7_x6402	June 20, 2023, 5:56 p.m.	June 20, 2023, 5:59 p.m.

Size	2.2MB
Type	Zip archive data, at least v2.0 to extract
MD5	`83b338082fc994430cd4c0c27077f1c9`
SHA256	`d15938851d2b1340c537fe0e08dd6fac4255440fd361ef3599a1a490f3dea139`
CRC32	`5E7A3419`
ssdeep	`49152:HZjQXorDcQhg7dMnEBJCgkh3V/4msgNbbZnN7p4lVG5PWZ5FvcBQ:HqWg7OEB1kh3VuGZp4bIP+UQ`
Yara	zip_file_format - ZIP file format

Name	Response	Post-Analysis Lookup
geo.netsupportsoftware.com	A 62.172.138.8 CNAME geography.netsupportsoftware.com A 62.172.138.67	62.172.138.8
securiji1.com	A 209.250.244.251	209.250.244.251

IP Address	Status	Action
164.124.101.2	Active	Moloch
209.250.244.251	Active	Moloch
62.172.138.8	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49168 -> 62.172.138.8:80	2034559	ET POLICY NetSupport GeoLocation Lookup Request	Potential Corporate Privacy Violation
TCP 192.168.56.102:49169 -> 62.172.138.8:80	2034559	ET POLICY NetSupport GeoLocation Lookup Request	Potential Corporate Privacy Violation
TCP 192.168.56.102:49167 -> 209.250.244.251:1212	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 209.250.244.251:1212 -> 192.168.56.102:49167	2035895	ET INFO NetSupport Remote Admin Response	Misc activity
TCP 192.168.56.102:49167 -> 209.250.244.251:1212	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 209.250.244.251:1212 -> 192.168.56.102:49167	2035895	ET INFO NetSupport Remote Admin Response	Misc activity
TCP 192.168.56.102:49167 -> 209.250.244.251:1212	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity
TCP 192.168.56.102:49170 -> 62.172.138.8:80	2034559	ET POLICY NetSupport GeoLocation Lookup Request	Potential Corporate Privacy Violation
TCP 192.168.56.102:49167 -> 209.250.244.251:1212	2035892	ET INFO NetSupport Remote Admin Checkin	Misc activity

Suricata TLS

No Suricata TLS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://geo.netsupportsoftware.com/location/loca.asp

Performs some HTTP requests (1 event)

request

GET http://geo.netsupportsoftware.com/location/loca.asp

File has been identified by 18 AntiVirus engines on VirusTotal as malicious (18 events)

Lionic	Riskware.ZIP.NetSup.1!c
DrWeb	Program.RemoteAdmin.837
Alibaba	RiskWare:Win32/NetSup.552dec19
Cyren	W32/Tool.EQYN-2153
ESET-NOD32	Win32/NetSupportManager.AD
Kaspersky	not-a-virus:RemoteAdmin.Win32.NetSup.i
Tencent	Win32.Trojan.Netsup.Rimw
Zillya	Trojan.GenCBL.Win32.9416
McAfee-GW-Edition	Artemis!PUP
Jiangmin	RemoteAdmin.NetSup.h
ZoneAlarm	not-a-virus:HEUR:RemoteAdmin.Win32.NetSup.gen
GData	Archive.Trojan.Agent.FW3MVG
Google	Detected
Rising	HackTool.NetSupport!1.E317 (CLASSIC)
Yandex	Riskware.RemoteAdmin!myez5VmqQPE
Ikarus	Trojan.RAT.Netsupportmanager
MaxSecure	Trojan.Malware.73446946.susgen
Fortinet	Riskware/Application