ScreenShot
| Created | 2023.07.24 17:24 | Machine | s1_win7_x6402 |
| Filename | 1907_2.zip | ||
| Type | Zip archive data, at least v2.0 to extract | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : malware | ||
| VT API (file) | 11 detected (GenCBL, Tool, EQYN, RemoteAdmin, NetSup, Detected, HackTool, NetSupport, CLASSIC, myez5VmqQPE, susgen) | ||
| md5 | 16c3edc2eda2d4f64a25722073791f75 | ||
| sha256 | 1cbc7f1e161d8233f64762a48d0e9ca253e7c67ea72a3088c70b8e53d5ac20bb | ||
| ssdeep | 49152:8adcHZ2vRMmi9+s9vVaQj17Q2bqfekSVpKAyWgpfZ4rEna3DQDolVe5PWZ5FvcBY:Vd4YvRDi9+sXbWmkSblaardDUobAP+UY | ||
| imphash | |||
| impfuzzy | |||
Network IP location
Signature (4cnts)
| Level | Description |
|---|---|
| danger | Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) |
| watch | File has been identified by 11 AntiVirus engines on VirusTotal as malicious |
| notice | HTTP traffic contains suspicious features which may be indicative of malware related traffic |
| notice | Performs some HTTP requests |
Rules (1cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| info | zip_file_format | ZIP file format | binaries (upload) |
Network (6cnts) ?
Suricata ids
ET POLICY NetSupport GeoLocation Lookup Request