Report - www.ztree.com/download/ztw24217.zip

Report Overview

Visited public
2024-07-10 09:41:30
Tags
URL
www.ztree.com/download/ztw24217.zip
Finishing URL
about:privatebrowsing
IP / ASN
74.208.236.196
#8560 IONOS SE
Title
about:privatebrowsing

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
aus5.mozilla.org	2548	1998-01-24	2015-10-27 08:06:24	2024-07-08 18:14:40	512 B	1.2 kB	35.244.181.201
r10.o.lencr.org	unknown	2020-06-29	2024-06-06 21:45:11	2024-07-08 18:12:20	2.3 kB	6.2 kB	23.36.76.226
www.ztree.com	unknown	1997-04-02	2012-09-13 19:05:41	2019-11-11 22:45:30	489 B	2.0 MB	74.208.236.196

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

No alerts detected

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

Files detected

URL
www.ztree.com/download/ztw24217.zip
IP
74.208.236.196
ASN
#8560 IONOS SE

File type
Zip archive data, at least v2.0 to extract, compression method=deflate
Size
2.0 MB (2037927 bytes)
Hash
9c7f2009bebbfaff82a1ba764399e64a
9bc53e73cb73ebda9a4684abb4d4024d38de438f
f1b533f46ceefd52a285d4f0f5ddcbfada17686eff680525bd1347997d3e1a59

Archive (15)

Filename

Md5

File type

ARCHIVER.BB_

63dd3df3b59807eb5cf868e1f3aa029e

ISO-8859 text, with CRLF line terminators

UnRAR.dll

e224eda7b8897e87dd0bccd29161e59e

PE32 executable (DLL) (console) Intel 80386, for MS Windows, 5 sections

UnRAR64.dll

ffb7e5fd3b73b4bacaf1bc798e86ac53

PE32+ executable (DLL) (console) x86-64, for MS Windows, 7 sections

UNZIP32.dll

a82bdaae0ce19b700f6e9800c8e5069b

PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, 5 sections

UNZIP64.Dll

4d8c79bcb8ae2925e7534604483d9af1

PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 6 sections

ZSHELL.EXE

183b71c50b27afbb2d9d648b7c5255d0

PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections

ZSHELL64.EXE

0a29c6689470ff2264a3fd92e8df44ab

PE32+ executable (GUI) x86-64, for MS Windows, 5 sections

ZTW.EXE

13081531eee3ee1e3c3646e085ffbfd2

PE32 executable (console) Intel 80386, for MS Windows, 4 sections

ZTW64.EXE

2708357b7124cdcdc7beb45dc61a4bce

PE32+ executable (console) x86-64, for MS Windows, 6 sections

ZTW_CFG.EXE

f7eaebec3ca49569502682e88629caba

PE32 executable (console) Intel 80386, for MS Windows, 4 sections

ZTW.HLP

f5826eb4dcdc631ff42f080732c9a952

data

ZTREE.INF

8f7c545a8dc31c8abf3f8ecfaffddcd7

Windows setup INFormation

ZTW.INF

9ea02e584400e25d2a4bedfa3caed29c

Windows setup INFormation

ZCOLORS.IN_

fcc4a9639b1393f05024ca91b598e26d

ASCII text, with CRLF line terminators

BETA.TXT

58b11a47487bbfaa53436007ab98880b

ASCII text, with CRLF line terminators

Detections

Analyzer	Verdict	Alert
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe
YARAhub by abuse.ch	malware	files - file ~tmp01925d3f.exe

JavaScript (0)

HTTP Transactions (9)

	URL	IP	Response	Size
	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash b34ca6af54e2b9fea57d418f5d1928f7 510b69f4470789a573217726d6f1a3d6ee765460 41e6a348aac9e9db44bfa14b3aa29d411f4489b375ae1f1be6b0d280af98541d HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "41E6A348AAC9E9DB44BFA14B3AA29D411F4489B375AE1F1BE6B0D280AF98541D" Last-Modified: Mon, 08 Jul 2024 01:53:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=7623 Expires: Wed, 10 Jul 2024 11:48:07 GMT Date: Wed, 10 Jul 2024 09:41:04 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash c2f3e4e1f94efa7a80f9deeb3d459176 7a8f013a3d13ffe4241b8e2a8b9ca63daeeace53 5f9feb641b1e74a7c14eee1104953d1e9faa0341d1f27fdbd50fa8207e6c0ac8 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "5F9FEB641B1E74A7C14EEE1104953D1E9FAA0341D1F27FDBD50FA8207E6C0AC8" Last-Modified: Tue, 09 Jul 2024 15:27:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=10054 Expires: Wed, 10 Jul 2024 12:28:38 GMT Date: Wed, 10 Jul 2024 09:41:04 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash e7492695b5254a3a63fcffb4f1ee8cec 0361713c6d8129210245347284c7c6babfd28fb7 5d1bc1c01894fd88a0d4680490977488d6458bb58a98ace24ef8aa103538bc1f HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "5D1BC1C01894FD88A0D4680490977488D6458BB58A98ACE24EF8AA103538BC1F" Last-Modified: Tue, 09 Jul 2024 23:47:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5537 Expires: Wed, 10 Jul 2024 11:13:21 GMT Date: Wed, 10 Jul 2024 09:41:04 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.76.226		504 B
URL r10.o.lencr.org/ IP 23.36.76.226:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash 9b556e25e514a3cd5829bc4d938e5517 85eeba07dc1438e7433ce7a145500164d842d5db 22f599883dc87540746708049ea46ec4eb88c81c924ba145a58bebd5ee3199cb HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "22F599883DC87540746708049EA46EC4EB88C81C924BA145A58BEBD5EE3199CB" Last-Modified: Tue, 09 Jul 2024 16:21:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=5941 Expires: Wed, 10 Jul 2024 11:20:05 GMT Date: Wed, 10 Jul 2024 09:41:04 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash e4399bc07052d0e83cade5fa20225368 fc3d948b013a94e85416031bdc004da4959a6e78 d7bef717510dab7c3bb629fa40aa089c8a430858ec3317ae58704ea5f7594504 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "D7BEF717510DAB7C3BB629FA40AA089C8A430858EC3317AE58704EA5F7594504" Last-Modified: Mon, 08 Jul 2024 20:37:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=3658 Expires: Wed, 10 Jul 2024 10:42:03 GMT Date: Wed, 10 Jul 2024 09:41:05 GMT Connection: keep-alive`

	www.ztree.com/download/ztw24217.zip	74.208.236.196	200 OK	2.0 MB
URL User Request GET HTTP/2 www.ztree.com/download/ztw24217.zip IP 74.208.236.196:443 ASN #8560 IONOS SE Certificate IssuerDigiCert Inc Subject.ztree.com Fingerprint95:30:5B:DE:2D:FD:5C:21:30:8B:18:46:06:58:48:9C:B8:3A:A7:E5 ValidityMon, 24 Jun 2024 00:00:00 GMT - Mon, 07 Jul 2025 23:59:59 GMT File type Zip archive data, at least v2.0 to extract, compression method=deflate Size 2.0 MB (2037927 bytes) Hash 9c7f2009bebbfaff82a1ba764399e64a 9bc53e73cb73ebda9a4684abb4d4024d38de438f f1b533f46ceefd52a285d4f0f5ddcbfada17686eff680525bd1347997d3e1a59 HTTP Headers `GET /download/ztw24217.zip HTTP/1.1 Host: www.ztree.com User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,/*;q=0.8 Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br DNT: 1 Upgrade-Insecure-Requests: 1 Connection: keep-alive Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Pragma: no-cache Cache-Control: no-cache` `HTTP/2 200 OK content-type: application/x-zip-compressed content-length: 2037927 last-modified: Fri, 10 Nov 2023 05:25:49 GMT accept-ranges: bytes etag: "4ac985d9613da1:0" server: Microsoft-IIS/10.0 x-powered-by: ASP.NET date: Wed, 10 Jul 2024 09:41:04 GMT X-Firefox-Spdy: h2`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash d7b2c37e4b6c062d80ad32046f42d3d8 131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c 317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2" Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=17541 Expires: Wed, 10 Jul 2024 14:33:27 GMT Date: Wed, 10 Jul 2024 09:41:06 GMT Connection: keep-alive`

	r10.o.lencr.org/	23.36.77.32		504 B
URL r10.o.lencr.org/ IP 23.36.77.32:0 ASN #20940 Akamai International B.V. File type data Size 504 B (504 bytes) Hash d7b2c37e4b6c062d80ad32046f42d3d8 131cd5c2ca2a258c3cf11746f94cfd43a6a4f04c 317f60a1498c7b52833955e8a54a0ba66b5b8dc9e9862c2ac262b874d491fce2 HTTP Headers `POST / HTTP/1.1 Host: r10.o.lencr.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/ocsp-request Content-Length: 85 Connection: keep-alive Pragma: no-cache Cache-Control: no-cache` `HTTP/1.1 200 OK Server: nginx Content-Type: application/ocsp-response Content-Length: 504 ETag: "317F60A1498C7B52833955E8A54A0BA66B5B8DC9E9862C2AC262B874D491FCE2" Last-Modified: Mon, 08 Jul 2024 05:32:00 UTC Cache-Control: public, no-transform, must-revalidate, max-age=17541 Expires: Wed, 10 Jul 2024 14:33:27 GMT Date: Wed, 10 Jul 2024 09:41:06 GMT Connection: keep-alive`

	aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml	35.244.181.201		444 B
URL aus5.mozilla.org/update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml IP 35.244.181.201:0 ASN #396982 GOOGLE-CLOUD-PLATFORM File type XML 1.0 document, ASCII text, with very long lines (332) Size 444 B (444 bytes) Hash 3b324dec137a87ef7e24a30a65b13dd0 c0faa95b2f1018e264b3a14aaf50d1003e6c27b3 6cd0b591d9239fc8564627e92a804fc261951b1cbaf5fa58a8ada3cc13f51463 HTTP Headers `GET /update/3/GMP/111.0a1/20240129201730/Linux_x86_64-gcc3/null/default/Linux%205.15.0-102-generic%20(GTK%203.24.37%2Clibpulse%20not-available)/default/default/update.xml HTTP/1.1 Host: aus5.mozilla.org User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate, br Cache-Control: no-cache Pragma: no-cache Connection: keep-alive Sec-Fetch-Dest: empty Sec-Fetch-Mode: no-cors Sec-Fetch-Site: cross-site` HTTP/2 200 OK server: nginx rule-id: unknown rule-data-version: unknown content-signature: x5u=https://content-signature-2.cdn.mozilla.net/chains/202402/aus.content-signature.mozilla.org-2024-08-13-18-26-52.chain; p384ecdsa=fO3ETDoKWR2XqRwVEt0Gg7k6luToC5svGQP1wenO0g-6q3C9hCpja5FvqKurW4eBGUZYTcRnLKXXExd_4WcmRQPIPJciyNi2Wtubb9xxjMiokQQE0XNn7npnYNObts4Y strict-transport-security: max-age=31536000; x-content-type-options: nosniff content-security-policy: default-src 'none'; frame-ancestors 'none' x-proxy-cache-status: EXPIRED content-encoding: gzip via: 1.1 google date: Wed, 10 Jul 2024 09:40:46 GMT content-type: text/xml; charset=utf-8 vary: Accept-Encoding content-length: 444 age: 37 cache-control: public,max-age=90 alt-svc: clear X-Firefox-Spdy: h2

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

Files detected

URL

IP

ASN

File type

Size

Hash

Archive (15)

Detections

JavaScript (0)

HTTP Transactions (9)

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL User Request GET HTTP/2

IP

ASN

Certificate

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers

URL

IP

ASN

File type

Size

Hash

HTTP Headers