home

gameportal.static.game.zing.vn

Domain Information

Server location:
Ho Chi Minh, Vietnam (VN)

ASN:
AS38244 VNNIC-AS-VN Trung tam VNNIC,VN

Root domain:
zing.vn

Scanner detections:
Malware distribution  (60% detected)

Scan engine
Details
Detections

Comodo Security
UnclassifiedMalware
60.00%

ESET NOD32
Win32/RiskWare.StartPage (variant)
60.00%

Baidu Antivirus
Trojan.Win32.StartPage
60.00%

Rising Antivirus
PE:Trojan.Dropper!6.3CE, PE:Malware.Generic/QRS!1.9E2D [F]
40.00%

Trend Micro House Call
TROJ_GEN.F47V0909
20.00%

K7 AntiVirus
Riskware
20.00%

McAfee
Artemis!8BA3F1DD9257
20.00%

ESET NOD32
Win32/RiskWare.StartPage.A application
20.00%

The domain gameportal.static.game.zing.vn has been seen to resolve to the following 3 IP addresses.

120.138.68.103
ptr.vng.vn
February 13, 2016

120.138.68.102
ptr.vng.vn
February 13, 2016

120.138.68.105
ptr.vng.vn
February 13, 2016

File downloads found at URLs served by gameportal.static.game.zing.vn.

4 / 68      (Malware)
http://gameportal.static.game.zing.vn/upload/data/.../VuiGame-Sieunhanratay-Ingame-1.0.exe  (8ba3f1dd92577e826c332b2113d4f8b0)

4 / 68      (Malware)
http://gameportal.static.game.zing.vn/upload/data/.../VuiGame-Chemhoaqua-Ingame-1.0.exe  (c35b02e0ecf016c8a617624b302424fc)

4 / 68      (Malware)
http://gameportal.static.game.zing.vn/upload/.../VuiGame-setup-1.0.exe  (46bf0c54439719cdcb116e767a477014)

2 / 68
http://gameportal.static.game.zing.vn/.../UnityWebPlayerFull.exe  (install.exe)

1 / 68      (inconclusive)
http://gameportal.static.game.zing.vn/upload/data/.../VuiGame-boom-1.0.exe  (f83b4c607632d64a14e3cbcfba833086)

The following 4 files have been seen to comunicate with gameportal.static.game.zing.vn in live environments.

TCP » 120.138.68.103:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 120.138.68.105:80
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 120.138.68.103:80
icedragon.exe (IceDragon by COMODO Security Solutions)

TCP » 120.138.68.103:80
wajaminternetenhancerapp.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

TCP » 120.138.68.105:80
wajaminternetenhancerapp.exe (Wajam Internet Enhancer by Wajam Internet Technologies)

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.