File scan report
Verdict Safe
Is net9.
Two of the 68 antivirus engines that checked it raised conflicting trojan labels, while broad prevalence, major silence, clean combined sandbox results, and checked host…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
2 of 68 flagged
- Flagged 2
- No detection 66
- No result 7
- Code signing Not applicable
- Test run Completed
- First seen 7mo ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only ClamAV and Zillya flagged this archive, and their family labels disagree; none of the 18 reporting major antivirus engines detected it. Its distribution across 246 sources, clean combined sandbox verdict, and fully checked contacts with no reputation hits make false-positive detections substantially more likely.
The detection ratio is low at 2 of the 68 antivirus engines that checked it, with no support from the 18 reporting major antivirus engines and no family consensus. The two detections also name different families, weakening attribution to either Aotera or Shelm. Observation from the test run produced a clean combined verdict, no named injection target, and no corroborated high-risk technique. All seven distinct non-background contacts were checked without a malicious or suspicious reputation result, and neither public sample intelligence nor malware-specific community rules produced a hit. The archive has also appeared through 246 distinct sources since it was first seen on Mar 9, 2026, providing a strong benign prevalence anchor.
What We Detected
ClamAV and Zillya flagged the archive, producing two detections among 75 engines. Their labels name different trojan families, while all 18 reporting major antivirus engines—including Kaspersky, ESET-NOD32, BitDefender and Fortinet—reported no detection.
Threat Behavior
The combined sandbox verdict was clean. No named process-injection target, persistence indicator, or corroborated high-risk technique was observed. The apparent defence-related mapping lacked the underlying artefact and therefore does not establish tampering. All seven distinct non-background contacts were covered by the reputation check, with no malicious or suspicious results.
What To Do Now
The available evidence strongly favors false positives, particularly given the archive's 246-source distribution history. Obtain it from the project's official release channel, keep security software enabled, and verify the archive hash before use.
Where this verdict could be wrong2 caveats
- ClamAV and Zillya independently applied different trojan-family labels, so the minority detections cannot be dismissed as duplicate engine branding.
- The archive has no verified publisher identity, and our own static analysis of its contents was not available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 18 reporting major antivirus engines detected the archive.
- The combined sandbox verdict was clean, with no named injection target or corroborated high-risk technique.
- The file has been submitted by 246 distinct sources across 259 submissions.
- All seven distinct non-background contacts were checked, with no malicious or suspicious reputation results.
- No MalwareBazaar entry or malware-specific YARA rule matched the hash.
- ClamAV labels the archive Aotera malware.
- Zillya labels the archive Shelm trojan.
- The ZIP archive itself provides no verified publisher identity, and a byte-level static inspection by our service was unavailable.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 6sandbox rule tags
- 11spawned processes
- 2network contacts
- 15filesystem & mutex artifacts
Includes the sandbox verdicts, 6 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 68 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The Safe verdict weighed these detections and treats them as non-decisive.
- ClamAVWin.Malware.Aotera-10060486-0
- ZillyaTrojan.Shelm.Win32.7849
File fingerprint
- Last analyzed
- Oct 23, 2026, 10:21 AM UTC
- SHA-256
68a0b524b5710b5e263010412b28f4c76479d2ce7068aee849853760de2130fc- SHA-1
33f3fab484f6f1187ac534d5ed83d72b8efce34a- MD5
8aa0b006a0e4875adda01c474ab3b146
About this file
net9.0-win-x64-release.zip is a ZIP file of 32.2 MB.
- Type and size
- ZIP · 32.2 MB
- Signer
- Not applicable
- First seen
- Mar 9, 2026On VirusTotal.
- Submitted by
- 246 distinct sources
First scanned
Includes every engine result (75) and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is net9.0-win-x64-release.zip safe?
What is net9.0-win-x64-release.zip?
How many antivirus engines detected net9.0-win-x64-release.zip?
What is the SHA-256 hash of net9.0-win-x64-release.zip?
Is it safe to open or extract net9.0-win-x64-release.zip?
How up to date is this analysis of net9.0-win-x64-release.zip?
Community
Member reviews and reports for this exact file hash.