URLhaus Database

You are currently viewing the URLhaus database entry for http://ir-watduoliprudential.com.watchdogdns.duckdns.org/mrd.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

URL: http://ir-watduoliprudential.com.watchdogdns.duckdns.org/mrd.exe
URL Status:Offline
Host: ir-watduoliprudential.com.watchdogdns.duckdns.org
Date added:2019-02-19 00:56:40 UTC
Threat:Malware download Malware download
Google Safe Browsing:Clean
Spamhaus DBL :Not listed
SURBL :Not listed
Quad9 :Blocked
AdGuard :Not blocked
Abuse complaint sent (?): Yes (2019-02-19 00:58:03 UTC to abuse{at}colocrossing[dot]com)
Takedown time:16 days, 6 hours, 8 minutes Bad (down since 2019-03-07 07:06:10 UTC)
Tags:exe LimeRAT payload RemcosRAT link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTSignature
2019-03-05n/aexe 64af09e2e96a2b891dfcfbf9c81e25d16f14ff0986834318313b22dfa83f6574n/a
2019-02-27n/aexe 5ac39b83b83353635ae629cfbc76030df55afd9adc4eb3343bef3925be6c8207n/a
2019-02-21n/aexe 27a3fc452725be3bbf5e82f96228b16bedd8747bbf5638c8277e7c76f07c857cVirustotal results 33.33%LimeRAT
2019-02-19n/aexe 110ef1bf1f55e400ef17c8179a25f696c4f667741b89a998ba0ea041fe53e916Virustotal results 63.08%RemcosRAT