URLhaus Database

You are currently viewing the URLhaus database entry for https://xetaimt.com/ooecgp9/rlb4/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:179108
URL: https://xetaimt.com/ooecgp9/rlb4/
URL Status:Offline
Host: xetaimt.com
Date added:2019-04-16 21:47:46 UTC
Last online:2019-05-06 06:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2019-04-16 21:48:06 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:19 days, 8 hours, 21 minutes Bad (down since 2019-05-06 06:09:46 UTC)
Tags:emotet link epoch1 exe heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2019-04-1866JpOghB.exeexe 1b6aa692ba88e13ddec659e9c601d305146fba99e16181467cdfe49c7b109918Virustotal results 18.18% Heodo
2019-04-17HGNPgggPViL7.exeexe 0e18bf797fbb5a31d3e88e09bd41c5f2e255d7d39153f86254928ec70f3a3c18n/a Heodo
2019-04-17xC9MKhGK.exeexe 2bb65ed1aaeebdcd629384f65783134cb1a15f877ff0c2d88d2e977fdb46acb8n/a Heodo
2019-04-179WssGAgs4N.exeexe 06b0aacfa0b6ec7017e1ade64a4bfdc0a8d76fc74772835dd44134b40833b9fbVirustotal results 30.00% Heodo
2019-04-17Nxg3c35Am.exeexe 50843f1c34dbe3de77a86615f7cc0064ebdabca83d2248dae7b93fbf8c7bb80eVirustotal results 39.73% Heodo
2019-04-17Mv7no5gPt.exeexe cabd6a707a679f24d05dc9017033592b7edefb0d4ff28ab374db176c5488ca42Virustotal results 10.61% Heodo
2019-04-17pQDOct3AP0Bl.exeexe f349869e1e5d51c932e1645562ba7bfe325faea0f049e81703325207c71103beVirustotal results 37.14% Heodo
2019-04-17TwOtS73TV3O.exeexe 93b93039ce9dc42388d55736d19e5d8e6393012acbb547e5486d5934c38ac292Virustotal results 33.33% Heodo
2019-04-17Slyldsfpany8.exeexe 94eed97bc2cc503578779d50643a04a08d28055cca96ff8800086b36542840ben/a Heodo
2019-04-17bkxtPZCrh.exeexe ba1a79b61bfaca2b9e6c7ee3a38ae1dc906ace1804ba2a66eb7a3e657551789aVirustotal results 32.84% Heodo
2019-04-17SboqSpzBERCg.exeexe 4201ca0efc7ee82ce843903a5ecd7f96bbae37b56ab00405817a96b241d06debVirustotal results 35.21% Heodo
2019-04-17OJiTZCKehk78.exeexe c56522a9b1cfd0ef11596fb80af03942ac3b0cc7fe067b74e89d66530f248027n/a Heodo
2019-04-17yyGdNoNLZ.exeexe ff38619af5ec74c2dca2c5b92ce5fa62b21596f3f16280458ccb47818721c8c6Virustotal results 34.72% Heodo
2019-04-17STAi6MtnFR9.exeexe 86814aaa96560342434fd38b84e6be4f1bb2f4e9656e03de086765e8facafacfn/a Heodo
2019-04-17nOEVy01Y.exeexe 270696e681aae3f24c7a3886f75952fd82c2bc94374c7fa1e72c5ae1583efcc0Virustotal results 35.21% Heodo
2019-04-178pb62avO.exeexe fe4505e505aa7255d8962f9e691c50a6a740416389509d1559664b877b3207b3Virustotal results 30.30% Heodo
2019-04-16NZiUYTZov.exeexe 42d5b442bcba882b9b67d483d983812918c8f16bf244617e5125e54ed39c45b4Virustotal results 22.06% Heodo