URLhaus Database

You are currently viewing the URLhaus database entry for http://host-file-host9.com/files/5388_1637619855_4035.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1808470
URL: http://host-file-host9.com/files/5388_1637619855_4035.exe
URL Status:Offline
Host: host-file-host9.com
Date added:2021-11-23 08:54:04 UTC
Last online:2021-11-30 14:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Status unknown
Cloudflare :Blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: abuse_ch
Abuse complaint sent (?): Yes (2021-11-30 14:06:05 UTC to noc{at}baxet[dot]ru)
Takedown time:7 days, 6 hours, 40 minutes Bad (down since 2021-11-30 15:34:41 UTC)
Tags:exe RedLineStealer link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2021-11-28n/aexe 48323c89d6d48fc2ebea3d5ffdb3675307160107f980a25b85cee85c0b2b62fdn/a 
2021-11-28n/aexe 7c372af38dc47dad0c305e4f42343e04825357266f70e2555d644127fcccb2efn/a 
2021-11-27n/aexe c012409e602c14954cb63beb913d004cbce5a65327f6d80f7b61db9fd297155en/a 
2021-11-25n/aexe 82a002b35974c0eceb45e760f5f036e87c432dc49601ebd956ec1286da5d8f0fn/a 
2021-11-25n/aexe f162797e7aada482d0c79d6c6a55322b395692bf54c30edc4b775eb883818890n/a 
2021-11-25n/aexe da21504980d87a088b101a2b6f29cc636589ef54ddc32ea6f8dcd63133925c2dn/a RedLineStealer
2021-11-25n/aexe 35acbd7443f8f51982e7743a6ab76d9357fe9f352623c4832494da1e314e11d9n/a 
2021-11-25n/aexe d0a29f758d8127012b783faa1f975da722097a4c30ea54daf1b939c321baca3fn/a 
2021-11-23n/aexe 94439a036e65f5ef096baab32f2b95377640c3c286707867b62ffa2bbcba1438n/aRedLineStealer