URLhaus Database

You are currently viewing the URLhaus database entry for http://landleader.riseentrepreneur.co/wp-admin/G/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1967904
URL: http://landleader.riseentrepreneur.co/wp-admin/G/?i=1
URL Status:Offline
Host: landleader.riseentrepreneur.co
Date added:2022-01-11 17:42:06 UTC
Last online:2022-01-16 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-11 17:43:13 UTC to abuse{at}serversaustralia[dot]com[dot]au)
Takedown time:4 days, 15 hours, 15 minutes Bad (down since 2022-01-16 08:58:18 UTC)
Tags:doc emotet link epoch4 heodo link SilentBuilder

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-12toqv_6359623.xlsmxls c468d97804e7a9fa569cfab4952c6fda72685adc622cec8aee02bb9c8f1a79aaVirustotal results 26.67% Heodo
2022-01-12070361188329.xlsmxls 769ecd4d91e53cc734ede1b06a3935096e838020e44061032964dd769dda3968Virustotal results 28.81%SilentBuilder
2022-01-12PQQN_96495.xlsmxls 8642a84875b30eeae2bec0b16db37715f4a2ff15caf6e5185a4012107ec1e87bn/aSilentBuilder
2022-01-122812484527590.xlsmxls 926c822e2c4d78b252f788d3fa75a77bfed1380ad50cdacf21f3efddf15b0b26n/aSilentBuilder
2022-01-12bqid68055053.xlsmxls 9d277bf6e9b937c6b9d79db16b78f65ef5346b79c5c68fd3fda71a4e18171fe7Virustotal results 23.73% SilentBuilder
2022-01-12Y6980337.xlsmxls f9cbf3cdfa7ed91bca677fd8d8e1f0f53c193323abfbbb1ce4d7c6d2f1b9feeaVirustotal results 25.00% SilentBuilder
2022-01-12gpkxb-326.xlsmxls 9e0c891bd4b687d10b5c7d8082a2d4c7d24a0c9ea90b1d0aa09dafa6dee22047Virustotal results 23.33%SilentBuilder
2022-01-12078596024.xlsmxls f710943ccdadad818f80e208b3ea05bb57523b5ca7ff2e9647abe730a65afe5fn/a SilentBuilder
2022-01-11ZOIAI_55.xlsmxls 4e4fed9bc0e99667d6959b4513a5c89a5f76f2437b19ae6b5b8c3ff15ba2b71cn/aSilentBuilder
2022-01-11JRX_90100644.xlsmxls bfe1c65501eb9a22ea914fe380d24127cdf99ce17fc20683f99a7b1e0ccc06f8n/aSilentBuilder
2022-01-11K_314.xlsmxls 429e0de91bc404f5fc886f0618177f5bc49fe0da3940e98426c5d5cd8aed57cfVirustotal results 16.67%Heodo
2022-01-11QE_349.xlsmxls cd8e0110b182d3afd4d91cc9be83efb4de17b54e76e93d861acbd9e981906fb0Virustotal results 18.33%SilentBuilder
2022-01-1144335-0.xlsmxls 15808d5cf09ee4a60ed9e18d0b403cd762cbf7613246e2cdfa6fba88eb654dd8Virustotal results 16.67%SilentBuilder
2022-01-11G97754102469626S.xlsmxls 755b4ee15682c5a1e3567c5d710b241e03a8b6ce7080dc3ef0816be9ed6e06f7Virustotal results 15.25%SilentBuilder
2022-01-11X60462048072996386.xlsxls 73a93604b31a5b4b301dad4849b63d5e6e48ef8d946f6fbff48b485b1bce7a37n/a Heodo
2022-01-118988315Q.xlsxls 0dec37edf7d179a139b89569d030dc83a715e5d9a945d9dedc410c3fcdd09125n/a SilentBuilder
2022-01-11C7773641954602.xlsxls 03319a0f6c37911983650f91c2a01b29eac84b17bd99133626d11d08952ad9d4Virustotal results 18.33%SilentBuilder
2022-01-113209521703949041335.xlsxls a0a6e55d2714273e7c3866776a187cc320e9bfa5086632fc12ed94db2efbfc3dn/aSilentBuilder
2022-01-11916066876395.xlsxls 18e24e9b03fde05fa41b9d86aa612dbbd5deabcebbe97ee5b3a3b7fa8fb43f51n/aSilentBuilder
2022-01-1165360086758125347672.xlsxls a5a1c304ab3b2351a82da736cf9c022ea2ad1cbff6321b64b0a741b575c8a6c4n/a SilentBuilder
2022-01-11K6759577W.xlsxls b8600d1365521e1a2f83ae356900d38cf8c44b60594bbe30df2ac04418cd823en/aSilentBuilder
2022-01-1183641870932585.xlsxls b1facac75e8c07b20f413b7083f889cd502c32847a97c5cbed0d3e4051f9a139Virustotal results 20.00%SilentBuilder