URLhaus Database

You are currently viewing the URLhaus database entry for http://enduringhighperformance.demo9lec.co.za/kxqyx/k_2485036/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1968229
URL: http://enduringhighperformance.demo9lec.co.za/kxqyx/k_2485036/?i=1
URL Status:Offline
Host: enduringhighperformance.demo9lec.co.za
Date added:2022-01-11 19:47:08 UTC
Last online:2022-01-14 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-11 19:49:07 UTC to abusepoc{at}afrinic[dot]net)
Takedown time:2 days, 20 hours, 18 minutes Poor (down since 2022-01-14 16:07:11 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-123180441.xlsmxlsm 947dc8d6c337a63466168a9efb2e42e692fad8da89af9c4c295fcd174a89c979Virustotal results 9.84%Heodo
2022-01-12DVJ-849.xlsmxlsm f20a142423cea7ec0369d225894d4cf71f4c31d425bf0215de2b6277a5354192n/a Heodo
2022-01-11MGPA_276044.xlsmxlsm d3e6a6a97ad6e4f79e73386e88cddd5b958d0f8745c551837dd366b929671704Virustotal results 10.17% Heodo
2022-01-110919425MTSTUJINQ_2.xlsmxlsm e06e1cc33f42f59f86b44d17359234628540e287dc10a39ac66ae21449abd380Virustotal results 9.68%Heodo
2022-01-11CKG-084.xlsmxlsm aaa2fbc449fbe3b4eb3c69e272ff4b1f3723b0741d5fe86ced352aece337439cn/a Heodo
2022-01-11332595_6.xlsmxlsm dd14be16e01e5fe53b7cf8199af830a979dbbbc33593606f3b25d7ea3b32697cn/a Heodo
2022-01-112354885_2.xlsmxlsm 2a43f2180ac8723fc79222c637ad6743128611c7c89843cec720bd884dd1b72fn/a Heodo
2022-01-11tb_014.xlsmxlsm 8ad61be673c186c9cdfb6c6c8d750fbcf80f920d4905742c0ed9d67833026ed7n/a Heodo
2022-01-11GKE_51.xlsmxlsm 71da6e57fe5adfa0b06f8ba9525e6db95e7c25246179fa8563561d24e79e6c65Virustotal results 9.68% Heodo
2022-01-11GPJT_1.xlsmxlsm 929fd76e8373d3c14a1fa542d4222dba73cb21f0c5cdaa0c8b7acea0a53d8f0bVirustotal results 10.00% Heodo
2022-01-11WGF-34.xlsmxlsm c2cb81db208398e070c47e7d03e76709142dec85ddaa985883536283a0acbb14n/aHeodo
2022-01-11esAM11972.xlsmxlsm 79a935edd516953713a4d4565e5dfcbbb08f17b9633f31d84e0e042a5de4c178n/a Heodo
2022-01-11Z-50192783.xlsmxlsm eabf9bfbdc503869315be500dab8f676c77bc6111c99ebeaec1981e1dc95af9cn/a Heodo
2022-01-1161242-6810672.xlsmxlsm 867a5e845a227cfb9fa1988fa078679d6b6fa0bae43ffebfe412f97bba373ddfn/a Heodo