URLhaus Database

You are currently viewing the URLhaus database entry for http://bayokokikaku.xsrv.jp/temp/q5C4/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1968306
URL: http://bayokokikaku.xsrv.jp/temp/q5C4/?i=1
URL Status:Offline
Host: bayokokikaku.xsrv.jp
Date added:2022-01-11 20:12:07 UTC
Last online:2022-01-14 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-11 20:13:06 UTC to hostmaster{at}nic[dot]ad[dot]jp)
Takedown time:2 days, 14 hours, 39 minutes Poor (down since 2022-01-14 10:52:41 UTC)
Tags:doc emotet link epoch4 heodo link SilentBuilder

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-12rrydE950055.xlsmxls aa65a34067b0c50e89c1078d0c7ff08de43e5036241404574f846265de6ff6bdn/aHeodo
2022-01-12HhCH_145196765.xlsmxls 66f5a05e98200743eb34cad5877b89dd359fbc2c8f4ced8da536851e0ac44689n/aSilentBuilder
2022-01-12H8482951.xlsmxls 228b8793653662088991f7cfa3b368bce32931a7516a2f8c7188a437eb03a856n/aSilentBuilder
2022-01-12lutm480.xlsmxls 48d83d3b6c7ddfcbf30ed8ebe2feb9bc8b5c97dbec16fdbbec64d120181f94a3n/a SilentBuilder
2022-01-1225-445246.xlsmxls 2c8664d029f07581d91dfdf94de270580b998fbf62b88287101aab42304156b4Virustotal results 30.51%SilentBuilder
2022-01-12983-6289.xlsmxls 046d125d4eaf4ae30ad4a794405fd7c905b58db18824dfbe24dff1cd4cfd13b6Virustotal results 30.51% SilentBuilder
2022-01-12450374279_92.xlsmxls c468d97804e7a9fa569cfab4952c6fda72685adc622cec8aee02bb9c8f1a79aan/a Heodo
2022-01-12YETYH_1925.xlsmxls 8642a84875b30eeae2bec0b16db37715f4a2ff15caf6e5185a4012107ec1e87bn/aSilentBuilder
2022-01-1206417_1952219.xlsmxls 926c822e2c4d78b252f788d3fa75a77bfed1380ad50cdacf21f3efddf15b0b26n/aSilentBuilder
2022-01-12427767639723.xlsmxls 1b7581c8be4bf9197005067c42e581bcc1c41b10d6d9768daa8c4642f6e3ef7bn/a SilentBuilder
2022-01-12m-7938.xlsmxls f7d338277f13461262faa21c960479146f4261acc6efe564964f5cd0370afd6en/a SilentBuilder
2022-01-12eljroa-62.xlsmxls f710943ccdadad818f80e208b3ea05bb57523b5ca7ff2e9647abe730a65afe5fVirustotal results 23.33% SilentBuilder
2022-01-11484412653850076.xlsmxls 5dd8cf32347063a7b6b80c824526d1f58a3b8c99344eaea74dad15d687395f64Virustotal results 18.33%SilentBuilder
2022-01-11A46.xlsmxls 5a9b4efcbf4e2f0517f9d0b39ad038e37ec003dc7c2021213c7db00147268727Virustotal results 18.33%Heodo
2022-01-115790960-97434093.xlsmxls 5c5fd037c414e33a6538da72a5ea4ae89c8dac15b396b6a10e8504a0b5a7ee75Virustotal results 16.67%Heodo
2022-01-118174126_137522615.xlsmxls cd8e0110b182d3afd4d91cc9be83efb4de17b54e76e93d861acbd9e981906fb0Virustotal results 18.33%SilentBuilder
2022-01-1169443_69937.xlsmxls 15808d5cf09ee4a60ed9e18d0b403cd762cbf7613246e2cdfa6fba88eb654dd8Virustotal results 16.67%SilentBuilder
2022-01-11B599799450082612991S.xlsmxls 755b4ee15682c5a1e3567c5d710b241e03a8b6ce7080dc3ef0816be9ed6e06f7n/aSilentBuilder
2022-01-11D84989076643880402O.xlsxls 9ade9daf48cb63c929cd8e7ec03ac77ed41d362efaa79453d0eda4553747c404n/aSilentBuilder
2022-01-11I2466094998432B.xlsxls 77d7199bee787fb17ba47e4461be479b626921734ac55b7b76d42531c3b1a211Virustotal results 21.67%SilentBuilder
2022-01-11982798194.xlsxls fd3087fa953ec989caff35845ec2bc3cc41303ac26e0f0d0b8e25a325fee3a29n/aSilentBuilder
2022-01-11X133378089682.xlsxls 0dec37edf7d179a139b89569d030dc83a715e5d9a945d9dedc410c3fcdd09125n/a SilentBuilder
2022-01-11998377965747483721199.xlsxls 16d7bcdf815f970d749fe920c0ddd616f7466ab5bb9abf19fb54984f13b3b462Virustotal results 20.00% SilentBuilder