URLhaus Database

You are currently viewing the URLhaus database entry for https://testmp.dune.ru/wp-content/36833322550/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1971909
URL: https://testmp.dune.ru/wp-content/36833322550/?i=1
URL Status:Offline
Host: testmp.dune.ru
Date added:2022-01-12 21:51:04 UTC
Last online:2022-02-16 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: sugimu_sec
Abuse complaint sent (?): Yes (2022-01-12 21:52:06 UTC to abuse{at}rt[dot]ru)
Takedown time:1 month, 4 days, 18 hours, 56 minutes Bad (down since 2022-02-16 16:48:22 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-1342312SIP-6864.xlsmxlsm 9f47ddb444c9cffedc84c7eaf7c80d10b990146564954a6134a910733bc0a38dVirustotal results 22.58% Heodo
2022-01-13699786083310235.xlsmxlsm 236a6d0de83a050c7865dba3da1e5ec1e210668e47a23499a833dd10551e9087n/a Heodo
2022-01-13RT_8.xlsmxlsm 80f732153350e276a2b676506c38904e02387501bbd7946340ee90858bcc5f79Virustotal results 22.58% Heodo
2022-01-13352_47.xlsmxlsm 893ba5ebbec60ae32f6e7180100a746265c834939520ae0aa743c3890a7d2d59Virustotal results 29.51% Heodo
2022-01-1341395350.xlsmxlsm b76e18e3aa77d8a35159a5b34f93940a933d206ef27896c6abca13c2686d24abn/a Heodo
2022-01-13939838_8174274.xlsmxlsm 3ccc385404055d349d08f8743232053863df38651ccac0bc96a0935598a00c1an/a Heodo
2022-01-13148_034252.xlsmxlsm b5befbca72d6e064f55ecaf38f0ca70b8347f959011fd47e991ce5d8aa309de1n/a Heodo
2022-01-13NMMT_93344811.xlsmxlsm 890e54734498c0cf6c05a9678b66b29e3c38203ea61f83937a017ba7afed9809Virustotal results 31.15% 
2022-01-1335380XYSNKGBN_05336501.xlsmxlsm d905d5f3fc80edd51d193d823475379dafd7bc2d3d80d5c018e7151c1baa28dan/a Heodo
2022-01-134122_497.xlsmxlsm b4fb2c694f76e85c361b9c285f67b7a5a15074919db0b9eb2d55521390eedbc3n/a 
2022-01-13325236-0752377.xlsmxlsm 43b4a4ded4844dc3840f383b8b10f7c9691f0044e5cf6a24681fdd62927988acn/a 
2022-01-1380496847962.xlsmxlsm 55831e6466e727c6dc0efc619eefaf7ff2a89d4ccb2f770e34aa49cd4a9894b9n/a Heodo
2022-01-13OHM-738749.xlsmxlsm 8bbb676c7050da79e895b56bb776939362302b3c8b14612ddda54109563de801Virustotal results 28.57% Heodo
2022-01-139618550838.xlsmxlsm c04abc3378a389c7769ed89de8e5d82f4cb311647e4f363641a807fc6a399f39n/a Heodo
2022-01-13128ZVFMT45885.xlsmxlsm 603fc4bf5e141be1b30fb64551545d7f757d7f508891d17256ffc5564f3ccfc8n/a Heodo
2022-01-1314808264468.xlsmxlsm e07efb44e73f01e1cd957c1874bce0e453c91eaa561f46efb373edb97100320an/a Heodo
2022-01-13858112WSVJ_9755.xlsmxlsm 4f9ce5c9c9dd88a6a01a3df3299e0aa43da3bad195036c22b141f28769708334Virustotal results 27.87% 
2022-01-13UO-564.xlsmxlsm febd9978510715acb1f4bb87d04412fb1e3e6e2720329590b6b146de515d2d85n/a 
2022-01-1358251339-79.xlsmxlsm c9d6e67d61769e32b703185a1035e43bbc9c7c053cc1d06594fad3979da3cc9en/a Heodo
2022-01-13607350903172.xlsmxlsm 1070ee81825904e9b69247d5ecd09aa91e0be9722ff1b627740e98e0bd48ee7fn/a Heodo
2022-01-13mb8298.xlsmxlsm 4c2cf1d0796d8ac276ad283bbb14986b510a2a3b33e76005c8968b653d43d844n/a Heodo
2022-01-13021308-687952.xlsmxlsm 109868bbf981851bac44548c11bee90f08fd3c83e06c9b9539f568e047f45e0an/a Heodo
2022-01-13Q10.xlsmxlsm 6bddf38bb58c7d8bd08898e834847c37292b0df1b11b21d23a55f3b062553608n/a Heodo
2022-01-132550248EHPUT430.xlsmxlsm 38e984900acb5a6830c8ea2b34c0b1b85c45b32848da185c5bd3e2546ade2311Virustotal results 8.06% Heodo
2022-01-12881876762-70528158.xlsmxlsm 20039ff121b47e5026b29877b299b76e47f3c7f766b9010a04e148a19823dbb6n/aHeodo
2022-01-126155782AFDPLUGLYQ3254105.xlsmxlsm 60610dee4927e907b5a6a4ac49f8c921fa8af7005b2e8deb2b26ffcc1cac6322Virustotal results 16.67%Heodo
2022-01-12792595_3831322.xlsmxlsm 24355720d9e3b12c0bd49ad9b2ade504263a3bc06d95103a3c086a316dc2ecbcn/a Heodo
2022-01-12Y-424.xlsmxlsm 9f0a7342511328df49b73e718bb20dd3db1437cb3d115548f9d6a0cfda3af0d3Virustotal results 19.67% Heodo
2022-01-12nfw_1687.xlsmxlsm 586f3fcc8654a5be1b03a87a7ed56d234e5edc6a98977d78163fb83a8ef299cdVirustotal results 20.34% Heodo
2022-01-1262SGCUWXL248.xlsmxlsm 9220fc47e54d3b04029eb989ec18b7cd46278893300c6ec1e8ae5d12209bc396Virustotal results 13.11% Heodo
2022-01-12pthctvc_2460.xlsmxlsm 6c7302d5b66f028999acc36158eba3a4e0c556e206535c5d8e73a0f3dd4bf6abn/a Heodo