URLhaus Database

You are currently viewing the URLhaus database entry for https://foryou22.xyz/wp-includes/css/dist/customize-widgets/KLG_24/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1973782
URL: https://foryou22.xyz/wp-includes/css/dist/customize-widgets/KLG_24/?i=1
URL Status:Offline
Host: foryou22.xyz
Date added:2022-01-13 12:22:05 UTC
Last online:2022-01-13 17:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-13 12:23:12 UTC to abuse{at}amazonaws[dot]com)
Takedown time:5 hours, 8 minutes Good (down since 2022-01-13 17:31:49 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-13252408116_072.xlsmxlsm 3e8ac5b89fdb8697813438a75aec6df15ad029e5c499a023f5bc7a209ff1b13bVirustotal results 31.15%Heodo
2022-01-13M5046.xlsmxlsm 78dd5816d66701839612b5caf64d4337e45d516e52b5f177345f5019ce4aa907Virustotal results 31.15% Heodo
2022-01-13551247_5879.xlsmxlsm e07efb44e73f01e1cd957c1874bce0e453c91eaa561f46efb373edb97100320an/a Heodo
2022-01-13161576049938.xlsmxlsm e8da2349f8ec549d999a3e63b1f859f0452b0301aaf4fced70ecbba675b81247n/a 
2022-01-137536_67.xlsmxlsm a8b105b33e639fbfaf784868e4c8b14639d7e0dfbde96bb5071fa8d7160595fen/a Heodo
2022-01-131539819-6.xlsmxlsm c9d6e67d61769e32b703185a1035e43bbc9c7c053cc1d06594fad3979da3cc9en/a Heodo
2022-01-13126601661_58669841.xlsmxlsm 1070ee81825904e9b69247d5ecd09aa91e0be9722ff1b627740e98e0bd48ee7fn/a Heodo
2022-01-136357_64.xlsmxlsm 5d7049ddd0c94d31087e9b7809dd67ab2c097e01ffacb571225e7ab561f57f39n/a Heodo
2022-01-13RyynLD7960803.xlsmxlsm 109868bbf981851bac44548c11bee90f08fd3c83e06c9b9539f568e047f45e0an/a Heodo
2022-01-1342635483-97.xlsmxlsm 4624a6c75a73e206d26cf23225ddf8c14c9bd3fac85edc04aebf63a281aa8bd4Virustotal results 31.75% Heodo
2022-01-13442143939_156373.xlsmxlsm aeb70e41209244bbbb3f870a325ee369ce718361b2caf361f8472ce7b1b7001dn/a Heodo
2022-01-13718_34.xlsmxlsm e867e8691b17fd95fce36eb933b1c36744f45513e44d931d07bf95229e47bef1n/a Heodo
2022-01-13948935213_3125.xlsmxlsm b3a8073712469f70329fad465825f867bd6dcf83420de3004730f91ecc938138n/a Heodo