URLhaus Database

You are currently viewing the URLhaus database entry for http://enduringhighperformance.demo9lec.co.za/kxqyx/AEL102/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1976357
URL: http://enduringhighperformance.demo9lec.co.za/kxqyx/AEL102/?i=1
URL Status:Offline
Host: enduringhighperformance.demo9lec.co.za
Date added:2022-01-14 10:54:05 UTC
Last online:2022-01-14 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-14 10:55:08 UTC to abusepoc{at}afrinic[dot]net)
Takedown time:5 hours, 13 minutes Good (down since 2022-01-14 16:08:38 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-1441880WTUNHDWOG_99400.xlsmxlsm dac736a5562b2a96cece573228b50c17f369d3912fef2b92dc5ea40d5c427034n/a Heodo
2022-01-14MNWK_67.xlsmxlsm 01e14e3c803705655e2068d80e77f2e2103118f38fa43791e069273b46c8cc0dn/a Heodo
2022-01-14NFQRF_0252983.xlsmxlsm 25ffc4f1a9abeb750423f929d563d90c09121eee81a928f86f02f8e4421f5c7bn/a Heodo
2022-01-14979146378-414553.xlsmxlsm 6cd312e77a99b26a6317e3c0d9e477cea62119b8ea0efa9bf09e53e9c792b6a7Virustotal results 33.90% 
2022-01-14844243205939.xlsmxlsm a972c47050ae7cf97f0c52155e8ab1462d5a9606eaf7140f1ee56f1e8a45dbb8n/a Heodo
2022-01-14xMGp_5206.xlsmxlsm 52d5a0ad07a847366ae9f83a1f2a3b7624f78929674eba661cacab8ae0ac9329n/a 
2022-01-142173729498874.xlsmxlsm 1f33cccbde25d58a817b0b6355084b8d0694bb104019808808694c2e6bbe2fbbn/a Heodo
2022-01-14186600_055.xlsmxlsm 02fef2f393dfa1693167af8424ff91f298d3c12bad8411580f82548c7876cdfdn/aHeodo
2022-01-14296346.xlsmxlsm e1f0eb778a09fec529aa7aff9d665828b18007c8e52d62565a552f606c04442fn/a Heodo
2022-01-14XPC_27.xlsmxlsm 33907752a95eb439381ffe72885f212ed6dc3f71fb2a3a352478b5fd83ab3eden/a Heodo
2022-01-14T_0.xlsmxlsm 1c8efbc70bde55f70789960968bfdb1a261eab6bc372e1f6859aee00261a7f82n/a 
2022-01-1407-9609781.xlsmxlsm 7ae8d061dd1dd74a37ac33eced5d361e376cc4b919bdfd82338595f8e17d1e46Virustotal results 33.87% Heodo
2022-01-14UTD-4118967.xlsmxlsm e96a3f5577ef1f2045def7dac6923247f9ea4baf84301b8425761d362301bd83Virustotal results 35.48% Heodo
2022-01-1455927-4630357.xlsmxlsm 77c84a4f67f70d068261158ddf09d5e98292a7d86397fb95dec8f0092a67d25fn/a Heodo
2022-01-14PIiRBr_647697.xlsmxlsm 127c23bfe45f05520e25aa2ee365653314949ad5bf52a5961e3b97b42ee942a4Virustotal results 31.75%Heodo
2022-01-14AEL102.xlsmxlsm cf560802eac9e437de73cb6219e12f9b7d2c6b5674bee80e2aabae463d9ea7e8n/a Heodo