URLhaus Database

You are currently viewing the URLhaus database entry for http://demo11.qatgroup.co.za/wp-content/NQZ_46939/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:1987609
URL: http://demo11.qatgroup.co.za/wp-content/NQZ_46939/?i=1
URL Status:Offline
Host: demo11.qatgroup.co.za
Date added:2022-01-18 22:22:05 UTC
Last online:2022-01-30 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-01-26 12:40:29 UTC to abuse{at}linode[dot]com)
Takedown time:1 month, 2 days, 14 hours, 21 minutes Bad (down since 2022-02-20 12:44:58 UTC)
Tags:doc emotet link epoch5 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-01-19RASUO_7121027.xlsmxlsm d08eb16b9f222bfc43f34e7e0efddd2370f747627d6869c18403d9b4b2bf6480Virustotal results 25.00% Heodo
2022-01-194012-9645.xlsmxlsm c3f53e74cbc71cf1956d17dae939c2d9f31a1c2e81328a3ca88ceb1e3bf652c0n/a Heodo
2022-01-1931848MGKL_85525605.xlsmxlsm 892cb5000c5657175c29ea88c181fd1c0ebe8ebce03702df7b7340973c0f52b6n/a Heodo
2022-01-19QY_8352227.xlsmxlsm 88390a46879f6c9ff67152cbf22d1868e9edb89c0724e1e144a789c73f69b086n/a Heodo
2022-01-19VST_2051.xlsmxlsm e612d546205aa859563388f97efd28b24ac64d633c059f4dc746bff6729d1647Virustotal results 25.40% Heodo
2022-01-19203027398-68016377.xlsmxlsm 1cfe5e523eb76253a7b3270d91f99f4998ab8ad60ec974444451ef69632a0d29Virustotal results 29.03% Heodo
2022-01-1990430NMOI_7321.xlsmxlsm c8b489b858ea1f5536525a2b538ee8d955f10b8f43b86e4eb06894d5c48e885fVirustotal results 28.57% Heodo
2022-01-19837612480_28814.xlsmxlsm 6c3a841145e2fedd8c5a7748d925cf469f8a3bf9f2cf457c216c18c5be51afafVirustotal results 30.16% Heodo
2022-01-1904465NNWAJO-552.xlsmxlsm 39d40e8b39b2ded1846a5ac1aa2441a8bc1e11f4edf26d60f60d49862a3435bbn/a Heodo
2022-01-19400629-6002.xlsmxlsm 46bdf6ee62843383d15200ed9be277d08a6181063bb788c617472cc5e6142fe9n/a Heodo
2022-01-1920127910602.xlsmxlsm 17fec23004233b510f24a66fbfbff83304bf565e4138fa85b44c7b80d9dfcbafVirustotal results 26.98% Heodo
2022-01-19K-45784.xlsmxlsm bc7476f9d9148b939127a2024a1b341cec82fb398bf06667bdd3da4b1acc8bd2n/a Heodo
2022-01-19ywz_65953891.xlsmxlsm 061f1cbf244c489c29d77924140bd6d380d4d09c0b1019aa2bd30751a08ed12dn/a Heodo
2022-01-1955078402RKICO_4740.xlsmxlsm d13c581258a7b7cea4c550025cf6e9a52d509d4759d34753a8386e339153ef11Virustotal results 25.40% Heodo
2022-01-1905595813_76031074.xlsmxlsm 0182d934cf978c326c068e12624db542cd902971a1c3516443ec11e2fecd069cVirustotal results 28.57% Heodo
2022-01-1918924_01.xlsmxlsm 515c9e3ac18310c9234c70c9b9b782b3b7cf48fe16da7547ca683acc944ad997n/a Heodo
2022-01-19860_52881205.xlsmxlsm e645688505083165509fd637e93c86cb2390f1a9a93a38a0cfaa1e1b88f24b68Virustotal results 20.63% Heodo
2022-01-1961_04629445.xlsmxlsm bf358073ed5741312e901e0fac9cc9af2c7d3f4b3b9f6d1f89f0c02fcaae63f8Virustotal results 22.22% Heodo
2022-01-19U_643.xlsmxlsm d6553545b1163cac98c8454f5751dfd16b73d1c9262916d86996b3fe3cfb632dn/a Heodo
2022-01-1941997QBBDP-990043.xlsmxlsm 96bc549312ea7fde7f0e9897ce14a8f4a7b0f970cce2bf36a9d1be5e2b7bfc3an/a Heodo
2022-01-19pisx95.xlsmxlsm b63e4863cf6daee93a61ffb74ae312b6345f3ea4bbbdff04155dd5cedb554cd7Virustotal results 22.22% Heodo
2022-01-19nb-3.xlsmxlsm 7fa31dadb117ef22bbce1462447468727b056cff0d6f874582c03d7db2243df0n/a Heodo
2022-01-19zwf_9044072.xlsmxlsm fef7017d59c99fb7ef55f867d66297ace1a66b98f61817b5f42b0b9c4e22a3e0n/a Heodo
2022-01-1929661-9901659.xlsmxlsm 17e58485ceea86f7c5a32f35a478b985b7a90573512c8cd051e090e4888e1f20Virustotal results 22.22% Heodo
2022-01-19AQe-68850157.xlsmxlsm 9460b2bb8ba2fb292c897532ce1f2671a383bed1194dd3aef7c2027fd427c09fVirustotal results 20.63% Heodo
2022-01-193582-94.xlsmxlsm bea5921badee43603291587c2cbed8fc2d82b15583a6d11fa66afc9bdf2b84e2Virustotal results 22.58% Heodo
2022-01-19H_496638.xlsmxlsm e3f5e0fe4b1a91a4511c3621a2d351a6132fe0bf448379a4953829cbc6579641Virustotal results 28.33% Heodo
2022-01-19LT_9647.xlsmxlsm 84529344649591a9fee25983b732a5171630e0eae26c5109f8916587672efafbn/a Heodo
2022-01-19KiE-2.xlsmxlsm 1f513a8a5f8abe29e8c9fda004daca2f4154840fce7c903e05372f0ef8a45903Virustotal results 22.22% Heodo
2022-01-1963258190_26.xlsmxlsm 3f25b33a654731325f43de1d4580715d04256dbc9a5edadae6cdecf84897d962n/a Heodo
2022-01-19waij17752.xlsmxlsm f2136dea41d8f87bda99e7a714825442517cef672c6081c69904bd3ca8b51455Virustotal results 18.18% Heodo
2022-01-19IVQ_357.xlsmxlsm 007b703040eca65bd22588faeaaf7316df014c55b1e2e4ff505468d1c9c7788cVirustotal results 22.22% Heodo
2022-01-19u_0.xlsmxlsm c048958b5e8cc5b2edc5393979348466863b4e67a0440bdce07f046fcaa33f6bVirustotal results 21.67% Heodo
2022-01-19727796-397.xlsmxlsm 237b2490c0e6d27ef3badff081fa7ba4b7e05a805a3664047eac211affbf612eVirustotal results 24.19% Heodo
2022-01-1901058-706.xlsmxlsm a520ea7a2ccefc4192333c4ecc52eda0fc0702a3a8d9e6de11d13a9f9fede9c9Virustotal results 25.40% Heodo
2022-01-19XT_172.xlsmxlsm 0d0b8301a65a0f3ee350a52c1771044e326d54e851e5cc43c47a8d3bce1200d9n/a Heodo
2022-01-19G_666329.xlsmxlsm 42b3f45dbdebb32d3b00bb80dc8e8f559d772005a06a6e08c256f25d088a6e46n/a Heodo
2022-01-19P_626.xlsmxlsm 7200e5724315590135f88283962627c70469223398ba6674b2bcfb070f0ebbd9Virustotal results 27.42% Heodo
2022-01-19ZFL_5.xlsmxlsm df2769638bd691851f529a5320a54d92d23f6d702c88d31a37ebbce68491a635Virustotal results 24.19% Heodo
2022-01-194809292TQKZU_880.xlsmxlsm f5577c81556fa38d796518163c5c798b23415437423aa249a0cc9c20a65f3349Virustotal results 22.22% Heodo
2022-01-1945486363.xlsmxlsm c13305fdd9e7e4ce379937deb578ce2e788370bc2b547e027db59c59b722efd4Virustotal results 21.67% Heodo
2022-01-195795-78.xlsmxlsm 1fa60639ea962861142d2efeb77fd77c280fb3442d31d2db07918d54e6b5336cVirustotal results 28.33% Heodo
2022-01-194402042HRS-5833.xlsmxlsm 79cfdb919315844deefdaa5f9ad364a026f3a795b473171647cd0176a4333f01n/a Heodo
2022-01-19WLQP08223.xlsmxlsm 7aee2fec8e183b1903208d7a478278b68708d2a38f321a493f0493a27d46322en/a Heodo
2022-01-19DI_8829.xlsmxlsm ceaa2e4a3e4521b680dbbb7645140a69929ac5ecb0d9342bd88ffe34e33bfcb6Virustotal results 25.81% Heodo
2022-01-18YVQCP_912360.xlsmxlsm c367a9422665976310f8899e0ae55a7415babdc88f2377d6bdc4e62aa373368eVirustotal results 19.35% Heodo
2022-01-18nehjiks-834337.xlsmxlsm 6001966534b597395906f4462e7dcc3068171124579b7265e5e7be7e05e5c427n/a Heodo
2022-01-185550355_3600.xlsmxlsm c903fb3b373c6c8d58084c907ac1629e16ed3f39d8407e4db2ed41c417f4131aVirustotal results 24.59% Heodo
2022-01-188736874ABTRIUZS-3654.xlsmxlsm 96cbfe690490f4cfdbfdf395626f5f393deb559f0c078aecfa9facc6fdac9d54Virustotal results 19.35% Heodo
2022-01-18QGG_710130.xlsmxlsm 42fce6fdb4460cd9ed23a7e05582c8344c254ca42bf5a384ec854274e372b0ddVirustotal results 16.39% Heodo
2022-01-1891185_552.xlsmxlsm f601b3c0045352c178e7dead3f2dc7077202e24e4621bfeb5436905417814a72Virustotal results 21.31% Heodo
2022-01-18HhwiFc_4741334.xlsmxlsm c96f85662e9b91ef48116048a2b379783a961a851b6281497f1e93de0721ad15n/a Heodo