URLhaus Database

You are currently viewing the URLhaus database entry for http://farschid.de/verkaufsberater_service/3CxMQ4uaxy/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:2119354
URL: http://farschid.de/verkaufsberater_service/3CxMQ4uaxy/
URL Status:flame Online (spreading malware for 3 years, 8 months, 13 days, 20 hours, 12 minutes)
Host: farschid.de
Date added:2022-03-29 13:52:08 UTC
Threat:Malware download Malware download
URLhaus blocklist:Blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 13:53:06 UTC to abuse{at}strato[dot]de)
Tags:emotet link epoch4 heodo link redir-doc

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31KK-72525471.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31CFM-40531909502150.xlsmxlsm 162637428037d1f8f3bd675b122e5b830107b9ea7352c8c765e97a3afbce1231Virustotal results 40.98% Heodo
2022-03-31JTV-53264208199.xlsmxlsm 64c57c337892c7579a7c6d302233570e6f2450b0d0152b3b32de811347079a2an/a Heodo
2022-03-31IPA-1120008279.xlsmxlsm 54bb2433c32ae91e6033d49276536fd303652e555e7d1cdf5e1aa0bf9f483d18Virustotal results 40.32% Heodo
2022-03-31YY-24214779151752.xlsmxlsm 9490224310276e55dea4f02cf1d9c3c81919929e8abc13c37b670025f1f7a3d0Virustotal results 38.10% Heodo
2022-03-31ISF-03299706.xlsmxlsm d4f941f7232c98be2d39a4a97edcad5b4648430bb60ad5a21747b37e705ff2d2n/a Heodo
2022-03-31LB-07580410013535.xlsmxlsm 00ea616ce33ef49268a2d6046f588bb73c80b7a90ae6e5e5067938d72e858564n/a Heodo
2022-03-31AP-1170262.xlsmxlsm 6ba49c8a1bc5dddfc74a33d1c6f53df15e682043f2e3e66963ef4577191206cdn/a Heodo
2022-03-31QI-9623329.xlsmxlsm 355981d4c8400968deaa8a13a04a79c90bf9aab795af2ff1b3273b825a477968n/a Heodo
2022-03-30VJ-72058415939703.xlsmxlsm 0f0f7b2909d785721bac9e084861e0e82096d63f5a895e6b4cd3c02b490dbc9an/a Heodo
2022-03-30WEP-926045635.xlsmxlsm 08e64e582d9d42f5f3a21eaff52bcb72b4a3abfc761561ff28f40bf937dedb2cVirustotal results 35.48% Heodo
2022-03-30OX-266520351525.xlsmxlsm a635724502ddf792c6bc78f232c678f559b02ac1baa5cb61f924b6d2d7aeccd0Virustotal results 39.66% Heodo
2022-03-30RF-61322275.xlsmxlsm 168a9aa1b5fa37a354fd6ccba71dcd29cbcd503a578504c69feb38bd84a8a691n/a Heodo
2022-03-29n/ahtml 11b6564024c108edb36318f46e93518e81e3f9f9fcf17f30e7a4f61ef4b2a534n/a