URLhaus Database

You are currently viewing the URLhaus database entry for http://fireandsafety.ie/flash/wiOEMwk9B3z4eYwbUjN7PcQz2nLOw/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2119362
URL: http://fireandsafety.ie/flash/wiOEMwk9B3z4eYwbUjN7PcQz2nLOw/
URL Status:Offline
Host: fireandsafety.ie
Date added:2022-03-29 14:03:04 UTC
Last online:2023-01-21 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 14:04:06 UTC to abuse{at}digiweb[dot]ie)
Takedown time:9 months, 28 days, 2 hours, 23 minutes Bad (down since 2023-01-21 16:27:51 UTC)
Tags:emotet link epoch4 heodo link redir-doc SilentBuilder xls

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31RV-11058778911.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31SI-375899535687.xlsmxlsm 5fe0d5c74d36af2db670ba08c72837740a66a82a2e8f0b206468474195578366n/a Heodo
2022-03-31ZL-1279972523587.xlsmxlsm 08e64e582d9d42f5f3a21eaff52bcb72b4a3abfc761561ff28f40bf937dedb2cVirustotal results 38.10% Heodo
2022-03-31HZ-76337277124213.xlsmxlsm 54bb2433c32ae91e6033d49276536fd303652e555e7d1cdf5e1aa0bf9f483d18Virustotal results 40.32% Heodo
2022-03-31TTN-844245480459521.xlsmxlsm 23dd125c7c3f736b183b9ba66bdd5ee5565f575fbb6c8c593f78f6da0b84e621n/a Heodo
2022-03-31WW-6948265750.xlsmxlsm f869263419a75a1350a78400b9e3dd186488c7c76d299e7984af7e5e0c91d75dVirustotal results 37.10% Heodo
2022-03-31LGZ-1851362225.xlsmxlsm 764d8e72174b0666952016caf95096e85219dba6554a8ce6db74b8244b3e7590n/a Heodo
2022-03-31AN-85099051.xlsmxlsm 638588dd97949a25ee7322aa73731204406054bf2db2043063ebfdc82d353f65n/a Heodo
2022-03-31ZK-2003632.xlsmxlsm b39f9cd3e4484248881234e5082ad33b07297d4e911d64ae4ab2409a3b68f7fen/a Heodo
2022-03-30BN-1296872595.xlsmxlsm 8eb161bd22ea52d987b19953ebebe364df8a0779ed9f42ad96c6dec32f8cce52n/a Heodo
2022-03-30TN-689662673219.xlsmxlsm 42c504a0fee5cb3e3033b4f6d596ce78f3f3c1118dc4cdfddf0b54715c66117cVirustotal results 32.79% Heodo
2022-03-30CK-3921087573.xlsxls 88eb7648bf7a3c5eb3fbb953cd7b5df5165ffd0cd0249928a6e314f8958ebaf4n/a SilentBuilder
2022-03-29n/ahtml 945928eeacd078b5ba017364e56d596278221cdb3fd35e7a3045e016f88a2b27n/a