URLhaus Database

You are currently viewing the URLhaus database entry for http://ecesaray.com.tr/marina2013/XNY/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2120243
URL: http://ecesaray.com.tr/marina2013/XNY/?i=1
URL Status:Offline
Host: ecesaray.com.tr
Date added:2022-03-29 18:36:05 UTC
Last online:2022-04-01 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 18:37:05 UTC to abuse{at}hetzner[dot]com)
Takedown time:2 days, 19 hours, 1 minutes Poor (down since 2022-04-01 13:38:27 UTC)
Tags:doc emotet link epoch4 heodo link SilentBuilder

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31HQ-200042353.xlsmxlsm 0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3dVirustotal results 40.00% Heodo
2022-03-31TCR-077807086.xlsmxlsm c171d718d9aecb5ad1e27309660f8da7a568f9798e03d4c6683d7825b5a122c9n/a Heodo
2022-03-31EO-2678134.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31IQJ-748940276.xlsmxlsm 97f11e4cd509aefb731d8b1a4b299c8ab4096e270f05f52d8e0eb6d2366fa501Virustotal results 38.71% Heodo
2022-03-31HJ-87363445885959.xlsmxlsm 5fe0d5c74d36af2db670ba08c72837740a66a82a2e8f0b206468474195578366n/a Heodo
2022-03-31KIM-9601140496.xlsmxlsm 4e313f9f3abefe7d2a05b2d9ce9dae1683f91278ec0ac7cff68b9f232ff656dcn/a Heodo
2022-03-31IYF-8326582.xlsmxlsm 96fac13010c22cdd9510ed06c70ed29257b59aa3fc3be17a9515bdcf3596aa51Virustotal results 41.94% Heodo
2022-03-31KFB-05634765.xlsmxlsm 484ac30b71e02b553efb54dd38ddc6e86610a68995e280411a4b9f30c8630c77n/a Heodo
2022-03-31ZK-872521724336.xlsmxlsm a43da1637de01a06d72a9d09981de5132b8bd971844704ee9fc7c5e07450a49dn/a Heodo
2022-03-31RK-9310927857.xlsmxlsm 52939ecf287fe6bf3435960c423bf17f7ea8452f102024e9aca86cf806fdd533n/a Heodo
2022-03-31QT-47704100598458.xlsmxlsm 0c71f0ce426be3dfeacb36cfb08349362327fa6041d1669a1d2ef8b1110bfab3n/a Heodo
2022-03-31SIY-356156087.xlsmxlsm f93f882fe4bac2b1210512c64a2985c99282b49a95a2aaa3bfcf6865d6dd0056Virustotal results 39.68% Heodo
2022-03-30RS-2048036891.xlsmxlsm 41f790fa1e0f18e897bdad1de2c9452310c964ab0c50e831d9c1150af849edf4Virustotal results 40.98% Heodo
2022-03-30ZHX-191277705777.xlsmxlsm 687a158c15f9b76ec9b11906e548b587dcd7cd319e90477c89b1341f5d6b1eben/a Heodo
2022-03-30FC-4328437.xlsmxlsm b8a9c6cb2992b99ed3cc0c82c5cc63dc9a4a3c509e8c67399d2d7c864ed83c03Virustotal results 38.33% Heodo
2022-03-30EA-75448029.xlsxls 2fb5d6b4684b1f180fd682f92fc346420c16376d64b8b8ec6b0564247000dc58Virustotal results 28.33% SilentBuilder
2022-03-30PQX-467224588914942.xlsxls d743d15057637cf8074f2c125e85dec324808dae8860051c978dcda48f641d86Virustotal results 28.81% Heodo
2022-03-301893544642188021.xlsxls 0d2f6209d514a862d07974e11e6722888d1e7d63c2dfdb6777f734929b6e5aaan/aSilentBuilder
2022-03-30197051782713632121.xlsxls d50ff37a85433702c1107c3f20efde94efa785c44886033b550035b23d873ac1Virustotal results 27.12%Heodo
2022-03-301169628315289.xlsxls fa9ff98be2b2014f3459f9e24865c2c062491b891fcf51b2a6b03e208256305cn/a SilentBuilder
2022-03-30335218774075452.xlsxls 517ad9640522ddd6180f39e1bdf5dff22b469b04cba6c10f4c0d6e3bcca16b19n/a SilentBuilder
2022-03-30262858143526415435.xlsxls e791d11f92f1919ec337188687638f31e0cdce5b86b87f060a045a9ffa6151a7n/a SilentBuilder
2022-03-302026302606965.xlsxls d98dd9a82151e75194671730ccd38081a04c9a54e596394dd332c12c8723439bVirustotal results 25.00% SilentBuilder
2022-03-3057583489813779714.xlsxls 0ca97e0da60bdc40cac1f0c63b6916e0976650209ca917398fa40999f7783073Virustotal results 25.00% SilentBuilder
2022-03-307975495246.xlsxls 0766c23e0c75ee303178ccb8d46e52a64e19f1c02ceeeed99b63f4d35cc4e676n/a Heodo
2022-03-30531168625448604.xlsxls 28c1994bc596421a111c75b795d98b2192edc5aa92b6d1e3adcefd40bd9d0bdfn/a SilentBuilder
2022-03-3092839234996198116.xlsxls 4c11e21253fecf68a6116f5381452e801b0edf62fceac13394d7366685545a9an/a SilentBuilder
2022-03-3008974581321.xlsxls f3fc7ccb474552d967ee4ba98072eb7ddb90807e5384e8e7ea92b121d10d78d3n/a SilentBuilder
2022-03-30974955780848.xlsxls 81a256099f04dbf352f0038e62c20eb749e9385d45dda82285e99faacd290eb5n/a SilentBuilder
2022-03-301443056686188.xlsxls 61e3f721676cf4ce1d2563a76278f249f505e136c2a97ed5d0a784fd40b08121n/a Heodo
2022-03-3053086125950.xlsxls 2ed370e7b10a0832ccc6c51912b84345f0b6b1a0d19f212a86886497ec9bee8fn/a SilentBuilder
2022-03-3015978076113979169143.xlsxls 4148c2fcfeafb479b13ec8c2b305fd2ebf671b61fe044476575a5b2be2b929dbn/a SilentBuilder
2022-03-304994325797915.xlsxls 17ecc742902925465369b5dc8bb6c8c87d9e16a1cdde0c38c3b4264f73029cd6n/a SilentBuilder
2022-03-3043833288814794.xlsxls 99f00e2a4ed7ffc848c6d17b428903f2234a4279a94026429569afa46cbf1f52n/a SilentBuilder
2022-03-308188731224056050.xlsxls 0064a9e50d81734b02d6e46a0c7438caaac87d97c3a8d2e252d116c08094820bn/a SilentBuilder
2022-03-3071858820721.xlsxls fa291395f719a90cebdce4e7d311f4fb35c20358ff5b78b90db5691798067e1bn/a SilentBuilder
2022-03-30771619245528343285.xlsxls fd2ecf04bb4da7241599359cdb7b7f3a79197b33968f784ea57336faf2c84ba9n/a SilentBuilder
2022-03-3072333938249119594399.xlsxls 348ea5bf5a7fc74fd10faeed8acc605067557cc10f827fb9f2fb83bea4b12bcbn/a SilentBuilder
2022-03-30904875281901.xlsxls 00dc943ad8b806227c7e348971e538f6d3aa287ec1fcd2e645d272d3e0fea436n/a SilentBuilder
2022-03-300286799191139330.xlsxls 9e567a344081987a4426f78ec523045fd89cefc8790ccd11bc7c7e84a0816144n/a SilentBuilder
2022-03-306714656942.xlsxls 18a5aadfb1ade6b05280001f26d457382545510248408bbf0ba6d73aecd59e1en/a SilentBuilder
2022-03-30301349235456164.xlsxls b8d670ca1984f7ecc9e90c4bc0c4c4d96172690aead7080171735f96c11ba21fn/a SilentBuilder
2022-03-294930233603.xlsxls 6e65b8204a30f479fe9a429c8c2e206091dab33182544365f9567a23b12ec75fVirustotal results 23.33%Heodo
2022-03-2929956455296.xlsxls cf32dd8b34af56ba98e8e60de33e463349578b7c5f034c6b5394c1de65d8b3bbn/a SilentBuilder
2022-03-2905560964065391314986.xlsxls d2c2f994b521bda48acab4fdb007d4fd5b14e1d30efd50a47348c9021992ff50n/a Heodo
2022-03-2901992218512.xlsxls a679c80a799b163cf0ad3f464c4a1bc023c7d6dd0715662da376d6260a4b9040Virustotal results 24.56% Heodo
2022-03-295812548899443766.xlsxls 67a20d8315c3e1cb24416ae035906dcd81592e4320a2168428e11db1afeee329n/a SilentBuilder
2022-03-29470362616290.xlsxls f65a94d6277859d9a378a87196fb29020f43daa4f319b0e64d292a3d15fc8b9an/a SilentBuilder
2022-03-2968531625696083832.xlsxls 54d08522ffbd96a675e5aea3d3658b9aeafed3508940f376269fdebe9a930237Virustotal results 23.33%SilentBuilder
2022-03-2907712031461275684730.xlsxls 4f738b9fadb36139d240c69921c4e98e6f8250dda07c65e281749fddc3ccd6d7n/a SilentBuilder