URLhaus Database

You are currently viewing the URLhaus database entry for http://ecesaray.com.tr/marina2013/XNY/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2120244
URL: http://ecesaray.com.tr/marina2013/XNY/
URL Status:Offline
Host: ecesaray.com.tr
Date added:2022-03-29 18:36:05 UTC
Last online:2022-04-01 14:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 18:37:05 UTC to abuse{at}hetzner[dot]com)
Takedown time:2 days, 19 hours, 36 minutes Poor (down since 2022-04-01 14:13:48 UTC)
Tags:emotet link epoch4 heodo link redir-doc xls

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31HQ-200042353.xlsmxlsm 0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3dVirustotal results 40.00% Heodo
2022-03-31HI-4756346775.xlsmxlsm 48f3f48c930933448b555efe67aa364e098504f2273ec2a4792803cb4a21b8bdVirustotal results 40.98% Heodo
2022-03-31TMJ-34999628.xlsmxlsm fcefa2ebaa9e5cce06f5519640eab5413a9b9f6a53ed3fe2f3754c9a610418ban/a Heodo
2022-03-31HQ-6172044569177.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31UZL-2407357345587.xlsmxlsm bc2b30e9969aa7dc11544b73955d47d12ec3d2febe998b5cef4b57c89dde7215n/a Heodo
2022-03-31XK-28324135671.xlsmxlsm 566c3447fd5a1b7f7f0c942d484a0185bcd747d47f9c487452dcbfed1979bd52Virustotal results 33.33% Heodo
2022-03-31NBV-92849790208.xlsmxlsm 578e2f6c9e64cb4de6991bae88f0e1e8d38afce9fb954c64d9ed303053647d94n/a Heodo
2022-03-31UX-82011807891.xlsmxlsm 8ffdaa8f731fe2148ad8c7dd79ce44c3dc17eadb46af64c64a76395fd0e629acVirustotal results 40.00% Heodo
2022-03-31OC-5285566045618.xlsmxlsm f1a59459dc11d8edab701cdd7610dd6310993ddb1aa04ab43f8fc3536040700dn/a Heodo
2022-03-31RK-9310927857.xlsmxlsm 52939ecf287fe6bf3435960c423bf17f7ea8452f102024e9aca86cf806fdd533n/a Heodo
2022-03-31QT-47704100598458.xlsmxlsm 0c71f0ce426be3dfeacb36cfb08349362327fa6041d1669a1d2ef8b1110bfab3n/a Heodo
2022-03-31SIY-356156087.xlsmxlsm f93f882fe4bac2b1210512c64a2985c99282b49a95a2aaa3bfcf6865d6dd0056n/a Heodo
2022-03-30MR-4313674720993.xlsmxlsm b4f7a7bd6f99c0ea09617160e6bf753419f6d731901828662049ac8abfed4959Virustotal results 36.51% Heodo
2022-03-30ZM-23588802.xlsmxlsm 39bbb570609ea300f9d959dcf23f2161043c6dedc230f97e7eab2388db651831Virustotal results 37.10% Heodo
2022-03-30QCH-5914405.xlsmxlsm 7b790cb9f037644da2aa7daf038bef787f020bc8aad1932fb1e8c4c5ab3b4766Virustotal results 32.26% Heodo
2022-03-30BTJ-428141766.xlsxls 403c28ce1df56f185d0824575299bea20d7d1738e6a9688c551d039b6d1aaea2Virustotal results 28.33% Heodo
2022-03-30PQX-467224588914942.xlsxls d743d15057637cf8074f2c125e85dec324808dae8860051c978dcda48f641d86Virustotal results 28.81% Heodo
2022-03-29n/ahtml 01765d45fdb947776738cfa373f241076ff5e1c519075e0cbd0d106354bd3e0bn/a