URLhaus Database

You are currently viewing the URLhaus database entry for http://ftp.colibriconstruction.net/cc/sOY0Z/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2120604
URL: http://ftp.colibriconstruction.net/cc/sOY0Z/
URL Status:Offline
Host: ftp.colibriconstruction.net
Date added:2022-03-29 21:45:04 UTC
Last online:2022-04-03 01:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-29 21:46:07 UTC to abuse{at}lws[dot]fr)
Takedown time:4 days, 4 hours, 9 minutes Bad (down since 2022-04-03 01:56:05 UTC)
Tags:emotet link epoch4 heodo link redir-doc SilentBuilder xls

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31LSK-6243631.xlsmxlsm 73a1d60faa31200f09f2567671137d6b5f9be02a97eec33fc20971d151d5c8f1n/a Heodo
2022-03-31TM-22080813994.xlsmxlsm ab43f95f76dbd0bafc11d3af407297993a715790014ec2d550185c7eb75293abVirustotal results 37.70% Heodo
2022-03-31BHG-0085701.xlsmxlsm 36b9445ba8e049935f86955d9c9251334fa60c940b28d69da57f97926e54211fn/a Heodo
2022-03-31CIU-302812817344.xlsmxlsm 75f0362196443080531377973dbab9153eecc5ae78da6a2e94b492580d2bdf7an/a Heodo
2022-03-31QRA-519681200837421.xlsmxlsm fcefa2ebaa9e5cce06f5519640eab5413a9b9f6a53ed3fe2f3754c9a610418ban/a Heodo
2022-03-31YZJ-0149970861.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7Virustotal results 36.51% Heodo
2022-03-31MI-33688748.xlsmxlsm b0fa5dda99558a54917cc9a5f6269d440cd8b30ed825f72c837d6e4044d9f628Virustotal results 42.62% Heodo
2022-03-31WZQ-263080911043.xlsmxlsm 5fe0d5c74d36af2db670ba08c72837740a66a82a2e8f0b206468474195578366n/a Heodo
2022-03-31KBA-20646164.xlsmxlsm a099f9c9c8eff7049da288a1205f1c0ccd52a4954930cabdd7a00dafbe8bbe6dVirustotal results 38.10% Heodo
2022-03-31RQ-906134470000684.xlsmxlsm 96fac13010c22cdd9510ed06c70ed29257b59aa3fc3be17a9515bdcf3596aa51Virustotal results 41.94% Heodo
2022-03-31ONY-53776308.xlsmxlsm 30deb7a7086f74317285271a2e26e40dc43b461a1a77c77480ea742b02cbe51fVirustotal results 38.10% Heodo
2022-03-31RM-60562753510471.xlsmxlsm 4bf2a2327ebd2d1421b849168375d718ca7eedfca6a369b4d947836eba831db3Virustotal results 38.10% Heodo
2022-03-31TU-56024752003650.xlsmxlsm 6f7875f81192db87ffea6b495f10f68edb22a26f0cbc22b47cc1fbaf1b160cddn/a Heodo
2022-03-31PCU-1293113212284.xlsmxlsm 0c71f0ce426be3dfeacb36cfb08349362327fa6041d1669a1d2ef8b1110bfab3n/a Heodo
2022-03-31GL-0585333851.xlsmxlsm f7de6bde50d0cf428495505a733ecfb2346e0aae8544a4d87993a78a7417332eVirustotal results 40.00% Heodo
2022-03-30XZX-04355300604045.xlsmxlsm 2909468da77be7c90d3c57fa66be2e6250afde34bd400f2c815be9bfd89be7ddn/a Heodo
2022-03-30DUY-3560681253628.xlsmxlsm 60198b10fd3c8daeeb186be258cdf74b24c18a364638c8b6c6370e0bf4a005e5Virustotal results 33.87% Heodo
2022-03-30ZB-60971151393.xlsmxlsm 7b790cb9f037644da2aa7daf038bef787f020bc8aad1932fb1e8c4c5ab3b4766n/a Heodo
2022-03-30DE-33651157728.xlsxls 82be92d18fb73fad9b6f0e90da074abbf2aaffd91c4493491620452f19bd281dVirustotal results 26.67%SilentBuilder
2022-03-30KXA-4494450112.xlsxls dd89ded2be5b0a176d6a4d7e4d75f19fd83294a5b0a6da3fcaf12119bbf6f6f2n/a SilentBuilder
2022-03-29n/ahtml 4c6be713474446228acc60c2914d67e380657a0b2db5ca73c16ad3f0edaf44bdn/a