URLhaus Database

You are currently viewing the URLhaus database entry for http://gla.ge/old/enG/?i=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2122980
URL: http://gla.ge/old/enG/?i=1
URL Status:Offline
Host: gla.ge
Date added:2022-03-30 17:55:06 UTC
Last online:2023-01-21 10:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-03-30 17:56:05 UTC to abuse{at}proservice[dot]ge)
Takedown time:9 months, 26 days, 16 hours, 34 minutes Bad (down since 2023-01-21 10:30:18 UTC)
Tags:doc emotet link epoch4 heodo link SilentBuilder

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-03-31KZ-19441720124026.xlsmxlsm 0e92cfd04405b8b597562761080285f19807c04c48c7278fe7632271ded41c3dVirustotal results 40.00% Heodo
2022-03-31APK-9770732166245.xlsmxlsm 09505f38dc69865b951b157cf9900abb04934cf9ca62028700bda6099ac98c9an/a Heodo
2022-03-31HY-268056186252.xlsmxlsm 894658b992050ab6d7ee061f083a48264ce56c1b4fbc5ac87c142765405a47f7n/a Heodo
2022-03-31PN-1804292851.xlsmxlsm fea58fae76c86e5f07c7f8b032f84174206bc489d92c49fe54a5b51d2658faf8Virustotal results 34.92% Heodo
2022-03-31TD-37938727224.xlsmxlsm 62ab476e343b12678cf4018d6d930dd8a13ca58be794dcc0cd82e693a7ed2962Virustotal results 36.51% Heodo
2022-03-31PKN-72814843725.xlsmxlsm 9098c46a233798193c0587711f5a9be2a4aa97567db08504452748dde516053an/a Heodo
2022-03-31DG-53552588.xlsmxlsm 8ffdaa8f731fe2148ad8c7dd79ce44c3dc17eadb46af64c64a76395fd0e629acVirustotal results 40.00% Heodo
2022-03-31EVN-190852554368.xlsmxlsm a43da1637de01a06d72a9d09981de5132b8bd971844704ee9fc7c5e07450a49dVirustotal results 36.51% Heodo
2022-03-31RD-66016524208596.xlsmxlsm c91108a630fb89be6e53e693ea5240bc7be18d74be099b965d92647bd239c6bfn/a Heodo
2022-03-31NM-226539578361551.xlsmxlsm ecfb46439586ddfd60ed5763f7b103d7487e94bf095208d8967dd838c5a68c27n/a Heodo
2022-03-30LHA-21133865807421.xlsmxlsm f6d9028f6903f57570a969a97a510120fa11d93ce778cfeac61862c36d6b6bd2Virustotal results 38.98% Heodo
2022-03-30NUL-3801097980598.xlsmxlsm 51be5ff843565b3e8fe56f303452e018d305cc846181d2d79d435509b2dc578cVirustotal results 35.00% Heodo
2022-03-30DRV-3250831093448.xlsmxlsm 96fac13010c22cdd9510ed06c70ed29257b59aa3fc3be17a9515bdcf3596aa51n/a Heodo
2022-03-30WJ-276339758836.xlsxls 82be92d18fb73fad9b6f0e90da074abbf2aaffd91c4493491620452f19bd281dVirustotal results 26.67%SilentBuilder
2022-03-304008840152206.xlsxls 3493b3210a3ce325a05cc7da5ffc69d323e0a0a645d8bdfaf1016a2de52ee1b5Virustotal results 26.67% SilentBuilder
2022-03-308480700725798.xlsxls e6816092d6eb5bec7ab8d5463c45994379e212925e29994c9a28a826b9f0ee92Virustotal results 26.67% SilentBuilder
2022-03-3078289001225.xlsxls dca8eaa3af3959b306af25eed2fa0edff0e0afc2eff8303e02086f3c9e2d24aan/aSilentBuilder
2022-03-3080835326452662446687.xlsxls 50170893cb064a5653f663f14de07cdaa05f1dfaba665721d31fe98d70db6366n/a Heodo