URLhaus Database

You are currently viewing the URLhaus database entry for https://nokri4all.com/lua/ilqteauma which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:2320734
URL: https://nokri4all.com/lua/ilqteauma
URL Status:Offline
Host: nokri4all.com
Date added:2022-09-28 18:07:56 UTC
Last online:2022-10-08 01:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2022-09-28 18:08:10 UTC to abuse{at}namecheaphosting[dot]com)
Takedown time:9 days, 7 hours, 7 minutes Bad (down since 2022-10-08 01:15:49 UTC)
Tags:bb H322 H436 Qakbot link qbot link Quakbot link TR U425 zip

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2022-10-06R951397381.zipzip 247ac3bc66ac88397991d31629cf9480bdd37cbecdb64b38aff2d10ce28d294bVirustotal results 19.70% Quakbot
2022-10-01Quidemadipisci458594058.zipzip 128d7657f67a8b2142f1d9523c740d4fc3084014eae12a11229dd4e039088121n/a 
2022-09-30G2393736175.zipzip e488f1dea1df15bb03c05fe491015775098cd813db6d614bd55424286d71ed8cVirustotal results 3.17% 
2022-09-29G3350885943.zipzip 7c5a487baa2e76b388f64532fb2feca6944ce6668eb31b93d356205c7ee4706aVirustotal results 3.28% 
2022-09-29Gall4169276403.zipzip 9c882a97fc9447cbdf46e5ddc535adca2bde7b2bcecd139917361d900c409dc1Virustotal results 1.59% 
2022-09-28zgRAqRq.zipunknown 8a3bf8ac87aed4bd746fd1e94b81b74e5a106c7b5ea4f96ee998050631723db4n/a 
2022-09-28ofIsjHNQKU.zipunknown c732399b2b009b1ceb904f9fd43ac449b3b318cb2a3be05ecfb1af2429270676n/a