URLhaus Database

You are currently viewing the URLhaus database entry for https://armeriaeantiquariato.it/pr/pr.php which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:2605869
URL: https://armeriaeantiquariato.it/pr/pr.php
URL Status:Offline
Host: armeriaeantiquariato.it
Date added:2023-04-11 13:47:20 UTC
Last online:2023-04-14 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2023-04-11 13:48:47 UTC to abuse{at}serverplan[dot]com)
Takedown time:2 days, 12 hours, 25 minutes Poor (down since 2023-04-14 02:14:34 UTC)
Tags:BB23 geofenced Qakbot link qbot link Quakbot link R89 TR USA wsf zip

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2023-04-13Wjds.zipzip 183d16985d7a81aa3fff3cfbff0ab51d8ca2e351519bcbd518713b993d00090bn/a 
2023-04-13Gxbp.zipzip fa92c50f5aaf75410bbc65259d640d1dd5826364fb8049a3d0959d159d4fa94dn/a Quakbot
2023-04-12Own.zipzip 2a14a7a1135d6e8592eb854823fd89868212ea630371ce25658914497478c31bn/a 
2023-04-12Grrt.zipzip 1e1beb484d43e0fb641e40f17c8267f8ae09bff8dd553b3c8a1313fe49849e21n/a Quakbot
2023-04-11Nxje.zipzip d88747dcc722f881ce0fe6aa4d8974fef272fc76a403ff73ad1cc4364510f2b2Virustotal results 0.00% 
2023-04-11Clfz.zipzip 97abc8b60f7942c601b4319f3ad67732036aa4264539104e9852df1e7809acfbn/a