URLhaus Database

You are currently viewing the URLhaus database entry for https://sumeetgroup.com/qroa/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:2629203
URL: https://sumeetgroup.com/qroa/
URL Status:Offline
Host: sumeetgroup.com
Date added:2023-05-10 17:15:18 UTC
Last online:2023-05-13 05:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?):mail Yes (Ticket DCU100113448 created on 2023-05-10 17:16:17 UTC)
Takedown time:2 days, 12 hours, 20 minutes Poor (down since 2023-05-13 05:36:25 UTC)
Tags:BB27 geofenced js Qakbot link qbot link Quakbot link TR USA

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2023-05-12Armeeig.jsjs eed0f142d88ee26d163aa8825911d020132ac209d289d28308753c4440af16f0n/a Quakbot
2023-05-12Ugahcoid.jsjs d29a15a39bada1cb6681bd1238d3f7dd92ba3d1b1095a9a663e0a6e3932a5ef7n/a Quakbot
2023-05-11Enlb.jsjs 4afc71bbb6004f65a2d338ed1b55629b0050f847c8c0ca08785b208beed677f5n/a Quakbot
2023-05-11Aiebzhhp.jsjs c6ebcc649b39fdee19793adff25bd8183417357a2409f5932922470e63929bfen/a Quakbot
2023-05-10Utdr.jsjs f7b7e6665dfe176f1ed54ea74c1cce38e41ae5f57a6301cd41c86618866a10a7n/a Quakbot
2023-05-10Nkuespb.jsjs 6b612e6ac8d1bc3603df1ba059bdafa951e6bdd3f970d9e7d41c0c28c7c5e2d3n/a Quakbot