URLhaus Database

You are currently viewing the URLhaus database entry for https://ramyfaresgroup.com/be/?057552 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:2635945
URL: https://ramyfaresgroup.com/be/?057552
URL Status:Offline
Host: ramyfaresgroup.com
Date added:2023-05-17 13:33:06 UTC
Last online:2023-05-19 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: fabjer
Abuse complaint sent (?): Yes (2023-05-17 13:34:14 UTC to abuse{at}godaddy[dot]com)
Takedown time:2 days, 7 hours, 41 minutes Poor (down since 2023-05-19 21:16:13 UTC)
Tags:qbot link Quakbot link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2023-05-19Pxtilh.jsjs 51ffefa8a10b6da720a80cec4735fe173669e7c974946e46c8dda908e824d8a4Virustotal results 22.03%
2023-05-19Spbjqd.jsjs bbcdb87a842c5157acea98f0cedd358f764e2613b6a635e4f9f5946de8c07780Virustotal results 13.56% 
2023-05-19Fcplnfu.jsjs c74cf0cb7927a8438a84c9cedbdbab3e4815550813336043f39674a67b6a021aVirustotal results 28.07% 
2023-05-19Xmqn.jsjs d76b1300fd995ec8def343df0450c11a58a217803fee3749db4afacebc64182eVirustotal results 22.03% 
2023-05-19Nqwceh.jsjs d7522ab4f64ae0950e24bb00df9157136bbcb900ace0c77bd1a46f06149bf37aVirustotal results 23.73% 
2023-05-18Lztqal.jsjs 76443e093ed6d6e3961cb5f9bbd546bab2d05f6bc2536c5744dc86f7a769bea8Virustotal results 30.51% 
2023-05-18Ppbie.jsjs 1a2e818afb29521c8658d2a0643158af97370d69c32c0bd85cb900bd3e85b0eeVirustotal results 22.03% 
2023-05-18Sllah.jsjs 1cea0c4b1af9170b9ed2927f3b100d202bebd1b8e69ba1527336aaa6b2c0bffcVirustotal results 13.56%
2023-05-18Kynuuiiu.jsjs a1353f7898cc49901d6c5dc01063b60be173f0ab2378d18348e3b766cd3a9913Virustotal results 25.42% Quakbot
2023-05-18Mtvqvy.jsjs 64b83f23408d2a7227fa4c862e4bafcc65ec650c57113690f264fd64d4b9bfceVirustotal results 27.12% Quakbot
2023-05-18Xzdg.jsjs f9a03e213a2bf36d23d4a6877af8261834b3049ed458410c5e8b4c6da00e2383Virustotal results 27.12% Quakbot
2023-05-18Rbiabu.jsjs 38994d258f8bfb97fcb4ad671d962c6f000efb90f29ef01a8ca9881d7a206c66Virustotal results 27.12% Quakbot
2023-05-18Udnwlgv.jsjs 8b5a063138d39c424fbf7ce7022dc972afa3c2df792b3a030272c1c77490dc96n/a Quakbot
2023-05-18Kzdaqafy.jsjs a569ce1eb1902d2edf7cffba78e832e764170e48ecfe81ac3adda07c5f42455eVirustotal results 30.51% Quakbot
2023-05-18Mtgyn.jsjs dc2082d0e27eabe3ed96fdbecac723d76fcbb6897709edc0b6e8a7a9a9ef177en/a 
2023-05-17Flfoftc.jsjs ba0c34e538207bb899f624292efada218b4202e276606cdaed6e258bd29572b4Virustotal results 25.42% Quakbot
2023-05-17Zhfgga.jsjs 934626b333d14ccf5c2f3a3effc073bba69fea3effa6d474f19bc48281dc9013Virustotal results 27.12% Quakbot
2023-05-17Ypodt.jsjs 98ca0fd1f80c8b41e2782376e1e44d8dbd142e3c6e7f91e3459aed684bf210a2Virustotal results 25.86% Quakbot
2023-05-17Ohdocox.jsjs 67c42e2dba1a888a502921f8497455eea4965e6a313718853b1782317b27c950n/a Quakbot
2023-05-17Qtrutmd.jsjs 426babf013bd614f1197dea8df2fac24ddfb79398b8310b46631885ec666eb54n/a Quakbot
2023-05-17Xgao.jsjs c7164e6f2a5f4d34a5877e5de94ba49af13d9b6e10be7158adc9e0d267084c28n/a Quakbot
2023-05-17Eudhgxp.jsjs cb6a65f1e6220e908455c9dfaf1b69114b9b0c5666dc2b80f597d2c1e4ab29c7n/a Quakbot