URLhaus Database

You are currently viewing the URLhaus database entry for https://grupo-cala.com/th/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:2650144
URL: https://grupo-cala.com/th/
URL Status:Offline
Host: grupo-cala.com
Date added:2023-06-02 11:43:28 UTC
Last online:2023-06-05 00:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?):mail Yes (Ticket DCU100126978 created on 2023-06-02 11:44:14 UTC)
Takedown time:2 days, 12 hours, 29 minutes Poor (down since 2023-06-05 00:14:11 UTC)
Tags:BB30 geofenced js Qakbot link Quakbot link TR USA zip

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2023-06-04document_D493_Jun_2.zipzip 109631fd1f7004ed44b8a87991c7310739721dbdc3060935d74c8b7f094b72cfVirustotal results 24.19% 
2023-06-04document_C934_Jun_2.zipzip 390dffe8ba880ffd0005df82b6c51f34a1d1e71fb6705a26afc23ff900f19208n/a 
2023-06-03document_D094_Jun_2.zipzip caf0c62e1ba82e842acc32a5c4e27349859fa499fc9a1b13ac5bfd72b21d1a2eVirustotal results 20.00% 
2023-06-03document_F524_Jun_2.zipzip 352ac4cc6a22b87d25c56b6a9172be52c3801f4f047421fc47393274282fbf94Virustotal results 24.19% 
2023-06-02document_E821_Jun_2.zipzip 613e4084d16657ce19b452296f3b9d58a0b7baf42a7a1940687f832186158482n/a Quakbot
2023-06-02document_E029_Jun_2.zipzip 7e8795333a98930daa52f43dea031ab4b24bddca2df9516fad4f44940edca32fn/a Quakbot