URLhaus Database

You are currently viewing the URLhaus database entry for http://rcmgdev44.xyz/cgi-bin/rossN32/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below has been used by bad actors to spread malware in the past, the malicious content has obviously been removed around 2022-12-20. Hence the the URL / website should no longer represent a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists anymore.

ID:	290702
URL:	http://rcmgdev44.xyz/cgi-bin/rossN32/
URL Status:	Offline
Host:	rcmgdev44.xyz
Date added:	2020-01-17 06:58:43 UTC
Last online:	2020-01-19 22:XX:XX UTC
Threat:	Malware download
URLhaus blocklist:	Not blocked
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Blocked
Cloudflare :	Blocked
dns0.eu :	Status unknown
ProtonDNS :	Status unknown
OpenBLD :	Blocked
DNS4EU :	Blocked
Reporter:	Cryptolaemus1
Abuse complaint sent (?):	Yes (2020-01-17 07:00:03 UTC to abuse{at}digitalpacific[dot]com[dot]au)
Takedown time:	2 days, 15 hours, 33 minutes (down since 2020-01-19 22:33:25 UTC)
Tags:	emotet epoch1 exe heodo

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2020-01-18	g6BRXIAHGQWI85kQ.exe	exe	ab5dc331127be64fb5120501c03de22a819a9ad88d8e17a8cc04e709900e4f6e	26.47%	Heodo
2020-01-18	uosMkfn5WhaQW8VI.exe	exe	dcb01fdf8ba270d3dd024fd60a28b21f0dba6ba8624dba1207e867a13085de7e	n/a	Heodo
2020-01-18	r5U96yJllc.exe	exe	e305d29476a1431019e8f7b2d960c06cac5075c903de497c78a27f83d6492ec8	15.28%	Heodo
2020-01-18	OjJLcX1c8IJbbXhDQi.exe	exe	7bf06e09cb28c2e0adef99dc5de4a4d013f88bba7ac5123ed6e9eeac9654b3d6	12.68%	Heodo
2020-01-18	DK5.exe	exe	fa8fb602ba4f5215a45d3d4aba985136d7f6cf1685fd8b23c5edc9f1b7f4d33f	n/a	Heodo
2020-01-18	dskl2xZC5PYGNGhey.exe	exe	0fcaed857557244561f11984d7771874aebacc8f84f4e0280fd3c918d6c68d1b	5.56%	Heodo
2020-01-18	Jq3jdqAuhEhM98SZtCej.exe	exe	8a005cf6c3fe4f9cb08eea708c619dcc9c5c8ca0df93e5961b0766c2e6733f1d	6.15%	Heodo
2020-01-18	YsSd2cgfS02gACLmk8.exe	exe	10274ec59899011e808ab76acba60b1e3caeb34a7007da3d7257e74908a92a10	13.89%	Heodo
2020-01-18	HMSvih7NwPM0VMN8jH.exe	exe	e685c407341b3175562635b2e2f468d8a7d53e461cc975919006a3776f709d30	9.72%	Heodo
2020-01-17	aXa81rwxAE.exe	exe	0c6a5cfd8f4fedddbe98130c44c7066f8d5408be546c3e9e65c32bfa96768c12	n/a	Heodo
2020-01-17	bkGQFB70g5XsNK.exe	exe	db2bee558e44f6b3779eaeed1f8b6cb320d6bbcdf062a3bd4d745a24148291a3	n/a	Heodo
2020-01-17	jaF0t1cFJCVi4fl.exe	exe	a0a2adb4aa63df59ec491842965efa9301e8fb301d2ea58ada83067719148c38	12.50%	Heodo
2020-01-17	jgLtvnJPtYOR.exe	exe	5057702a905c8d2827b557d15963b3e32bcab7e10e31dcb5dee44ad3e6aa5a42	n/a	Heodo
2020-01-17	rwlJSlSLtn.exe	exe	54e1b3d2b09af635b4fb96b871f61ddf64bee455441407200c8345dd0d2d92b5	n/a	Heodo
2020-01-17	jfk7K.exe	exe	2e1814e7d9a588824835e3a74227b4662ecfd6076562a3a35781e858c2312e16	n/a	Heodo
2020-01-17	aNn5.exe	exe	b1c2e968bcf93056e3d058a67b3626af8edd7ccb7f2f12514dcb0514f9d5f9d6	n/a	Heodo
2020-01-17	W4dZyW6qqIjF5uXRr.exe	exe	759ec750149ade2ff4fcd6b5402cfe65eb2240a3a0d58008fb6e2b69059324e7	9.72%	Heodo
2020-01-17	RhxViKziPRoqB3.exe	exe	0a26b8389b9333c1ebf76be679aa8774b933fd509d9f23a89a6d54bb554b6183	19.18%	Heodo
2020-01-17	7r4vcQkZ7kVXXR.exe	exe	6f684b7a05a4217fab092c075cb23752ac51b39235715de02641fbc4f6a2a0a9	n/a	Heodo
2020-01-17	9sCB0upNicKa3I.exe	exe	a5bd2720fe80844a82e378418655524ea646ec47bfb3a4f5e1a4df8b5397608d	n/a	Heodo
2020-01-17	ii1PcgkQ9n.exe	exe	42be66794332fb3f2578f1515d9fde883cba935409f2ab8c465809e4ea70d112	25.00%	Heodo
2020-01-17	rztnX.exe	exe	b068757a8bf7e90478f7ab19178308d329e5b25f8c87ac6e7f58730e5ca89a86	n/a	Heodo
2020-01-17	x06GVE1eEGIBhZ.exe	exe	7a21e9889f2c12727b85f7c710d8b50993bf7cc8cda067d4580ad16ce9a9a92b	n/a	Heodo
2020-01-17	pL7AAHHWyJokyyxy.exe	exe	cf2d137e9678acd8e45134297b28aeee071411379db6c67991d7b308915baae8	n/a	Heodo