URLhaus Database

You are currently viewing the URLhaus database entry for http://www.l600.ru/sites/En_us/ACCOUNT/Payment/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:31380
URL: http://www.l600.ru/sites/En_us/ACCOUNT/Payment/
URL Status:Offline
Host: www.l600.ru
Date added:2018-07-12 09:04:46 UTC
Last online:2018-09-10 16:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter:Anonymous
Abuse complaint sent (?): Yes (2018-07-12 09:21:14 UTC to abuse{at}rtcomm[dot]ru)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-07-13invoice-20180713-8280987.docdoc bba895171faac7077912d759461ee4afa88ca49f3510a578fbd9bd0310acf047Virustotal results 22.41% Heodo
2018-07-13invoice-079-TF-667213/418.docdoc be5c10a764e08853e877d4cf25446897e821f72a552e45166617e1761cbb1da2n/a Heodo
2018-07-13invoice-20180713-607351.docdoc 07aed8cb8bcbe6688ba0d835d0a1f4dc477b935aa74e6ef08e87a085284d8768n/a Heodo
2018-07-13invoice-20180713-054854.docdoc e27c290b626fe88755f6a1bb5896b9bd52347d1274d663ab0c0d8befa47947a9n/a Heodo
2018-07-13invoice-095-DQA-5576749/7.docdoc e2066792c82300571669d1d4143bfc0b4cd7bc35a92cdef40ff05ca17f43f5dcVirustotal results 23.33% Heodo
2018-07-13INV-2018-07-13.docdoc 97ebd62598f99ee1dd7b1b65f78cb82a5df58e40e2b4572ff9df16c7d724d71bVirustotal results 23.33% Heodo
2018-07-13INVOICE-2018-07-13.docdoc 95deb885f38ecac5c9b598dea60c0d8fa27c2985bc611a09105270a3821a768dn/a Heodo
2018-07-13INVOICE-XVF-0991682.docdoc 5d36c70205a9efcb37d0bf76f135203c0b6a67b0684f5cf5eb7eb718d6f4b3afVirustotal results 23.33% Heodo
2018-07-13INVOICE-RPJ-907219.docdoc 146ede99972c7f509ddbdc14d8b9dda0538fc1b99c4245b6735b12fbde6f9742Virustotal results 38.33% Heodo
2018-07-13INVOICE-20180713-74883991.docdoc d2bb88c934e3232b3aff7f12bbdde3389320eed32a33fa8ab6637e47e90ce216n/a Heodo
2018-07-13INV-20180713-0553775.docdoc ea6200d8f700a990ff663e7b9daf833c1ca36cd734d98153de6cc289a3dea46cn/a Heodo
2018-07-13invoice-2018-07-13.docdoc 16dcc2fe21d32c9c9804904cca90a210074077a19cac085ce509f0e70e4dfc74Virustotal results 38.33% Heodo
2018-07-13INVOICE-HQQ-9459467.docdoc 8f74ec222b7e2397600a636e1c4d7234ac418803de511eb80f4808ba412d2a8cn/a Heodo
2018-07-13INVOICE-MAD-0526458.docdoc fedb720d0563e0f1006157b48ccde68e8f9e8d440e32e42e6cb577473e6689f8n/a Heodo
2018-07-13INV-0581426/2.docdoc c824d4bf598b29910f76d2abd4729a5fc15cabc2f3626082658bdd4e59c2c9ddVirustotal results 40.68% Heodo
2018-07-13invoice-QD-9922935.docdoc 0eb53d75d91cb07dd1f21ad206b8fd1e8b09a1d36cbb9ee15a82a86be74f9492Virustotal results 38.33% Heodo
2018-07-13INV-084-I-3182264/77.docdoc 523316f8a759917e64d5de3c5ca63e705d4e22f265d742695611e4388e1d1901n/a Heodo
2018-07-13INVOICE-20180713-6419694.docdoc 6b5424ab7bd9429d642d198ef81c8c840179558b6bec8d6a234ceb621c135cbeVirustotal results 38.98% Heodo
2018-07-13INVOICE-002-QG-463019/179.docdoc a0f5d4d3f279df5d5a3704ba60b1b998ab14f6a843ca0c762d9c18cfa8f8cf53n/a Heodo
2018-07-12inv-20180713-605723.docdoc 2de637800e61a43436013587a3d1de272a6ce41b6d327163bb7ba0c56b1e503aVirustotal results 22.03% Heodo
2018-07-12INV-2018-07-13.docdoc 3c96844b1ed334173d32dbc46668e6a234931bb2cefb945ee5157a9f6359cf97Virustotal results 21.67% Heodo
2018-07-12invoice-2018-07-12.docdoc 6bd419011bef4ca236b15ff19f89b2defc6768c6ef08866b46590e6461c86a09Virustotal results 21.67% Heodo
2018-07-12inv-HW-1592636.docdoc b1b0eaac5ad3bfd1c233db2fd7cdc43eb09ccd7d8d41519a79e84c66ddc4aceaVirustotal results 21.67% Heodo
2018-07-12INV-2018-07-12.docdoc 6d46058f394f1b31f89b3eb9ee5bdf48c69614fe8dc3c6f54092af7dc2c7164dVirustotal results 20.00% Heodo
2018-07-12invoice-2018-07-12.docdoc 668bbeef3c73c075b28f0c8441dd083fe979966afa72b89f62de5140820ca68eVirustotal results 21.67% Heodo
2018-07-12INVOICE-20180712-01381619.docdoc a15f66b222d6bbbead16f3c7725792a41c7c4a32fbde94443b0e225009b2101fVirustotal results 22.41% Heodo
2018-07-12invoice-JI-585082.docdoc c3edc524c521abfbc6b205dfade64b4d24a5307f8abaea357c2964b6b44796a7Virustotal results 23.73% Heodo
2018-07-12INV-058-P-563186/9.docdoc 55d87ed565d9b22c0dfc6f0aaf0c13a2c40018a153ad58c2eafa33f98a01eb71Virustotal results 25.00% Heodo
2018-07-12invoice-057-KEW-5863592/3.docdoc 9c9ab6e712ff27b9d43a9915a70e670690e0a5c5089a5a538125e6beb1b921edn/a Heodo
2018-07-12inv-SI-8722797.docdoc 24fb6eece60e8771362ef0cd74ccb2824109124f9d771813b9094936dd8ed311Virustotal results 25.00% Heodo