URLhaus Database

You are currently viewing the URLhaus database entry for http://80.89.237.130/1.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3799649
URL: http://80.89.237.130/1.exe
URL Status:Offline
Host: 80.89.237.130
Date added:2026-03-19 08:14:12 UTC
Last online:2026-03-20 09:XX:XX UTC
Threat:Malware download Malware download
Reporter: Bitsight
Abuse complaint sent (?): Yes (2026-03-19 08:15:14 UTC to abuse{at}novoserve[dot]com,abuse{at}server-panel[dot]net)
Takedown time:1 day, 0 hours, 56 minutes Poor (down since 2026-03-20 09:11:38 UTC)
Tags:dropped-by-amadey fbf543 Vidar link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-03-201.exeexe 60efd407eee7affe4fb235765b155955b0e19d84dabd629f52351e4a12fbb817n/a Vidar
2026-03-201.exeexe de2c5592a885835cc52ce4ecf742d0dc0306d268bbe086dd89ceab8495490199n/aVidar
2026-03-191.exeexe e3edfc278bc13aa77ed2d171b4d58343ba97f217ff3a8c49a833b7f88aac459an/aVidar
2026-03-191.exeexe 30331dd3b7f3b4a693102c3f36c05590ebd5ce821ad420f8fd346079f52b1750n/a Vidar
2026-03-191.exeexe ad0fe37beecb610674b282190ad61acd4a27fac82716d40ae1e9b318b14c3273n/a Vidar
2026-03-191.exeexe 02b7edadae376ef4e7ffc713f413aa50efb3e329c4a45a45f3cb726fb10bb2f5n/aVidar