URLhaus Database

You are currently viewing the URLhaus database entry for http://aiqupai.com/dln0/sidkz9y-xe-381638/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:416209
URL: http://aiqupai.com/dln0/sidkz9y-xe-381638/
URL Status:Offline
Host: aiqupai.com
Date added:2020-07-21 18:56:24 UTC
Last online:2020-07-22 08:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-21 18:58:08 UTC to qcloud_net_duty{at}tencent[dot]com)
Takedown time:13 hours, 32 minutes Good (down since 2020-07-22 08:30:38 UTC)
Tags:doc emotet link epoch3 heodo link ZLoader link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-22Inv KOMD248_534668464.docdoc 02c7fd8ed2ff395eb8c7eb3caca1e0cec299f4db7480e6d19829069ce541bc7dVirustotal results 27.42%ZLoader
2020-07-22INVOICE-1246_50659611.docdoc 0f2039a528f454dc85d45347c05e3deeed35f371d829ed160143b2cda326accbVirustotal results 26.67% ZLoader
2020-07-22Inv GSYW5_435526366.docdoc 639bdf650ed2329ccbe33f471cc8e6e8e24bc3a1147d446ff0ce5ea0e28ae9ebVirustotal results 28.33% 
2020-07-22Invoice_8456_6529762.docdoc eb7c02a2f5a7f9b6c76befb58faed0e6cba4cfc494eca22bd8e87b36fa241b66Virustotal results 27.12% 
2020-07-22Inv-VKJ5798_313550347.docdoc e7edf63be003d87056435fd147d04f6930e07f08dc6534bdfdb3913f4cbbd59cn/a ZLoader
2020-07-22Invoice-O5219_02169769.docdoc 915ef2dcbb13060e972f99c4e495f50d5fb9144271000603ebb86db379223840n/a 
2020-07-22Inv-MAB9027_144075508.docdoc e7af4a6f667a4edbd224f0b3c1358fcc307b4f67688529201e0c1c9a91560f64Virustotal results 26.67% ZLoader
2020-07-22INVOICE 7_822145879.docdoc 455dfe523b388db738afa8d1f08933f7ff42ba148a286ef3b05c0d12d3424d5fVirustotal results 26.23% 
2020-07-22invoice-AIYQ6_35281729.docdoc 4b0e52b567cd400c2c99e8d0862590bb832ae10b79277b8985318a3c05e5176bVirustotal results 25.00% ZLoader
2020-07-22Inv-VPP82_796723009.docdoc 6475e70afc346103957694beb826b2eefdb2850c9939c91d6b514ce9e1cd32a4n/a Heodo
2020-07-22invoice-INBJ699_905583.docdoc 14c000f66600b5ca3d6bac699b2d5c04ddcb6d8718fee703a5cc2c57fc7a1ce5Virustotal results 25.81% 
2020-07-22INVOICE_SZW2393_8803035.docdoc 7476dba24b28d2a074d7e75aea79591f98fbb95b065c91870b5a8198ab615f19Virustotal results 26.23% 
2020-07-22Inv HAMK35_241563744.docdoc ee7974d011582b83c0464f15d86e55b3306961023b16ed3c195c6c1953ea5835n/aZLoader
2020-07-21Invoice-CPNF6_9698348.docdoc d1fe2bcc5439caf2963c2bcf85af9c8b8d4451abbc4675be82a33bf97ca81f18n/aHeodo
2020-07-21Invoice_O30_061027.docdoc 599ef65639238b841a852f756d71b9d44c5e02b6d151b6941b95c94b5e8eaf64n/a ZLoader
2020-07-21Invoice-050_43603272.docdoc b697a31e24a1872813f044cfe369887a6850b80c7d79509587d7e4e6955ba322Virustotal results 26.67% ZLoader
2020-07-21Invoice-9_795932.docdoc 3e48fa00d3dfee3093ad2affb99324ae8e7261f2c92fd9bc71ffc5923a7dc4a3n/a ZLoader
2020-07-21Invoice-H21_39042844.docdoc d9238e5af649fe7ea0572f9699144985895a4c4576ebb77e0e198ea5120f4c20n/a 
2020-07-21INVOICE 9_904394.docdoc 9c3f1dbdddf1aea861852243a66b3795d0cbf86a1ee36fb372505a839db31540Virustotal results 26.23% ZLoader
2020-07-21Invoice-QXK0101_0643307.docdoc 9e2fa2ec0c3818292f9a10539ef4bdcda848df84a8e0223cae2f28f82360a11fVirustotal results 25.81% ZLoader
2020-07-21Inv_C1_87871950.docdoc fa107254b6f843bb079661702c64654bcdffb1fe41fdcdd125d5d99437e15106Virustotal results 26.23% ZLoader
2020-07-21Inv-DIXY0_99835971.docdoc 2bf992bac6895328fca415aeeee4f89aff347608e709524ad9a2f549b007dae3n/a ZLoader
2020-07-21Invoice-00_2375779.docdoc 97af910f93ee8e736e135660fd84b888bdcc82c809ef30af7cac06da62907994Virustotal results 26.23% ZLoader
2020-07-21invoice-F55_289775.docdoc eac069c2098e2a08afb43c1f5aae5878d557e5cef94096cefa93bbe0d04c236bn/a 
2020-07-21Invoice-HN23_52170726.docdoc 56508ca86a568105ecfe6df473dd0a40bbb40f66270edb514d83e99e1e6ef0d3Virustotal results 26.23% ZLoader
2020-07-21invoice ZA3_674486122.docdoc 837bbc0f0c83b6a6837640d6ecda9c348ffd06a81fa4b87c7ebfc7df59b1a690Virustotal results 26.23% ZLoader
2020-07-21invoice-QPBL9281_008947213.docdoc d7e10a3c855ce88c300fdcc0faf9b5cd0534c9dca789c807efda55947f2822d6Virustotal results 26.23% ZLoader
2020-07-21Inv MQ25_700757.docdoc c7f1f379555ef08082a617234440aebf2a68fe7c55bf8280d333518d22adbb4eVirustotal results 31.15% Heodo
2020-07-21Inv MQ25_700757.docdoc c7f1f379555ef08082a617234440aebf2a68fe7c55bf8280d333518d22adbb4eVirustotal results 31.15% Heodo
2020-07-21Invoice_GN9_12879836.docdoc d00a595a3e71c743fc04ec4a2ba0eaab9fe1d76d7b018423fc5cece4e4a62a29n/a Heodo
2020-07-21Invoice_DI5915_22774363.docdoc 3a5dd00ce1b9f75836d4575816fd4e49d546dfa29d24a4b5dff87b94d9b34b13n/a Heodo
2020-07-21INVOICE_079_306424864.docdoc 9ed17331261676ac56f81432fd0de1293bdc48863867eac50012dff696d69439Virustotal results 29.51% Heodo