URLhaus Database

You are currently viewing the URLhaus database entry for http://198.23.213.30/word.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:417668
URL: http://198.23.213.30/word.exe
URL Status:Offline
Host: 198.23.213.30
Date added:2020-07-22 05:20:40 UTC
Last online:2020-09-03 11:XX:XX UTC
Threat:Malware download Malware download
Reporter: abuse_ch
Abuse complaint sent (?): Yes (2020-07-22 05:22:03 UTC to abuse{at}colocrossing[dot]com)
Takedown time:1 month, 13 days, 5 hours, 59 minutes Bad (down since 2020-09-03 11:21:50 UTC)
Tags:AgentTesla link exe njRAT link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-06n/aexe cebee7dc0112f960319868d6df1f9db37868e1912def20304af20a21bf409250n/anjrat
2020-08-01n/aexe f226b44eb44a2b8883a1966be5a943ed2ecf6646a094b6cccb78f23d08796e7en/a njrat
2020-07-24n/aexe fa7942a25cea90d890bca23298576191b75723375e2106d8ada228a85bfcfa7fn/anjrat
2020-07-24n/aexe 891a8e460bcb5674dcb63bb4822e7fe2b44c5e3bce54eef8138f1359b810c216n/a 
2020-07-23n/aexe 4915f66ed7caab4de6137ad5a73319f0e6bd04303545b57aa0f73bd224acedd9n/a AgentTesla
2020-07-22n/aexe b7e01380d58027103b282b33a910791af457a82a584b1f4aef4cbabb5bac62bcn/a njrat
2020-07-22n/aexe 476d02f7c777bb08d97cf87c305e3cb4f41501c1b15ddd88e55f31bff0767b0an/anjrat