URLhaus Database

You are currently viewing the URLhaus database entry for http://cosmo.li/GFMI/multifunctional_sector/external_X5zR_GTkqUewl2xeA/973792286194_VTar6/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:422326
URL: http://cosmo.li/GFMI/multifunctional_sector/external_X5zR_GTkqUewl2xeA/973792286194_VTar6/
URL Status:Offline
Host: cosmo.li
Date added:2020-07-30 18:51:33 UTC
Last online:2020-07-31 17:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-30 18:52:20 UTC to abuse{at}mail[dot]metanet[dot]ch)
Takedown time:23 hours, 7 minutes Good (down since 2020-07-31 17:59:44 UTC)
Tags:doc emotet link epoch1 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-31DAT YY16023.docdoc 242a7cf61d7a50d7a5eb9a2a9ffd61ac47f061eabbf92f8f2d57c70eca976871Virustotal results 49.15% Heodo
2020-07-31DAT YY16023.docdoc 242a7cf61d7a50d7a5eb9a2a9ffd61ac47f061eabbf92f8f2d57c70eca976871Virustotal results 49.15% Heodo
2020-07-31arc B99577.docdoc c54a83ed7df0a40d62a865853af530ffc4372e2bf7255a43bd6e352ed5ec9868Virustotal results 47.54% Heodo
2020-07-31inf 16579.docdoc def3ce0f4c7f3945278c10c62219f1988c261c1949d3ebb53efae2d6bba24b2cVirustotal results 47.46% Heodo
2020-07-31list-IZZ9042.docdoc 3807ea27c87ef220916b55deb372a2eab386ffd18028cfee853a34521e6fd377n/a Heodo
2020-07-31Dat-20200731.docdoc 67c5999b32940c30f6fd3c0b3192781138c395f1e0a6157d55c5a0b8ee6a4ff2Virustotal results 47.54% Heodo
2020-07-31doc 20200731.docdoc b9c07b0add0ebfdfb953f12ca052352e83f960649b3e3b260bd55cd93c9252bcVirustotal results 44.83% Heodo
2020-07-31arc.docdoc 6b43b38cbc9af296e3ffeecf0f53986f42af21fd59ce158d7deedc06d597880eVirustotal results 45.76% Heodo
2020-07-31File.docdoc f64a9838ba01f483ffcc11baa109003b47d7055e26182f079bf5feb482256906Virustotal results 45.76% Heodo
2020-07-31arc_2020_07_31_313.docdoc e005a0193a62e835020ac3add8d749a00ed88735c22ba5cfc17c8e03070f213bn/a Heodo
2020-07-31ARC 20200731 6290125.docdoc b932f9fcbcd3c278483655fe0f75a06f328c7b36c2ecef394d07e8413adff2b5n/a Heodo
2020-07-31rep-2020_07_31-887.docdoc 4d2ba508dca9a3ce899aa342252f786c29c81a735433b98163b27a7c1f76c646Virustotal results 43.33% Heodo
2020-07-31DAT-2020_07_31-9552292.docdoc c5e1be1f3b4b0978b9a8d32d545c5d775db521592c4b0c41ee29dd6353cb0190n/a Heodo
2020-07-31File_2020_07_31_LKF6432.docdoc 03323b58028eea4598e85f64f7ceb5a05aa6319cfafddd54df733ab08604fd8an/a Heodo
2020-07-31DAT_2020_07_31_340907.docdoc 2ac60db8698b3d3221b47a52979ae44720c62807088dbd856c786830d3b99547n/a Heodo
2020-07-31REP-2020_07_31-CJT38179.docdoc 98801d6c2f513246c4ad276f6da584b6c7a03db219c4289e964843b344e23f20Virustotal results 42.37% Heodo
2020-07-31Dat_2020_07_31_VQE6519.docdoc 77573139944c47abf290288581650dfde32bcae6d6f1577e65987f948f483385Virustotal results 43.33% Heodo
2020-07-31REP_2020_07_31_912.docdoc 4acec2a5ef0b6f549b39db572081188d4e2d9cc039f95a709c105b7aa3bddf7bVirustotal results 41.67% Heodo
2020-07-31List 2020_07_31 UKV781.docdoc b7866f0bf3b77092eb43f36d11d3576b2e4db31f80033dc2ce61b2c12f799e15n/a Heodo
2020-07-31arc 2020_07_31 324637.docdoc 2b95566cf7003e763ed0197b5fa50108fe5056cb69e2e0ad9151ad8b1b2af8a1n/a Heodo
2020-07-31inf_31355.docdoc eedaaf67ad14a0213229367966ad1333e3f8085e1e6b83683d7fac0e3e16ae28Virustotal results 40.98% Heodo
2020-07-31Inf 2020_07_31 NRQ136268.docdoc 5a5cce347f4394dbd606a57bb1e525d50bd0400d12147fe8db44c012fe267222n/a Heodo
2020-07-31Inf_20200731_8930676.docdoc 7172995d1d5b54353bce9bbad1ec7900ca7175b8a7e41e5d86bd80df42e1014an/a Heodo
2020-07-31Rep_20200731_34476.docdoc 1d075da8b51be2231edf1a9450db095e374e7d2200b6d3c3e7088dcad1557bd1n/a Heodo
2020-07-31List_476.docdoc 8000822d4c8c7e44dd4b30d66d27dc97e0200b918008f375cebf7147411cbf74Virustotal results 40.68% Heodo
2020-07-31Inf 20200731 3364.docdoc fa3e81294239894ab6d187ff561319cd3f23649f9888593ae2c7bd734af6ecfdVirustotal results 49.15% Heodo
2020-07-31List-KY766.docdoc f50fb4e4eb9c8fd7caa059bb20573d67a0a47bfeda1c3d0efb6a2f4faeb77ea4Virustotal results 49.18% Heodo
2020-07-31MES_2020_07_31_236354.docdoc e6a1cc45ec979b40952950438c59cd9dc2a3009a942d9fff7cd793d7518e0368Virustotal results 48.33% Heodo
2020-07-31file-2020_07_31-7933.docdoc cfb9e071cc0b8abf3bfe496027745ff1085b24dafec350195422d545c337001bVirustotal results 50.00% Heodo
2020-07-31ARC 2020_07_31 JD42314.docdoc 73729cfbc98f25d4dbdecf63cd27eb82bff9057cdf78e160440e41c9d553f4c2Virustotal results 48.33% Heodo
2020-07-31Dat_20200731_T964519.docdoc 504a1e650555404e3526d3045ef7bc16a577c06635215b1cea49e2c8877a7cf7Virustotal results 48.33% Heodo
2020-07-31Arc-20200731.docdoc 624aa2e87b85c4c93a21bf0b764d1594ddff016da7f44040918cbcccdfb017c5n/a Heodo
2020-07-31Doc 386.docdoc 3d0cc46b7da5512e1f7e206cad81500810333df0c10fd1270f314353c2602d83n/a Heodo
2020-07-31LIST-2020_07_31.docdoc 9d3a2720e64fadf090a5267f5ca698c0ab762940705497bc2412d711f1494983Virustotal results 49.15% Heodo
2020-07-31doc_2020_07_31_669561.docdoc ae98434b475cd34f72aa2b317e2c29339d0a2578d792a14ee7102cc0bb415aa8n/a Heodo
2020-07-31REP-2020_07_31-QL221.docdoc 2af35203a78ab48a45126f959aa05f3037e941bc7ff22d04decb13d88846a967Virustotal results 48.33% Heodo
2020-07-31arc-2020_07_31-N672.docdoc 61e8635da3b4dad36cbca3de124b4e2d07a5de346e069517354f0e063bb9ecfdVirustotal results 49.15% Heodo
2020-07-31file_20200731_UO30495.docdoc 57b075be6438184bf527bd055363a33f851ee9acb765aaff3c717f2ca6ea7d5fVirustotal results 49.15% Heodo
2020-07-30Rep M027.docdoc b9c357adce4a39fef2bdc25779951e2f40307dade90e05fdd0f95b77cf77c786Virustotal results 49.18% Heodo
2020-07-30MES 20200731.docdoc 1aec4694358be776e5733a6efe431b95ad93ed01eb0b394bac898a68f62938b5n/a Heodo
2020-07-30Dat 20200731 4082.docdoc 103409fe241a51656f19890d23c38daa378646f589ef42fb9a84480af85fcddfVirustotal results 50.00% Heodo
2020-07-30Dat_2020_07_31_476471.docdoc 71100778f6bc4fefc8bee7d8191d1a50ec140a1f8d30b57b9abfd2db06635274Virustotal results 48.33% Heodo
2020-07-30File-F5512.docdoc 80565d4ed000d2c561645c79096f5e2fe04ac3f5c7e9e34ac68cb4ed9306ceabVirustotal results 50.00%Heodo
2020-07-30Mes-3704.docdoc 4122a94cf3814bd9e32328263e6b981316558b31ce38df659a1853a02274dc00Virustotal results 50.85% Heodo
2020-07-30FILE.docdoc 9c59614355467ee88c9dd9cde34e35c9b7344c82eb6b01c36ede1aa41923740eVirustotal results 49.18% Heodo
2020-07-30list_2020_07_30_3305.docdoc de22f3d159bf17825aa2c83805068b8ebe5d690f6981d2e8102613087fd3b6den/a Heodo
2020-07-30INF 2020_07_30 606533.docdoc 8afe6cc692747e8399748ac4d652b72ddea1515312f9530b8319a1b02e960eebVirustotal results 47.54% Heodo
2020-07-30arc 2020_07_30 RN88205.docdoc 8fa056cca848c61d974a9bbcb5ee31aa9e45987ef15a2589765d61065fa9fc1dVirustotal results 48.33%Heodo
2020-07-30REP 2020_07_30 468.docdoc 0ae3792dfb7057e3264b21dd694ca5b3fc93502edf5829ca4797eb57f01170a2Virustotal results 46.67%Heodo
2020-07-30FILE_2020_07_30_855.docdoc dbdabc0245226588757dd5317307e3e4d7307b6948dc4c467a1dbff0231e7e0bn/a Heodo
2020-07-30doc-2020_07_30-J23127.docdoc 0a20209c9b6d387dc569b4a5e5c2bb715254fb1f1448b3a09f7eae306a38efe6n/a Heodo