URLhaus Database

You are currently viewing the URLhaus database entry for http://itstelecom.com.br/ava/LGOU/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:422465
URL: http://itstelecom.com.br/ava/LGOU/
URL Status:Offline
Host: itstelecom.com.br
Date added:2020-07-30 23:54:15 UTC
Last online:2020-07-31 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-30 23:56:03 UTC to abuse{at}hospedagem[dot]net)
Takedown time:13 hours, 19 minutes Good (down since 2020-07-31 13:15:13 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-31Invoice-QQE6826{:REGEX:.docdoc 3d8ef147ca84e9943fdc850171e2de9c05b0db3472cd05901e4f109e7fbe07f1Virustotal results 50.85%Heodo
2020-07-31Inv_Y9_692399.docdoc c7ed06b6f4284ba3fd857f03875187654aad78683efa88d3ed984fe057d484abVirustotal results 50.85% Heodo
2020-07-31InvoiceTUOP1928{:REGEX:.docdoc 0154af8049b8a7ec498151777f31d6e971c61bdfc439fe1a8150ad0f69c0e4f8Virustotal results 50.00% Heodo
2020-07-31invoice-YNH223-849325.docdoc 5399417505ae67bdc2253943f273fe2b69fcdb71294530cbfe0cbe731a251b48Virustotal results 50.00% Heodo
2020-07-31INVOICEIMH1-5318923.docdoc e3b83c00a51a401c88f8ab7d52dbee1d71b7a843fdfe5c2a6f3b76464efd77b2Virustotal results 50.00% Heodo
2020-07-31INVOICE_GSL4845-492290322.docdoc 09d8024f4904f92b615ceabf3c50d048d8600e410bd728c5ca6a09f15ac8d0aaVirustotal results 51.72% Heodo
2020-07-31invoiceWAKB0680{:REGEX:.docdoc 48c0326e786deae1ebf50df4773916c79325d15261708cccbc89d2421c639729Virustotal results 51.72% Heodo
2020-07-31invoice-4-97157688.docdoc dcfb38249b589a264dd4ce2c25853335f1399685fcd68d68c337f308d110a793Virustotal results 50.00% Heodo
2020-07-31Invoice_N9 091414790.docdoc cee085d16cb1dec28ff7ef5bd5399111ba8a5e26623b17902866e886144c228fVirustotal results 50.85% Heodo
2020-07-31Invoice-K18 063221677.docdoc 468c03e5514c45db80f93d359506f99bcdc95812e5e37680b531dd2fd1cba7f2n/a Heodo
2020-07-31invoice-PE29-0204105.docdoc 2a378624ddc963eca6688d3c25bec4bc7637de2153e1f23f594622a03f6e600dVirustotal results 50.00% Heodo
2020-07-31Invoice R0885-133355.docdoc 2789d1d3eea1e5dcb760faf9bbf395f267ec901bc7c52a67ae60133050897609Virustotal results 50.00% Heodo
2020-07-30invoice 28{:REGEX:.docdoc e42656550ed8d746cb8b453d28e1ca374da03e76bdf6b65633f3b1bedd1e051cVirustotal results 50.82% Heodo