URLhaus Database

You are currently viewing the URLhaus database entry for http://grupoleferas.com/twitterAPI/w1r1537638795299vaut5zw4v/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:422776
URL: http://grupoleferas.com/twitterAPI/w1r1537638795299vaut5zw4v/
URL Status:Offline
Host: grupoleferas.com
Date added:2020-07-31 11:00:37 UTC
Last online:2020-08-09 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-07-31 11:02:04 UTC to abuse{at}arsys[dot]es)
Takedown time:9 days, 10 hours, 49 minutes Bad (down since 2020-08-09 21:51:26 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-07-31DOC_853214836328405761080.docdoc cb62bca74d99cf663f017a96fe335ed6f7b61dc98c84b17b65184293ed02e223Virustotal results 46.77%Heodo
2020-07-31BAL_U7XQTURS.docdoc 5858ff6b1b7a2a32a3ea0025bcffc6cb3463458255f2f492a7d4a84f8f5389e0n/aHeodo
2020-07-31U_RS5385600525JE.docdoc 53b0406efd3043bb9a82034aad1061ca92952b9d1a9111ba31afbc95d47076c6n/a Heodo
2020-07-31BAL_94345171.docdoc a4793238143f28a12c3574808fca946d088dacc4570bbb1fd33df193b2185bb3Virustotal results 47.54%Heodo
2020-07-31EUG_00819453.docdoc b57bc7dd589454fa0f07ea79ec130baeabc4f14804df12eeb7fa990cbb703791n/a Heodo
2020-07-31FILE_HFQOFQCY759.docdoc 54ba24d383abb977b3b8e9fd0ad9a73735f0953a3c0f89fc0c192e86cb67d45aVirustotal results 47.46% Heodo
2020-07-3156539751.docdoc 55da5c5eb03990c56ace11826deedcc82fe9d5f1a0fa6055575be6d9830f85e2n/a Heodo
2020-07-31VHF_691949639581519612368.docdoc 1a4bdb64a47146d10bf8594404bcf28b53acfdb7242c989eb3d1c6673a270f86n/a Heodo
2020-07-31INV_D0Y8AI4LIEAIAC7K.docdoc 070d85940c505f80e563146c1264493f523229d81ef2aff4374669e0cc1769c0n/a Heodo
2020-07-31BAL_YLD_070120_SEP_073120.docdoc ba34c257bf0a483ea51193711903c2805619166e2d3452360fb2b791739e1696Virustotal results 47.46% Heodo
2020-07-31P_PO_07312020EX.docdoc b816a78081281f27b6bb7ba717c4c7352063ad264991acb7f0e3a0bfad991854n/a Heodo
2020-07-31WR7493550373DE.docdoc 97a0ba05768ba99119322c6cb79f62bfc92dbfbd64b56b393aa203e7679f5328n/a Heodo
2020-07-31INV_MW5297682981FZ.docdoc 628a4059b2b1433fae9cd2e40f5e6c8dc2528d5269c48dfcd20ee92378809e66Virustotal results 43.33% Heodo
2020-07-31DOC_4205855060.docdoc 74c79e2ddbba251595996dc010becfe64bde18250a2996d4930d60b6dc688f79Virustotal results 43.33%Heodo
2020-07-31INV_86470309115148.docdoc 79c176bbb127e50221aff1d14c8b4f8536dfe567f477e4608a526858824fcd26n/a Heodo
2020-07-31BAL_HU8381023708DB.docdoc 67eefdc61c4894365a14b80f30a06e1581213946458527b37964761cfae38cd0n/aHeodo
2020-07-31BAL_PO_07312020EX.docdoc 8d3d57f3ae15f3a97337fcd5d624d4e1dabe04c558203f41ea9e93c23928790fn/a Heodo
2020-07-3184796254088764146462.docdoc fff80f4d5e52e8ada39f0fdf2613952499c7d90f8b651335993ee20b382afe3dn/a Heodo