URLhaus Database

You are currently viewing the URLhaus database entry for http://csds.ca/css/yQn/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:427201
URL: http://csds.ca/css/yQn/
URL Status:Offline
Host: csds.ca
Date added:2020-08-07 13:15:12 UTC
Last online:2020-08-07 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-07 13:16:02 UTC to abuse{at}uniserve[dot]com,network-abuse{at}uniserveteam[dot]com)
Takedown time:8 hours, 29 minutes Good (down since 2020-08-07 21:45:13 UTC)
Tags:doc emotet link epoch3 heodo link Quakbot link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-07Inv TVEM784 097398640.docdoc 522dfd2bd5983277254467284eb5cb1ae79a0957444adbd473462cfee3599c4dVirustotal results 37.70% Heodo
2020-08-07invoice_1469_6898319.docdoc 1b49868f184b6f4f2fb80f3d22439d3aa2131627441c78bffdbf8bb4b18e7389n/a Heodo
2020-08-07invoiceEDH705910035.docdoc e8035bcb217908bb414bb819f5f71f6745ab19ee1348c122ced77fff342930d5Virustotal results 34.43% QuakBot
2020-08-07INVOICE-G68-00975307.docdoc d8ed4fd8240d522ca6a6f60b17cc639ad6dfdb93ef50a62987c6091b7c80c56dn/a Heodo
2020-08-07Invoice_IDPN48_700754943.docdoc 66762226f0f7bab8acf658aaf69557223a227f9225671446d93e502b6d221fd0Virustotal results 30.65% QuakBot
2020-08-07invoice-C09-815450823.docdoc a1d3c10648113856a54d5142939fddfc547781a277390386c2c66731226e65d7Virustotal results 31.67% Heodo
2020-08-07INVOICE-IYJA4-49021060.docdoc cfabab6ffb980a446a83e4e44e6bd9a0f7d5eb5836628e4934ae4987f58ec211Virustotal results 29.03% QuakBot
2020-08-07Inv GT12 11416541.docdoc 2232504c5ac6d12d0c0acc9590c5957289d5177e41c502d10797f7bfcf436fe4Virustotal results 27.42% Heodo
2020-08-07invoiceRB19556299.docdoc b0ca63e844878888dfd2c5e0ec67432ddbf00dd81de2f91d7b807308d942b84aVirustotal results 27.42% Heodo
2020-08-07Inv-1470-384991.docdoc 38484bba81fe221467f8808a6667bd4344ab116fdfa4f92a1acccbf8e86d0b4dn/a Heodo
2020-08-07invoiceR965446071.docdoc 8dca57bd20cb1aad6ec1fa7527c59fac9aa9f278935d7eabade0ff47817bda58Virustotal results 25.42% Heodo
2020-08-07invoiceABC0026322788.docdoc f2f9d8844e0ea0472349e17048e353522a138927c4b88802535845aa231f0833Virustotal results 24.59% Heodo
2020-08-07invoice_CD4372_34901306.docdoc 03ebc44cfbcccf33f186b7fa2350c9b7043d031b274921de003e30d9d999dfb8Virustotal results 26.23% Heodo
2020-08-07invoiceFJKY89708624425.docdoc 5aee069347a637261c43f7af705de95354a2f9f320fca5ee3bba986978d6b81cVirustotal results 26.67% Heodo