URLhaus Database

You are currently viewing the URLhaus database entry for http://campanus.cz/wp-admin/jBqUUjq/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:427285
URL: http://campanus.cz/wp-admin/jBqUUjq/
URL Status:Offline
Host: campanus.cz
Date added:2020-08-07 16:28:10 UTC
Last online:2020-08-08 19:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-07 16:30:07 UTC to abuse{at}wedos[dot]com)
Takedown time:1 day, 2 hours, 30 minutes Poor (down since 2020-08-08 19:00:59 UTC)
Tags:doc emotet link epoch3 heodo link Quakbot link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-08Inv13071659750.docdoc 5d7f4b905c268a16b873261ceb5f2bca434dbaa45ad6c5b20a3d43091709ace2Virustotal results 39.66% QuakBot
2020-08-08INVOICE PSA0 236872726.docdoc 6c1e2497b23d20655d8eef924d28c3fd28db1fa7cb11126fb9079c8e65c11010Virustotal results 38.71% Heodo
2020-08-08invoice_NKJ007_293096.docdoc eb283960353efbf54aa5fea1afd72a13e16ffb3e86b9230aeac43d3e2c346e17Virustotal results 40.00% Heodo
2020-08-08InvTI68320131815.docdoc 720c9434e43e1693e0923ea04ff82552809d11a23b9ced59c6d0b3e417ae7885n/a QuakBot
2020-08-08Inv-INUB4857-511157.docdoc d9117ec342f11a6f9cfe66f8c223ad054a26dc3cde8c442a7a72d537701fbff8Virustotal results 38.71% QuakBot
2020-08-08invoice-WVZ9744-904335.docdoc c620f32017dc5a093d19d6362b34657906e156082ffac1c93df403171a2fcc32Virustotal results 38.33% QuakBot
2020-08-08INVOICE-QT0215-85231449.docdoc 19a12981cd87b52671d2ab194472e484378f6dd0790be6d781243b5c9bc6399aVirustotal results 38.71% QuakBot
2020-08-08Inv-STQ281-284287802.docdoc 51d32641c97d78c53640cc9fec84f1b150eb754042a74ce028d92f70bcf7544an/a Heodo
2020-08-08INVOICEYOC9064432510.docdoc 65ae828750c71374225c39bcfba19a641631b695eafa9df608266f83e63a8c61Virustotal results 38.33% Heodo
2020-08-08invoice RG05 152707797.docdoc b5b0dab6e7d7a2fc66a0947ad16fc1b6de4d68b73d5d071459ed06b18a96a8a0Virustotal results 38.33% Heodo
2020-08-08Inv QSN0 422360548.docdoc 1c59c3dd93e52fa2fac6c782150a3917bbf77c7c5f941828bfc6869dd60a7cdcVirustotal results 40.32% QuakBot
2020-08-08Invoice8841359208.docdoc acbb87afd6b22d463b27aa56b1b49e40a2c049097102b0c901678e2ba771e59aVirustotal results 37.70% QuakBot
2020-08-07Invoice 8 37695701.docdoc d91731a4dfcfb45b578cde0a57e35273bdc0eecf426e738a1f52a32e989c9fb9Virustotal results 37.29% Heodo
2020-08-07invoiceQ8021910661.docdoc 346b0ed5db257c2bf541ae37f57e3971a19bc69310811cbe7fa037768f2136a1Virustotal results 38.33% Heodo
2020-08-07invoiceIFFA229183536.docdoc 96c2710133ec54c60394683f148a94ba31cda1182b21b8f0f3285d78c92c0336Virustotal results 35.48% Heodo
2020-08-07INVOICE-NV44-6187344.docdoc 7ce67620298aa7d0fe5e7f2bab8e052f4a4ce937c3300c92875e33d7b466acc0Virustotal results 36.07% Heodo
2020-08-07Inv-FNDP00-056769808.docdoc 6d9ffb2447adb083ad20788cb467c96a7f91b27d9a5a9eb35a13e2471d909b32n/a QuakBot
2020-08-07INVOICE-N159-180191246.docdoc bb196956c5e57876daf8c64828c2b0cff8f83fc540f7ff492ecd7632f8a235dcVirustotal results 36.07% QuakBot
2020-08-07Inv-DBS3773-940702396.docdoc 5871ec926c8f2a5e608bbcc0aadc55520fcba58d418280c7f44449f8e88a3d41Virustotal results 32.79% Heodo
2020-08-07Invoice-VYOG037-355769779.docdoc 737d96d343a18d4739a12d2b949eb31e758fb5e24c17b0c706997154731ac07fVirustotal results 30.65% Heodo
2020-08-07Inv PM97 004737.docdoc 3a7e162433ba4372c7e49ee5cb6bd4afb23cde7bc0f19d39edc30aa22473994eVirustotal results 27.87% Heodo