URLhaus Database

You are currently viewing the URLhaus database entry for http://csngroup.donaus.com/backup/f36plkn0r/90c952807252655419y2tu612fnulvt9x/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:429164
URL: http://csngroup.donaus.com/backup/f36plkn0r/90c952807252655419y2tu612fnulvt9x/
URL Status:Offline
Host: csngroup.donaus.com
Date added:2020-08-11 09:41:05 UTC
Last online:2020-08-17 12:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-11 09:42:03 UTC to abuse{at}digitalocean[dot]com)
Takedown time:6 days, 2 hours, 49 minutes Bad (down since 2020-08-17 12:32:01 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-13MTR_080120_FUG_081320.docdoc 88bab9477b241c915c4828229812ee9c6bcfafcd6d303a02feace7bfe146de75Virustotal results 28.81%Heodo
2020-08-13H_5J8MJQLKGGM.docdoc 4abecf9c71a16e78392600309278c84a75e35f2d1fa5bb8ef6c347820092d753Virustotal results 27.87%Heodo
2020-08-13N_33043837.docdoc bad77bb86f43d26aeeddd264c08f21e690be629f116fd2659556e12485195610Virustotal results 26.67%Heodo
2020-08-13891731648024.docdoc fdd5654b78c6c5c23b4f6c6502eb69701c87c65ad4bd2d121046db883154d863Virustotal results 27.12%Heodo
2020-08-13INV_305252519735266674.docdoc 514c5463ef915a602313b4a23950c67d0ac86cdf68b2189152de5c5e34b8f21eVirustotal results 26.23%Heodo
2020-08-13FILE_65565964.docdoc f3288815441008b2291c6b17d597d58fe606f7475c4641bacba49ad56c1b1142Virustotal results 51.72%Heodo
2020-08-13REP_082970678512137814359214.docdoc d3cbf8eb26742271a0281233827b52ab52334bef5335d0f8a27c9db613de55c7Virustotal results 53.33%Heodo
2020-08-13INV_PK2769748211GM.docdoc 0938a3eb8d86fa634cbaa1f643bd2c6cafcdacba202e4683cf7245705bd11fb3Virustotal results 52.46%Heodo
2020-08-13FILE_PO_08132020EX.docdoc c2bb5e128810c06abd15ad3ef0bc95622c20da154ca500892972305c94feabedVirustotal results 52.54%Heodo
2020-08-13REP_7647891378868305891033.docdoc 294dc4d0897b43e65d8e7c4ab761281fae2d7ff62a16dd47e9b7731019ed0c21Virustotal results 53.33%Heodo
2020-08-13REP_OZ7397473320FA.docdoc 2ec1025c3a44b35de74853b22998ea439d6eb5f0d92d9065256692f0deadcbd9Virustotal results 51.67%Heodo
2020-08-1397349491840926.docdoc 5ec2a412f6729dbbd84453b84c85ac56f93e865a1900eb514efedefedc56467fVirustotal results 50.82%Heodo
2020-08-12BAL_QW2788826030SK.docdoc b09cdb8f91eb70d7f179d304a4585ab2b1867a160d9760ab236065aae029268dVirustotal results 50.82%Heodo
2020-08-12FOE_080120_CYG_081320.docdoc e9bbc3d987e57144a6554ea1c30a527af2db5a40b2c12e9fa6b28a79ea2afb3aVirustotal results 49.15%Heodo
2020-08-12BWM_54AEMY59I6MEU.docdoc c872e36dabcc02d5ca6d5a1c7ff09a8673509c3a45dc42978988f19f053fffadVirustotal results 48.33%Heodo
2020-08-12REP_1WVONUABD0TBWWHQ.docdoc f3a601950fbbbb99855528eac98d43109bf3ab8aa35e4de00ae14321f1d6ea2aVirustotal results 48.33%Heodo
2020-08-12BAL_KO3491779852QM.docdoc 5ec93d8ade8ce137e0a4718134228f587451d59aeaa2e27d24713ccc4866e8edn/aHeodo
2020-08-12GCPT_SVP_080120_HJI_081220.docdoc 448b77551e8ab272663dac5ccf4cad4be8b7dcfc1759a2859785754aa44d285an/aHeodo
2020-08-12ZC5836925401UN.docdoc c75a7753aba5fdf5703e46cfe6e6a53ceb7df3394f932fc521343b25ab0b2388n/aHeodo
2020-08-12J_VW7106911563US.docdoc f2ccd3c493881b68693c2d24addb0a1ec854e6020efdff1cbccf785a1ad099bfVirustotal results 48.33%Heodo
2020-08-12T_DMMRG9OZHAY.docdoc 4b94ba4ad2c65349c09e18ba049dd76f5b61a5491812b3ea60961945d1866446Virustotal results 49.15%Heodo
2020-08-12SJ_HBZ_080120_GPZ_081220.docdoc 6678c9d2f3e28e53d3cf9fdcd2baeeafbc43c899aad658fd005273aaa29e3edfVirustotal results 45.76%Heodo
2020-08-12U69WNIXNLZCVTWC3.docdoc cf71122cefc9da3a118c409800dcdf2f9a961238a3341bf9c373d69fe3923959Virustotal results 45.00%Heodo
2020-08-12Y_UL2942965723MQ.docdoc dd4525e6914fa0fd2f91bde41f2df30ef8857b9f08c19e0a106ec78098ab63c1n/aHeodo
2020-08-123611148004891092615195.docdoc 0ccc815e047e5c8bc4824f7c3f963bc4757a6a6efed1eba12ebd366fd1fd4c09Virustotal results 36.67%Heodo
2020-08-12DOC_S1XMNG6N8R.docdoc c99e3c74dfec6465026a494216c1ac797697cb816f37baa98d571a089dacb73aVirustotal results 32.20%Heodo
2020-08-122Q22ONB9FNUYI.docdoc 4020a8982e70b51b150cd40a837ea5dfceb35f0a6c9f9858b3fae5e00404ae62Virustotal results 30.51%Heodo
2020-08-12CLP_PO_08122020EX.docdoc 632b6d0a99555d9a6319cc5bac55848d67014534e79c08823b2763fdda37679cVirustotal results 30.00%Heodo
2020-08-12BAL_LV8251932692EV.docdoc d9d475ae79ed46f2b566d8683b5d680cced225807e23723845c1ee49efdab247Virustotal results 29.51%Heodo
2020-08-12REP_WT0480037351ZI.docdoc fc15009f0b0f3066546203abf08c3f98e289f63a7791d5de4b94a666e6348483Virustotal results 26.67%Heodo
2020-08-12Q8D4VAC3P7G.docdoc ae3f98c31cbf01b3809feeb57990ae8270686b4e716f2c8971f8408ca1676532Virustotal results 28.33%Heodo
2020-08-12REP_NUN_080120_RNZ_081220.docdoc 18f46635637fbd2308eef45d6dc7077d90f65163e5ab3f991d201c0d8f91587aVirustotal results 26.67%Heodo
2020-08-12Q_S6DJ86701J3E6J3H.docdoc 6b825da15adc2cc05d82bcea3118130263ba2dc1d411e6486cbf37e6d317cc6dVirustotal results 28.81%Heodo
2020-08-12IYO_PO_08122020EX.docdoc deecd2c02ce1300608d772703afe9dda7a49aa3c1a1d59246b476138d6ebe201Virustotal results 28.33%Heodo
2020-08-12EP0OSIQWLH7UBC.docdoc 265373b64df48b69c520486d767efa8c028ec29d4b7cfaba05e0459400ad0b2eVirustotal results 28.33%Heodo
2020-08-12PO_08122020EX.docdoc 397be2c8284f65fd173f3ebb49ce8059a21e4228e1a8f5eefef6772291c8c185Virustotal results 28.07%Heodo
2020-08-12INV_PO_08122020EX.docdoc 9f355154b3f108769ec0855431cb69c5172916d78b07a8d79ff6da2f49371b6aVirustotal results 28.33%Heodo
2020-08-12BAL_CS2760073876GX.docdoc 81c27d10e37bd700d8cee11eba8d01d2bda91b7743083fa7a4e51f3f169ef0c5Virustotal results 28.81%Heodo
2020-08-12REP_39957847.docdoc 1e1197d27bc4e2c81bf36570d41052b3f74d24df43ce0250b2d53d7b2269c20bVirustotal results 29.31%Heodo
2020-08-12FILE_HBR7FXOT6.docdoc 121ffe67a99b7c122a7a9812f00830d7a5e9605d6e18ebd7d84e74f2c22a6670Virustotal results 28.33%Heodo
2020-08-12DOC_2579073897565371.docdoc f5cce6613741a27074dae451858cf61fb0419f2d5ff5d09c8c8e4b85570a4252Virustotal results 53.33%Heodo
2020-08-12REP_16452187.docdoc 9492fa4f34cceef83ff1e6f77bc428777aba7ae617b195a3e6a06d84e5889b1eVirustotal results 51.67%Heodo
2020-08-12BAL_NL0692823264NT.docdoc c978e204a4343d19a9b1df57379618a391455fe0f0fd17e49fcb670670c4241cn/aHeodo
2020-08-12DOC_99824980.docdoc bf23bdfcb1ba099bac9552136a669b228f4fffaa65dd00d243331be54d5ff517n/aHeodo
2020-08-12FILE_PO_08122020EX.docdoc 1d2096f4adcba717670858b98912615f7bc86bd95ef6b3117901aa4ae6383d4dVirustotal results 53.33%Heodo
2020-08-12WND_080120_YDO_081220.docdoc 75e0692474be7d8066516c6ccb1904530d6540d82228ca27d52c6c8c5f806264Virustotal results 52.54%Heodo
2020-08-1273181764.docdoc 455f02233220edb99d4f99f02ec20a5ad8b3a157bacaeae2dcac14f707613869Virustotal results 53.33%Heodo
2020-08-12REP_620705962219645900503.docdoc 8f78d106bc2f3e79349aabe3d812859febc3039e06dced8aa67b29e2421a9d31Virustotal results 54.24%Heodo
2020-08-12O_OG5742672784FZ.docdoc 7575d9ebd2153fdfbf4c1626ec4769e8cdef40ea8e2990670f1cc5cba71a2e7eVirustotal results 51.67%Heodo
2020-08-12BOPD_427748821835877280117398.docdoc 4c3eddd6a41f348b80609e91f83e3a9e22818758105ce3db1de70777baeae682Virustotal results 54.24%Heodo
2020-08-12P1XM993FFWTHV3CR.docdoc 358176ae69d49cbdc29ce5f8965efe9952253949970d9de4e8f09f46c488e6ecVirustotal results 50.85%Heodo
2020-08-12C_U2T69DTLK.docdoc b06fa4a03274712b0d1bea0d2a5d1afc2c71541acb80b1054d31b661b67514ean/aHeodo
2020-08-12PO_08122020EX.docdoc f5e067c9ce4ac6b6dca42fbb099d867e403cc3e6590dbe9d8650b588cbb48637Virustotal results 50.82%Heodo
2020-08-11DOC_CHB_080120_TTR_081220.docdoc 5a95e436c4df9dfb41496c96489d1bddf6db2c7d54ccf0761eb61ef1af9c83a0Virustotal results 50.88%Heodo
2020-08-11FILE_7160047023542180990609376.docdoc 896db11ae3dd47bbbdaef6de2e44964142461c89f1fd377015b96affcc75cf60Virustotal results 50.85%Heodo
2020-08-1153964978.docdoc 6ef92d63f441bea978f148ae6b93fd26d8feb4716042101e28ebacd3101f6eb1Virustotal results 51.67%Heodo
2020-08-11CD3090350141IZ.docdoc 1aac25866333e7f77dc237137353a0a65ce189972d87658229eae96e3037bc68Virustotal results 51.72%Heodo
2020-08-11BAL_SOU7E0LJ5LBD.docdoc 1d09b28a4d454266d52d7d2e5b9aeab2bbf43839ec33c9a7221eafae3c28c067Virustotal results 51.67%Heodo
2020-08-11BAL_TU4184312885TA.docdoc 6c5380e193b725ec3ea512a3146d8c0925c7c489800dad57d1b4b2f940751d22Virustotal results 52.54%Heodo
2020-08-11REP_T72G9CZ3N38G6BS.docdoc ca30b2272a56997f03e6470ff7ef67a05a07abaaa5a436b29c936f7fc34e2dfaVirustotal results 50.82%Heodo
2020-08-11REP_67845847281386647.docdoc b9be58269c46d1dba55d08e51cf5186e5c6669171b0b96d6bf2ca5b7558af124Virustotal results 50.00%Heodo
2020-08-11INV_41955922628.docdoc 597ed34e38d2b0c2313a9d95a421d70af23bd88d60c66de8e04f4127d425c6e3Virustotal results 50.00%Heodo
2020-08-11YNA_6KXYQ2NUX13ES.docdoc 0dc77319f898db1037b996e421c171d0ddbd13166a8b589ab1da97b8bcfc99cdVirustotal results 48.33%Heodo
2020-08-11BAL_21654290.docdoc 8ba6e22d298dc4a7b8722b5e15bfb9f8b4128d0fba504cff7fd4acd55999eba5n/aHeodo
2020-08-11FILE_GKKP3RYP6Z4TENVA.docdoc 8e5f3490181127db4ae19a0c19a2aab3233016bcc64272ec836a68426ed0ae89n/aHeodo
2020-08-11FILE_87267335.docdoc 6c042835d406a08afd589550530dbc4586f9490fb02cf9cf77a0695097190ebcVirustotal results 40.00%Heodo
2020-08-11BAL_3926827336501163937361300.docdoc 8979a7dda1fa732d2164c2ef2e8bb59471cbed0bf320309720b8c18ce4a5f673n/aHeodo
2020-08-11291738939432743330160914.docdoc f288fc67d607003c58bc277bf9c779e8d206ae43259b9cea64be737d4df22a7dVirustotal results 36.07%Heodo
2020-08-11ES1869849924LY.docdoc 34d67996b2581cdd647857f3e3e696b014b5439d13108d5cbc713db42e9089cfn/aHeodo
2020-08-11FILE_01462114.docdoc 91ea8ace7b370d468a6318d2ab0847a1d03897afb3a2d887794d4f35c781f34fn/aHeodo
2020-08-11FILE_ONYXQ5H6S674BV.docdoc 208687883ec482d8ef391621a964345892dc3af09bbb0797af59fb18935df319n/aHeodo
2020-08-11BAL_TTY_080120_UBN_081120.docdoc 5ca1aedbc7b3e63e13e3b3263321e12f1d49d668c331db20a1f996b3fd362894Virustotal results 32.20%Heodo
2020-08-11INV_69899313277.docdoc 3cbbd9298f3b6d77456b687dba10ecf5f45614573ed3be647167c5e96ef16552n/aHeodo
2020-08-11JN2820040191SZ.docdoc 8bfd3587537db9be73cc189509eab9796c40a95566b79753724b36ce7dce7c19n/aHeodo
2020-08-11OTM_PO_08112020EX.docdoc e86b2beb2b36a9530c75a89e078c28b809fca63518cebdcd860f0135e899ae90n/aHeodo
2020-08-11Z_PO_08112020EX.docdoc 2b773fc9f00dc3faefe05dca9697347ab80fb8224235bd96dec05698ea4139f8n/aHeodo
2020-08-11R_PO_08112020EX.docdoc f266dfe6eca386777143d38c655e759b22fba117bcd9138c44354938222c1673Virustotal results 25.00%Heodo
2020-08-11OG4431562671WS.docdoc 1455b3fed34c9f9524557c1681b4ea63f86ce164113c4c2c15bcf5e70d14b251Virustotal results 24.59%Heodo
2020-08-11DJWQ_27495984.docdoc c4c90085f1c458859b18e0503f5505debd672b4ad9c0b13a043b89a9e7bceb72Virustotal results 25.00%Heodo
2020-08-11INV_230592520.docdoc 159adf2257291ab010f4ab9a6518eca15f59b22b9dca9f3d52dee5f9fae80c00Virustotal results 24.59%Heodo
2020-08-11FILE_PO_08112020EX.docdoc 5a8d4ffcfdfbc1a6381d52664660dad53c880513959ca2ab2b0632aea4084347n/aHeodo
2020-08-1105206342.docdoc 7bce19ab2ebbfd54b04f581b9e81b10e82557befdb1b22eb3d0fdabbc8826a5cn/aHeodo
2020-08-11BAL_320089273533395.docdoc 5fd5d52919277328ddc6a266f40c3ad46a8b4196c9fe8f14d7f42252def786a5Virustotal results 22.95%Heodo