URLhaus Database

You are currently viewing the URLhaus database entry for https://qinzilong.com/plugins/WKTyiU/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:431497
URL: https://qinzilong.com/plugins/WKTyiU/
URL Status:Offline
Host: qinzilong.com
Date added:2020-08-13 03:36:44 UTC
Last online:2020-08-14 02:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-13 03:38:03 UTC to abuse-noc{at}west[dot]cn)
Takedown time:22 hours, 50 minutes Good (down since 2020-08-14 02:28:15 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-14invoice-OH14-612191.docdoc 0b134d91d537beab9f4e700b126eb1b43b69c80126818592cef4697fce08263bVirustotal results 37.70%Heodo
2020-08-14invoice_8143_989471204.docdoc 4398bc31070f761b318b30f297d363b006ed9e84c6af0aa45ad140f57e7c1529Virustotal results 37.29%Heodo
2020-08-14Inv KZHT7139 10131708.docdoc e8516c23d1aec8faadd52ae68fd240339940d05f4a1db7c56afdbec1eb5de0f6Virustotal results 37.70%Heodo
2020-08-13INVOICE60658296994.docdoc 3c2103ec1e6af0ce039524d58d70a4ced5e2845549def894d03f836978afa09dVirustotal results 38.98%Heodo
2020-08-13Invoice825206138.docdoc 3eb6b088630e12b4b89f3af4f5b1366626605adddd5d7d447d1b4b8246d305bcVirustotal results 36.67%Heodo
2020-08-13Inv-Z0826-1997643.docdoc 88d310c1de24f5a780b5269aeff8f47a6715c4fcc531df6ad2e8b2fce834773bVirustotal results 35.00%Heodo
2020-08-13INVOICE OV3 8531769.docdoc ff68f4adbb2d5f421b94ec8c2ca343c8dc807544237928a2617bb4c1dd32b7b8Virustotal results 36.67%Heodo
2020-08-13Inv-U320-6160919.docdoc 653065e50db8318e4c980f45418849681df513e216b29c07cc7036442b0f9cfeVirustotal results 36.07%Heodo
2020-08-13INVOICE OEH740 055074344.docdoc 5afd28f4c27929a5271720ade77b26422b7596600473f76d9aca778869203bacVirustotal results 36.21%Heodo
2020-08-13INVOICE_NWS129_91575046.docdoc 5068ac1fc3ea1af3eb637bed169df3a72f14ab7db56ff2996f718fbe8c05642eVirustotal results 36.67%Heodo
2020-08-13invoice_IFN851_555281205.docdoc 3423e50e3ca9d294abb9a295ac2ca4d7c44b5ff0e9642bf553ac9b6a5f44968aVirustotal results 35.59%Heodo
2020-08-13Inv O44 39977245.docdoc bb480394e0201866ae43a5b60c1ec371e3dd37a01e922a8dd5ff68d8cb325f3eVirustotal results 38.33%Heodo
2020-08-13Invoice-33-020851.docdoc ecab54e301b452142ecc261b2329b5603222fdd66c4785aaee3b0a1e54373879Virustotal results 33.33%Heodo
2020-08-13InvoiceEC7064968003.docdoc 9c555a84e2b325b4c2d60e9dba477c087791380312f4c5c664d3ab4f1c47ab86Virustotal results 31.67%Heodo
2020-08-13InvSMDY53343935.docdoc 88face3f5c64a159d93d81009170415aa7ef5b594d942b26c795d458d5a4dfd9Virustotal results 32.20%Heodo
2020-08-13InvVWTE4253387731.docdoc 7abb5b30def6039173391b3e77f2a498a9ac16f3e7fa6312e9991d2d8c4e39e4Virustotal results 30.65%Heodo
2020-08-13Invoice-DDL8-4889215.docdoc 286f7949f545a67074545aa0830816a560a993143774c4468d041d5e656d2897Virustotal results 28.33%Heodo
2020-08-13Invoice-HVB0583-6433808.docdoc 4bd0be911a687ec4b5a5cbb2e2fefd2756af0764a5360ecdb90bbde1dbd3dfd2Virustotal results 29.51%Heodo
2020-08-13Inv_KTEW47_8356200.docdoc 52c981dcee0a9c0bc80ec192b453e8af6b01ced6cb3187645687ad0fd1b13221Virustotal results 27.87%Heodo
2020-08-13Inv BVFX726 780199428.docdoc 06166b3489e6b1ba8b3b7abbedf9fa72a55fc82e560c856df36cc781c2470e4bVirustotal results 26.67%Heodo
2020-08-13Invoice_ADWL4_6828063.docdoc eeb469414b6509fdd0d204f306b29d55021e2de94608991794b5f59c2add1e07Virustotal results 26.67%Heodo
2020-08-13Invoice-UHZ9-549109.docdoc 3a957d2e54e658d116c346dcaf0dab5ecaec5e60bf7125b32087746f27cbe35fVirustotal results 26.67%Heodo
2020-08-13Invoice3459613518.docdoc 267245def36dc107de0213044013ec67b837c68ed109267f13728319263b5664Virustotal results 25.00%Heodo
2020-08-13invoice-WU560-13135195.docdoc 86c0cc8d6327a374689e50a0d8bc139919ce31d297cce113a4e93bd78b8cd8a0Virustotal results 26.67%Heodo
2020-08-13invoiceKY51087120.docdoc 145265d9d2f1701a20adb03e85675a152789121b8d2e7c8514a5794603cac08fVirustotal results 26.23%Heodo
2020-08-13InvoiceQBB19242214485.docdoc d22eb2573f777153ddd035f4b8ba8b83c452f150ee71bb9e2dc95a0036794c46Virustotal results 25.86%Heodo
2020-08-13invoice_GJLD70_748502807.docdoc 8d3707b8799040b4d0ae3452f01c096d3658cb6636834e49f602c9f745ccd6edVirustotal results 26.92%Heodo
2020-08-13INVOICE-YDH58-6378519.docdoc f844331d28cf2533981a9e753d6df2e9677efadaeea9b2c014266991ae78280fVirustotal results 26.23%Heodo
2020-08-13invoice_RZ026_07321880.docdoc ef4bd4002ad40e14d4be0e1b65b772318b986c643bf1704805b738350cdf8747Virustotal results 25.00%Heodo
2020-08-13Inv VEN0984 8104693.docdoc 7b6f86d6898258e9a8a5a572e055f9efc0d045b78fc6eb88c0d2f61f064629f2Virustotal results 25.00%Heodo
2020-08-13invoice-I517-52956959.docdoc cc8c1667a1b992293217c0bb3a7bd8be2cb3d4f83bdaa7746fdb6b36992bfa5bVirustotal results 25.00%Heodo
2020-08-13Invoice_V3426_27996599.docdoc 46b21be022edbd1e3c421e00b0f0fb17b33ff686feb8309c819c817da38d7fe6Virustotal results 53.33%Heodo
2020-08-13Inv_D8813_7722761.docdoc 10531f315432369a9c0706bc00ac1405445316044a9ec07b03de6606a6a9f9fbVirustotal results 55.00%Heodo
2020-08-13Invoice-JC87-477306351.docdoc cd0aaf460944efd580dcc39bc1dd0460f88f2c3c17e303694ffa1eae5020eab2Virustotal results 53.33%Heodo
2020-08-13Invoice QJ425 09804221.docdoc fddf4cab73e6e2ff5c40c7fee09d52d5eb903e6bd17ad77aa292c6ded707f394Virustotal results 55.00%Heodo
2020-08-13Invoice UB7574 864799941.docdoc bd379f0e0dcc9c8c75d70a99df9f95dc56d70fd92cbf446a21dcb7b22ded59f9n/aHeodo