URLhaus Database

You are currently viewing the URLhaus database entry for http://citymobile.rs/cgi-bin/U70FSQDW1KRV8/of8ly2194546513894917217rphxobue/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:438306
URL: http://citymobile.rs/cgi-bin/U70FSQDW1KRV8/of8ly2194546513894917217rphxobue/
URL Status:Offline
Host: citymobile.rs
Date added:2020-08-21 15:21:10 UTC
Last online:2020-12-22 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: spamhaus
Abuse complaint sent (?): Yes (2020-08-21 15:22:02 UTC to abuse{at}ninet[dot]rs)
Takedown time:4 months, 3 days, 0 hours, 25 minutes Bad (down since 2020-12-22 15:47:13 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-22REP_C4YT4OH1YJ0GK.docdoc 493fbab43b8eaf0772394866842fa9474e8e54a84894498828af06590dff1cbdVirustotal results 55.17%Heodo
2020-08-22DOC_PO_08232020EX.docdoc f8cac8302d04c68ac098a7199dad00350e89aea96d6c7bd016056461d9c49909Virustotal results 56.14%Heodo
2020-08-22INV_AW8883680768ZT.docdoc 3655cdb051d4e200642ff9c6d6771c865cf10cf779c5253707a6c1939ff9967fVirustotal results 48.28%Heodo
2020-08-22K_7688657041224.docdoc a2a5add4aafd25f28fa4f3358425c1d6fbfa78d7026ee5d990d1f940be9a6b5eVirustotal results 55.93%Heodo
2020-08-22MM0RDJNRK0FXZZ.docdoc 6c3fb369276b844233faf8e281f76433edfc72cf4474e44876f1d5869e35e533n/aHeodo
2020-08-22BAL_8STJDVNS7.docdoc 875e8c26386ff1c0c8b3678d2bb054d0883fa0eea3868af7f150390cb0ba6577n/aHeodo
2020-08-22IS1664649163CC.docdoc d22cd591ca782f3baf0951d51ef1240685529fa34c5600b9fd14b3a9f81a6ff4Virustotal results 49.15%Heodo
2020-08-22847880824988919798941124.docdoc 64ff3957fa2821e1e54fc9ae7986204b361b0ab5cea01e45f4582b9b61318de8Virustotal results 56.90%Heodo
2020-08-22INV_05888890.docdoc ce2ba046f2b155fbca1c5575fe23db9241abaf2913732ab6989ad8e3a06aa444Virustotal results 55.17%Heodo
2020-08-22FILE_0013688803696010466036.docdoc 17a8abcd3a0ca286f3322bc0211554283f14c8d538bbc1cac2fa2ffd07dd10bcVirustotal results 45.76%Heodo
2020-08-22ZAI_080120_LZP_082220.docdoc 6c1c592a721270eee147407ae5433ab9874fc959d3a587c9b711accf6804bd1dn/aHeodo
2020-08-22BAL_PO_08222020EX.docdoc b8a94a9f62b6775a1344c2264595791ae3ea587929c28341e9423c9dea41c9c9Virustotal results 51.79%Heodo
2020-08-22INV_781629045574047803046.docdoc 69e8dd6df38ec2bdea7faaa0d97904804da845aebf646226f142eedb586b32een/aHeodo
2020-08-22BAL_YAE_080120_PMP_082220.docdoc 2fd9392aa58c13ecda286bf33882e5a6ebd07633a6ab746f9f1b8c573f42a129Virustotal results 49.12%Heodo
2020-08-22FILE_67B8FPENO2DMESR.docdoc 4b720b443bc4f87a12c3b958c84fa9bdc6753a6d0772e79e7068c9bfef8ecefan/aHeodo
2020-08-22MVH_080120_EZH_082220.docdoc 09a8b2355f1be6dde0ecc28e349a88dbfcdec61e7936a2ee93480e76b4b82ef8Virustotal results 47.37%Heodo
2020-08-22DOC_EXG_080120_ESI_082220.docdoc 5a8c3ebf749c6f220acb0540ed11bbfc458ffff16839e005442f07fdeb004137n/aHeodo
2020-08-22DOC_PO_08222020EX.docdoc b827ea89c0285f491b5d81e3db08938e1c2c1bca8c6187af15debc415b8ee65dVirustotal results 48.28%Heodo
2020-08-22FILE_HHZ_080120_NWF_082220.docdoc 26d555ec74a58483c8bd0c5d4a286d2662776ba3feca6137b85501568e4290a3Virustotal results 45.61%Heodo
2020-08-22DOC_YS4262761482CF.docdoc 7bb46eb08bf229fb87bf187ddd62783334d74d2e386b5c400a6a4c42b8212b9bVirustotal results 45.45%Heodo
2020-08-22BAL_VLC_080120_GEV_082220.docdoc a36791162048762c26483d90f500a367da81672c29e9de5d6d524e75585f0b8aVirustotal results 56.90%Heodo
2020-08-22FILE_200120254068626.docdoc 76a3bda4d7ee27c2c82f872da4722630cc3859af9483e315d4153d877784e308Virustotal results 50.00%Heodo
2020-08-22T_HK7121408932OB.docdoc 04ed313f0c28c0f07e054a223bcce3991932e313f7c233013dcd6e2f945f9f80n/aHeodo
2020-08-22RNA_080120_BUT_082220.docdoc f3a1bc1f284c6c53cf1fef5d8cfc0390aad8e8f402954af78d14ba16a6ca0e70Virustotal results 52.54%Heodo
2020-08-22REP_PO_08222020EX.docdoc e7eb9296ed7a22e6ad9048ec60ff569cb899440fc4ed72cca7e3a1e166f6aebdVirustotal results 50.00%Heodo
2020-08-22REP_TKE_080120_ZMT_082220.docdoc 488a7d54aec0b6c22f19347c7fc08db9587d95ab9d8d0b98e7c527e1d74654cfVirustotal results 51.72%Heodo
2020-08-227843869893958001934403.docdoc 7d22157e23163b7a45402a9a9b230b23bc2d5f5249335ca9ff4f9577a965715eVirustotal results 36.21%Heodo
2020-08-22PO_08222020EX.docdoc de8da644f768598c0f022a5398be71b4532ddabaee7035c96b697e37b6e706a5Virustotal results 33.93%Heodo
2020-08-22INV_PO_08222020EX.docdoc 81533cd3de83433dea8b8b9963a768102671597ede52ccf8f0a04d7eafd3ab5bVirustotal results 36.21%Heodo
2020-08-22DEJH_SXZ58PAMCXXSOQ.docdoc 2352834aada622f4460b9dd3393af149de11975edbdb35d4c20f4917959a8526Virustotal results 37.93%Heodo
2020-08-22INV_9642187959563419.docdoc 821e25913d73972a01a1db32a8504153128d8b4856fb812dd3ede84e3afc18f6Virustotal results 36.21%Heodo
2020-08-22UVR_080120_PQS_082220.docdoc 6a9cb9033ebcf0e513947cface83d763d935d1fe8fe4b8a3ed36acdd88d92371Virustotal results 33.90%Heodo
2020-08-22INV_33338606062.docdoc 55f959cd44c12cc0010b087a01a71632af4e1b07f2d7e53f351e03ec8dd0b28aVirustotal results 33.90%Heodo
2020-08-22BAL_21873932.docdoc 185629559fc8144ebc604bdb282f488286168205d6797eebb448ee7440c20edeVirustotal results 30.91%Heodo
2020-08-22DOC_NTC_080120_PNK_082220.docdoc 02673d69c148c0f8b3a70c07d8ab42ef299cffc98186d037c1eba5949eded2b4Virustotal results 32.73%Heodo
2020-08-2242305463.docdoc 860c5f447f202c55885fc12b01dae4464cb7a2813113a03099954d6e2487f437Virustotal results 32.14%Heodo
2020-08-22DOC_94734793.docdoc 17c529f8042665bc986093547d9f8281d9684aae9d35e8774f30bee09148b53fVirustotal results 33.33%Heodo
2020-08-22WJH_080120_DNN_082220.docdoc 223f9d553cde32a1d85c024ab5bf112893a5d55e9595f0cfab8bc6219e3e447bVirustotal results 32.76%Heodo
2020-08-22INV_55672555.docdoc 93b634aee9aad2befb33b7fd725cd8f468013a1949dfdae190ccd84456d328d0Virustotal results 36.84%Heodo
2020-08-22REP_FQ3551649009AY.docdoc a1e87d01c65493326225304620046734277bb14220533083a514de1693fc43a5Virustotal results 32.76%Heodo
2020-08-228730594474764153515556.docdoc 096a3542fef0f482f624aefb72a07ce378c1b5618b69a2067567a88f09b01190Virustotal results 34.48%Heodo
2020-08-22Y_PO_08222020EX.docdoc 70ac24d401d9e9e234080bee44b24b274e7a2356994d1acc91678f6f52fd1937Virustotal results 35.59%Heodo
2020-08-22E_UP8377228340BH.docdoc f91300fa52a19f297115dd8c84a2b9f1083fe608123fe8dd26d1e391f13b29d7Virustotal results 35.09%Heodo
2020-08-22REP_PO_08222020EX.docdoc 9508b83011bb52c9467d4b51400097d529a11929bf5418d164198ce20383d873Virustotal results 34.48%Heodo
2020-08-22M3IF9Z8HAR.docdoc d1e99293df55be2d080e73031e5d44ddf0904fe9575b76f79cb6026a49dae176Virustotal results 37.93%Heodo
2020-08-22DOC_ZJ7757084585FV.docdoc 94904301a0794ca20357c8ba3c059df10179b43afe4828ac94683dfca014d6f7Virustotal results 32.20%Heodo
2020-08-22DOC_75620132.docdoc 6de50b6129796c4fa1231ce261dadabd610d00711194503150cf45355edec9eeVirustotal results 33.33%Heodo
2020-08-22INV_MRA_080120_YCF_082220.docdoc 0759e5c471a2092742d96de880d1e5b939fa7fc1bbd839fc5a6f40c79067c24cVirustotal results 32.76%Heodo
2020-08-22DOC_PO_08222020EX.docdoc 845169ecadd97b50576fed0fca204646844a511794662c22fdce0cadc58219b4Virustotal results 32.76%Heodo
2020-08-21599870186.docdoc a6679eb46ce9ffb28041319f4f1f5d9ec789b87a8ee7d4e8a35d1971f7d02e58Virustotal results 32.14%Heodo
2020-08-21PO_08222020EX.docdoc 04d877632142f79b8bad4d3e25dc07870f8c31c719b9214b22321b21566874ddn/aHeodo
2020-08-21DOC_5782882115253789118.docdoc e13da1516e2f63a731df6ef27cf254ffe39dfebf1dfdb23489fe0d0e15376e01n/aHeodo
2020-08-2100280548.docdoc 89415d58550d6a2793ed4804dc7752b3eb54a8e12ab8c02556131b5f4b0d8decn/aHeodo
2020-08-21REP_MX6734675041JK.docdoc fdc4dfb08fe4e5b448b179f635819a8009630b36cf45650fd6729e7c941e77edn/aHeodo
2020-08-21H_IGY_080120_MFX_082220.docdoc 63e8e5f134319a61ee0ea021511f79a597ad651a1712ff703902454157100d1cn/aHeodo
2020-08-21BAL_10297165.docdoc e0b9952435a1e6f33cea8d02f0c567833c748d540f40c5b57c4d056b8fe44c8en/aHeodo
2020-08-21CVK_BSN_080120_IKJ_082220.docdoc 656cc3eb3438badf2ad21a9aa6c6a7b35ef4279cc9469344dabb0878569757b3n/aHeodo
2020-08-21INV_46376168.docdoc 6323c7b4ec8783e51f631813adf56905ab2c875fd1c8f94f58f7b2f98ed037f7n/aHeodo
2020-08-21REP_PO_08222020EX.docdoc 7bce0d97de6cec75813a540c08e2d525272f48d346ed73c9c776125fbe166cb4n/aHeodo
2020-08-21Z_UU5721145328ZR.docdoc b5d0c13fb0ba646923359186d348a87774ef6f8e757c1f87890b025123586fa2n/aHeodo
2020-08-21INV_WDQ_080120_QTO_082120.docdoc 1022e8758c9c8dfd250c7ba0b11aab2f91e2f1a695616c8cebf548ba5c75fad5n/aHeodo
2020-08-2191431517.docdoc 2b73fad779d9e34d297483eed819e3e2c6e4ad911c2c04c47129070f0f790076n/aHeodo
2020-08-21FILE_PO_08212020EX.docdoc 4515983abea28fd6da7bd8991a47916f0a226647eae1305d1aa554af62144d8cn/aHeodo
2020-08-21FILE_PO_08212020EX.docdoc 111fb0943ff426b2e56e72084f508d1dcb4e497894c5860fee15785c67a38bd2n/aHeodo
2020-08-21BAL_126849478732080817.docdoc a7da93abb18c18072efe59aaa0c6479e8c85e09c61336c1684a118219facfafdn/aHeodo
2020-08-21N_KR2375561225VE.docdoc 77460cc133315ccdfbdaf1546ce45acc79abed14bb832947ca2dd33c1425dd49Virustotal results 27.59%Heodo
2020-08-21REP_5VDK9GE0FKH60.docdoc c8ec1a9b7d385d96166c22f142d0437768d0db460b1cbfcc53cd796bb0662569n/aHeodo
2020-08-21INV_YSR_080120_ZPE_082120.docdoc 33da171c98a915b6b46ee6b15f06b10f57557c479fe659f138921a4578264ab1n/aHeodo