URLhaus Database

You are currently viewing the URLhaus database entry for https://yinyangmedi.ch/logs/57643393754168/faaVV/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:445362
URL: https://yinyangmedi.ch/logs/57643393754168/faaVV/
URL Status:Offline
Host: yinyangmedi.ch
Date added:2020-08-27 18:20:21 UTC
Last online:2020-08-28 06:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-08-27 18:22:08 UTC to abuse{at}hostpoint[dot]ch)
Takedown time:12 hours, 16 minutes Good (down since 2020-08-28 06:38:10 UTC)
Tags:doc emotet link epoch3 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-08-289976014319QC.docdoc 7e0d6fc8bc7a69d5e27e2130c83b434512af52a5337145098c2426f62abf97eeVirustotal results 33.33%Heodo
2020-08-27invoice.docdoc b1f8d82d19d6020ac3606afc8e0699ddde66a03ce07d5d7f6b6bc45a238084f2Virustotal results 35.09%Heodo
2020-08-27Inv_525647.docdoc 474fe5a4009da897047f91b9d9b8f40aaa5d674955f0815934507029c7038976Virustotal results 33.90%Heodo
2020-08-27form.docdoc 907ddcc7b2dd5151f379c7897b9de25bfcf3e3f5a8a58043b3339a540ee5ab76Virustotal results 32.20%Heodo
2020-08-27INV_725615.docdoc 6404e3e703da64c594a45e59e02f1ebd13380fdfb4462b7f6086317f46432f3dn/aHeodo
2020-08-27invoices 0795 & 32261.docdoc 5eb93964840290b1a5e35577b2e7ed1c0f212ef275113d5ecdb4a85c127ae57aVirustotal results 31.58%Heodo
2020-08-27invoice.docdoc da24bcf9ae9edfa1f1b02f6edee01e2ccc3b37220462cafa4f4771b3309bccd2Virustotal results 32.20%Heodo
2020-08-27PO# 08282020.docdoc 249258e389c57dae809f34520051324f678dda2c946e37189377ac5ee3a7c8f2Virustotal results 32.76%Heodo
2020-08-27Copy invoice #418599.docdoc c87ff4601214eab29d1318e621dac4a0ae69e9f3ec301f4126b4dfff0a947572Virustotal results 32.20%Heodo
2020-08-27Form.docdoc 5bf845e70cde6a5112d1aec081e98995bc8494ce31682762bad07ec7c92a2889n/aHeodo
2020-08-27invoices 713 & 36725.docdoc 2d49046fc064b91ca9ac6b885536752ac075d5f370afc9d43148a0d79c4cfa51Virustotal results 32.76%Heodo
2020-08-27invoice.docdoc 7b6888dbb025af550f9a973dc79ee2a0ec62237cb93a5e504b18761976eac998n/aHeodo
2020-08-27INV_7172.docdoc c2c840c18a5cd6eb5a60c30afe7695b1068bd8ebf0e5fbd5c6a166f9c15767c4Virustotal results 35.00%Heodo
2020-08-27Form.docdoc 8974b88d7ce674207d02e5c3dbefe723b7284f76bc41295fe5c6f7504ce06b06n/aHeodo