URLhaus Database

You are currently viewing the URLhaus database entry for http://avto-baki.ru/6VW/SWIFT/Smallbusiness which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:50276
URL: http://avto-baki.ru/6VW/SWIFT/Smallbusiness
URL Status:Offline
Host: avto-baki.ru
Date added:2018-08-31 13:23:30 UTC
Last online:2018-09-07 12:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-09-07 11:48:44 UTC to abuse{at}best-hoster[dot]ru)
Takedown time:35 minutes Wow (down since 2018-09-07 12:23:53 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-01SWIFT #90473R.docdoc 8e04c42475bc3540925710dd1c71fad658b7cb19b6b2206fb59d0fea9b37cd2aVirustotal results 45.00% Heodo
2018-09-01PAY #123082QULCC.docdoc 4805621eb61cedc4ff2c2790a4fa9d6bef7c698a9206e32c0e909474284c0d88Virustotal results 43.33% Heodo
2018-09-01SWIFT #32162UVJFRH.docdoc 8648c7aceae7b1438d6ddef4e4c3c4daf1b253bd00acc632978ba0c85e2da442n/a Heodo
2018-09-01BIZ #4WDPWEHA.docdoc 0d0b2153394c4b88a90c7af2c8a80c6be6de857e9c50e78be1fc4cdcd6c47f96Virustotal results 31.67% Heodo
2018-08-31PAYROLL #5413771RTALNFD.docdoc c03f6c8f7b1b9f289c628e58c9255679a4a30a9ddbf5e6c3f08e11cf95aa9710Virustotal results 31.15% Heodo
2018-08-31PAYROLL #5ROLBMID.docdoc 7f8aec95699ba129406c6d469a139cfd54ac9c0397276e74ebbcc14d1768053eVirustotal results 29.51% Heodo
2018-08-31PAY #0XLWUI.docdoc d7a27eab6f478b52d25ce3d7da136ca3355a2d767a71a7a38d5cdd207d5b5f37Virustotal results 32.79% Heodo
2018-08-31SEP #631161NQOAVIZ.docdoc ce7bf3f5e2e6d68b3c7d9e0385d2b205e4aa094efdff4aa6305f329ace905e8eVirustotal results 31.15% Heodo
2018-08-31SWIFT #38935TPXV.docdoc 0b2b7e70a13a8d5283d9601562c59e78c624aaa5f461f5362ecd121bc651f28bVirustotal results 32.79% Heodo