URLhaus Database

You are currently viewing the URLhaus database entry for http://betrogroup.com/693858WQ/PAYROLL/Personal which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:54163
URL: http://betrogroup.com/693858WQ/PAYROLL/Personal
URL Status:Offline
Host: betrogroup.com
Date added:2018-09-10 19:21:43 UTC
Last online:2018-09-14 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter:Anonymous
Abuse complaint sent (?): Yes (2018-09-10 19:22:52 UTC to abuse{at}ch-center[dot]com)
Takedown time:3 days, 19 hours, 37 minutes Bad (down since 2018-09-14 15:00:38 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-12SEP #369432LZTVLX.docdoc 1cd647e17b39af655bb2fe1d63ba1284929be47fdd5f1e0735b45f7c4f0257a8Virustotal results 31.15% Heodo
2018-09-12PAYROLL #11EITQS.docdoc 5f19a72d9e9523669e23b9baed8d9cfacf444a4e059c8f2c196d295383ed5d6aVirustotal results 30.00% Heodo
2018-09-12SWIFT #90629WZIZ.docdoc 80484d93a308a4fbfbf92b91ff6604e7e99d6e67f9a237bf8553c56e85431664Virustotal results 31.15% Heodo
2018-09-12BIZ #4765HDOUTMX.docdoc 047a324e6a663a9eb38e4f59f69e48fa52a869fc800fee6641a4dfc09af65db0n/a Heodo
2018-09-12PAYMENT #8232XAFHJYC.docdoc ea8dba08b3a950db78076bf7bcd42dd9410ab5b87a344cf4051c5fb072dac165n/a Heodo
2018-09-12PAYROLL #27AWZRQGVO.docdoc 2ceb81f9c7601592ac7b99888c1c7611f0cb9053aed8a7a9306078f4c1d9fb92n/a Heodo
2018-09-12SEP #870941H.docdoc d4482c6be7b3208e3668f55f40b2207dfe7acd33c26f93e7100757827eafe66fVirustotal results 21.31% Heodo
2018-09-12PAYROLL #72469URMDQH.docdoc a1cbeb26b1fc114888a3bc7bb0f5b20cbfc5176d05cf6f558e64ebd222f7f779Virustotal results 29.51% Heodo
2018-09-12PAYROLL #835004PSPY.docdoc 1858e2a692ef2d989e4cc717bb602057d9fb6d6bf7b65af08260f6a3cb39eff9Virustotal results 30.00% Heodo
2018-09-12BIZ #92BFWPKCWA.docdoc 5b3c3f51194f2dea28d90851907f7b9cd196fd9b6d71947fa887009a78979be3Virustotal results 31.15% Heodo
2018-09-12PAYMENT #485634VCUQDJIN.docdoc e44ad7d54c33963149c77ee31940482540e8ec955cd9077aefdf938ba5c6c933n/a Heodo
2018-09-12BIZ #6285452HYWIZC.docdoc 3de86dfea08f36349a4818c01bacf3c4f6426bff6157088ca95c04c26a4d7c24Virustotal results 26.67% Heodo
2018-09-12BIZ #4JMNO.docdoc a4447d6d2ac0b8948372c72077fe25133ddac2a70ea0e63519fbd2cb2f7f0fd5Virustotal results 27.87% Heodo
2018-09-12BIZ #844KRN.docdoc 6d76d354048e5121dc488c597ef5bb292f63390b161b73dba50f84e3e115dc2cVirustotal results 27.87% Heodo
2018-09-12BIZ #71LKYZBJ.docdoc fb79164ee252899c5a3b973a2c9255e70b8c45b456d97d417e901991b2c502b4Virustotal results 36.07% Heodo
2018-09-12PAY #7393UDLU.docdoc 750de3c0ac403809e9278478546150617ed5df8b852cc22c5600ab9094fb3451Virustotal results 36.07% Heodo
2018-09-11SEP #2885LDBPMUJL.docdoc db960c5df69ed5957af827b49783a74fb6cb13ef84107cd0a594f70cafa4f7dfVirustotal results 37.29% Heodo
2018-09-11SEP #4248KPHBXL.docdoc e6e1960b357c12fa780d82c037575e89d58053582dbdd93d6cfdaed0911200a7Virustotal results 36.67% Heodo
2018-09-11PAYMENT #0405731PFQ.docdoc 09d2774d10a7b1151b6ebc72461c75efa1fe763d058192427fa300a063fb11deVirustotal results 33.33% Heodo
2018-09-11SWIFT #55772WUQNA.docdoc 5586e5cc630f53effe5a62b0dd54a67a55f1a70503c175cfc65b8431abfb44a3Virustotal results 33.33% Heodo
2018-09-11BIZ #0SYZ.docdoc f2981e2e8ca965281a702f4a8f0470a06fd7e48f816c519d411f6d7af5392520Virustotal results 29.51% Heodo
2018-09-11SWIFT #4VPQOQS.docdoc 97386dc0f1e12dd77272154eedeea6057876513296307a3956b00d079eaef348Virustotal results 29.51% Heodo
2018-09-11PAYROLL #2XVKPYKJK.docdoc 3374d863e7f6de3611ff4aadaecacdc54784571f27631b87f7fdd9e9f8b39237Virustotal results 26.23% Heodo
2018-09-11PAYMENT #7565SUJ.docdoc 20dc9bef3d5831a71cc98aebcd3b84ae259a5a9b882a7fb7ae41567777eb1cb3Virustotal results 29.51% Heodo
2018-09-11PAY #7J.docdoc 3b213349974a6994adca2d0d0fba15a9cf07adf7a3b3529601ca62d6031ec53aVirustotal results 29.51% Heodo
2018-09-11PAYROLL #888840RGY.docdoc 3961b3338513540d2fcb2c01219f0d5f4ad44970a7d72244889684bdf5ba3ec6Virustotal results 27.87% Heodo
2018-09-11PAYROLL #41ZBIHJRLV.docdoc a82503fe73aecaa8c2f84941ceb921a4d7b75287b4f7ec77efe63c3464d10154Virustotal results 28.33% Heodo
2018-09-11PAYMENT #2273405MGJ.docdoc 49158022825cd7518187ba183ff5bacc26dc02b16ba05bc4f66f8483ec569562Virustotal results 26.67% Heodo
2018-09-11PAYROLL #35LZH.docdoc 30204787f9f4b5d37ea3dfe47dd19805c6e5ac33181080f8bedc7edbeb533468Virustotal results 26.23% Heodo
2018-09-11BIZ #59JUB.docdoc cce551a1627b7b0d44ff403916072aeeda0afc439a0b82aea18d414c34d26628n/a Heodo
2018-09-11SWIFT #1042LD.docdoc eed14bc5002147fd5197466ebb78a42e1756035ea183327b304cee5260ca72b8Virustotal results 34.43% Heodo
2018-09-11PAYMENT #014Z.docdoc fe1c08b96166e935591c7e99b392ac29376a138799099947437f3d1093d8251fVirustotal results 29.51% Heodo
2018-09-10PAYROLL #3JQVPN.docdoc ba917de8d93cc1382402957efc70226388f956b22cfe3ea0d7d990439bfc0115Virustotal results 29.51% Heodo
2018-09-10BIZ #9276WJZHICFM.docdoc b730fbccc33bb6ab4ba9c2b83e6f37aca024bb69d537a7376e64df6f50cdf105Virustotal results 33.33% Heodo