URLhaus Database

You are currently viewing the URLhaus database entry for http://egomall.net/4YM/WIRE/Personal which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:55069
URL: http://egomall.net/4YM/WIRE/Personal
URL Status:Offline
Host: egomall.net
Date added:2018-09-11 18:39:41 UTC
Last online:2018-11-19 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: unixronin
Abuse complaint sent (?): Yes (2018-10-11 11:03:49 UTC to ipas{at}cnnic[dot]cn)
Takedown time:1 month, 9 days, 3 hours, 59 minutes Bad (down since 2018-11-19 15:03:17 UTC)
Tags:doc emotet link heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-09-12PAYROLL #58BJD.docdoc 9dcfac123de75bcfc9f7c7583b6592522dbc3f8cf4a09cd0f29708255ec19e47Virustotal results 31.15% Heodo
2018-09-12SWIFT #27596KGFYUJ.docdoc eabb02e2198c7641bf9d3f8c1e1a467f5a7c55cfd6516f39078a2528083daefaVirustotal results 31.15% Heodo
2018-09-12SEP #9960Z.docdoc 9bf0d95cb5f73ff4945a61379a9d058f520376aacd4eae89d82165c1e67c35c9Virustotal results 26.32% Heodo
2018-09-12BIZ #4FPLC.docdoc 907aeb750eb680cb57c7e93fdb76af114de2bcd12fb4ea47af5e76e755f832c9n/a Heodo
2018-09-12SEP #15MTJE.docdoc ea8dba08b3a950db78076bf7bcd42dd9410ab5b87a344cf4051c5fb072dac165n/a Heodo
2018-09-12PAYMENT #0033445K.docdoc 2ceb81f9c7601592ac7b99888c1c7611f0cb9053aed8a7a9306078f4c1d9fb92n/a Heodo
2018-09-12SWIFT #410626XQBWLQXK.docdoc d4482c6be7b3208e3668f55f40b2207dfe7acd33c26f93e7100757827eafe66fVirustotal results 21.31% Heodo
2018-09-12PAY #6LIMBAVCF.docdoc 874c4105a4609af1cac382c4f8b299da6c1628871ec0f3e80f48cc6962dae534Virustotal results 21.31% Heodo
2018-09-12PAY #61355VYAKDXZ.docdoc 0d05e6c0df71189a5a6399281af155418a24fb20d7cb857799795db44f73eba1Virustotal results 27.87% Heodo
2018-09-12SEP #995LFZ.docdoc 834d2c131a08577c53405dfccfa2f79d14cc1423a2ca55eb708c7e7876bd0872Virustotal results 28.33% Heodo
2018-09-12SWIFT #396RMXH.docdoc fb79164ee252899c5a3b973a2c9255e70b8c45b456d97d417e901991b2c502b4n/a Heodo
2018-09-11PAY #8150757LIJDT.docdoc b9a1fd3df1308972767d89dddad29a4248f90634c32dcabcf61e89f4ef9cb8f8n/a Heodo
2018-09-11PAY #66PQ.docdoc 006604c0a36b0b1dc90e7ee590e095b22ff04e92d2960baec7f65d00c402f7adVirustotal results 32.79% Heodo
2018-09-11BIZ #0009BQPKQAZD.docdoc 0c9eb04883f16b5aaef9c5ccf6f5f228cad669b4e72bec003a85e2c4d31d8d4bn/a Heodo