URLhaus Database

You are currently viewing the URLhaus database entry for http://zgtaiji.com/uc_client/Overview/nremd5ngcxh0/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:610534
URL: http://zgtaiji.com/uc_client/Overview/nremd5ngcxh0/
URL Status:Offline
Host: zgtaiji.com
Date added:2020-09-24 19:06:12 UTC
Last online:2020-10-01 07:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-09-24 19:08:12 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com)
Takedown time:6 days, 12 hours, 46 minutes Bad (down since 2020-10-01 07:54:37 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-09-25DOC_UGZ_090120_DFZ_092520.docdoc 8a73bdca97395b9f659104c200734008fe685faff6734fc31ce0cd575090f1b2Virustotal results 35.48%Heodo
2020-09-25DOC_SA8653534631CM.docdoc 870bc543d566751893f393fcf0c7abd3bceadb183ce2f7384e8922bb56a5bbb9n/a Heodo
2020-09-25REP_27185973.docdoc 8737044355a98a9ffd49ece5bcd55b760fdd2e63b8b6b02d15028deb9d28ed36Virustotal results 24.59% Heodo
2020-09-25INV_KIK_090120_YXX_092520.docdoc af8ff28fb4ea041b8cbe3e93a2c9984e483b0fbda6945bc0172d0946d5c1cb7dVirustotal results 22.58% Heodo
2020-09-25BS35ARF74TCFF.docdoc 802f04236dcc8416e167f809dda60e5623b54d39bd04e74dd1f1db148afca2d3n/aHeodo
2020-09-25REP_SFZ8T9AGD.docdoc eefd694ad7a3c1d10441452c651459410143b5ce0d56e19d39c16c1114105d09n/a Heodo
2020-09-24INV_CA4640289055WD.docdoc d4aeeadcea8487c5cde690583d8fb442c9334208e54fd53d3714e0ec9bf0da91Virustotal results 31.15%Heodo
2020-09-24Q_PO_09252020EX.docdoc cdd71002bc856432c4601d28ab82f21a59cc5dfd779119a556b6e353a3a9f5efn/aHeodo
2020-09-24FPYBV4IREMHQ.docdoc 7b6806b4e83dde2a32e4d3f04439478a2a28eff8c723179a141152aa89c0c8fcn/aHeodo
2020-09-24INV_88050415.docdoc 46996b6a7e3fb5f718730ed86bbfa6e57792d961db1bd60352e17703af38134eVirustotal results 29.03%Heodo
2020-09-2405594553.docdoc dcd26d0a6efa5d5e5d222fb2514b682c86ffb540ef7defc9f034278cc7857adan/aHeodo
2020-09-24INV_HDG_090120_GGG_092520.docdoc c4fc9ec7954c1bc71dc415464f2813e6151dd7c106526dfe3aa8d97ec3b8f9deVirustotal results 32.26%Heodo
2020-09-24FILE_GENYMX88IJ8.docdoc ff6440d9c01fb2fc8526c683c418271051ec21b1b730972f02ab6442bb0f83afn/aHeodo
2020-09-24FILE_XX3078841797EL.docdoc 2a3395e9459dc5f0fc72621c2299e98b4226e6b99cf6069d89004e3d430a219dVirustotal results 29.03%Heodo
2020-09-24BAL_73093460.docdoc 715f9dc1efa5fca591ca9ec3b12ea2cbfb023fdeb8f0964988c191a7be6166c8Virustotal results 29.51%Heodo
2020-09-24REP_S14S9FSM8.docdoc 0d6de09715c2540ddecff9f789615db1ea094b991d2a6417c3c086eb6e77e609n/aHeodo
2020-09-24REP_32481930.docdoc 49cb977b6bc82a34e7733da5b4a34862f85b5afd2c8a0691c79d9e2b86dca29en/aHeodo
2020-09-24O_KJE_090120_HUB_092420.docdoc 85c3fbc17a0daacdb938f7ea4b8dfa14ae9a099d59de1e9fef807b569c999acbVirustotal results 19.35%Heodo
2020-09-24DOC_OT0328215617JS.docdoc f558184120407b98a2f1473322ca913b07ff58cd20d06ae924a355e11821dc9bVirustotal results 29.03%Heodo
2020-09-24INV_KK1575601628HR.docdoc 35ef0a522e2f7f98db76cd53d203d6389d65b2c0337b598482f1ca0fcfe5953dn/aHeodo
2020-09-24PO_09242020EX.docdoc f6f1cf12aa5337999c20c4cfd641254575e981ad7c463944cfe676ec92a23165n/aHeodo