URLhaus Database

You are currently viewing the URLhaus database entry for http://els-desnogorsk.ru/blogs/invoice/cr627t5/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:703895
URL: http://els-desnogorsk.ru/blogs/invoice/cr627t5/
URL Status:Offline
Host: els-desnogorsk.ru
Date added:2020-10-16 20:42:04 UTC
Last online:2020-10-17 03:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-16 20:44:03 UTC to abuse-c{at}hostland[dot]ru)
Takedown time:6 hours, 43 minutes Good (down since 2020-10-17 03:27:43 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-17XQ2LCOT1J1CBCVXS.docdoc d19c1e922354570a8700f8dc25900a7c8ae4bee4b08908a4c6cad2309eff1ba1Virustotal results 51.61%Heodo
2020-10-17E_44437893.docdoc 61cf4ff84de3e35dd24e8df00464aa832912b8c378cbffc5da91abc576c809fdn/aHeodo
2020-10-17DOC_PO_10172020EX.docdoc 19b133b4ad7b5c3072ca746a89f06864d39ca4c8985ddfb2eeadd125ff5cd7a7Virustotal results 53.23%Heodo
2020-10-17VPU_100120_ZQU_101720.docdoc eb06448eea7b0d73132945671275ea572688e13de195a89974d8315900ff8cb7Virustotal results 52.46%Heodo
2020-10-17PO_10172020EX.docdoc af4011781c0a2add45a6f72b8d52e5bd7d7381ff28c93e478dede0ff100ff237n/aHeodo
2020-10-17ZKC_PO_10172020EX.docdoc 72bc6543f22de398e1374caed638e9a1d24ec0b37a5fa9b5ac10ade7559ab839Virustotal results 50.00%Heodo
2020-10-17INV_22280268.docdoc 1f9fcb8ad3585c6cbf7250308fc58ebd7fd913baf350cbd3d7fd8934c9e33e43n/aHeodo
2020-10-16PO_10172020EX.docdoc 3772d83153c2d54a8a3dd72055370d3db69948bf4eafeb69018ce518c7801d05Virustotal results 50.00%Heodo
2020-10-16BAL_PO_10172020EX.docdoc 53467ef76cb2d0f4cc9404439089220dd6d34680c167f2f062307713724ee9bbVirustotal results 50.00%Heodo
2020-10-16I_QRJ30SH1HZQDTP.docdoc bf79372e0c3a2b7a3b0df0f3994621206443404f5c382b8ad5e5c609c6b0e043Virustotal results 50.00%Heodo
2020-10-16RR1869509015UF.docdoc 6539d2ac4a847b3444866e22b642a335e3d8b92d40031a090fa315aef1af2930Virustotal results 51.61%Heodo
2020-10-16BK_PO_10172020EX.docdoc 050d172a5e413b5f0a7a68bbbb0684b485f20b0b5f89bf3f9711b0c8e844b723n/aHeodo
2020-10-16BAL_LJP_100120_KPU_101720.docdoc 59330f6abd11ccf8373697955746b598be71ca8c69774640b41ebd9650abb398Virustotal results 45.61%Heodo
2020-10-16FILE_GNGB5T91S6FJDPMH.docdoc 8e4239eda8a4993212d0de12a0e6fb748c995f1a89e8fab3417a0140b9f650d8Virustotal results 50.00%Heodo
2020-10-16INV_IH4213496068LG.docdoc 1c3dd09ac057aa6b432e637992b2d3f2dac3ec4212fbd51771b0bfd7be470110Virustotal results 48.33%Heodo
2020-10-1641161877.docdoc 0592df728f9353ff5f892eba34b3e4a89511bebcf05071738614f9c16c4c640aVirustotal results 46.77%Heodo