URLhaus Database

You are currently viewing the URLhaus database entry for http://gkdon.ru/wp-admin/1S6VmpyWk4BHE/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:704157
URL: http://gkdon.ru/wp-admin/1S6VmpyWk4BHE/
URL Status:Offline
Host: gkdon.ru
Date added:2020-10-16 21:44:04 UTC
Last online:2020-10-20 00:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-16 21:44:47 UTC to abuse{at}rtcomm[dot]ru)
Takedown time:3 days, 2 hours, 15 minutes Bad (down since 2020-10-20 00:00:45 UTC)
Tags:doc emotet link epoch1 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-17Arc-7312731.docdoc 294c6f87d8514072c30988bd55dd643c5c018b9f9ae05b9db1a97d034b31e092Virustotal results 55.00%Heodo
2020-10-17arc_K013.docdoc ea4cb3d56a4e049d8d0e7d1e30ff96c6b4fd216860a4c48ed248940702f3b7acn/aHeodo
2020-10-17dat-2020_10_17-46936.docdoc c147f6f4d8e08ce92756aea055fb18dc3398e77ce2ba5a71bfa3d6eb5f3de750Virustotal results 53.23%Heodo
2020-10-17ARC-20201017.docdoc 1cee91ca2689e165e0a72614f98d0dc71da6671ecd0e7f32bb3d6d2710e8dd0dn/aHeodo
2020-10-17REP-20201017-454.docdoc ccad29eac2b2a4c03fc1c9a9ac36544345fb0a5f454746c05dbb5f02d4d53210Virustotal results 53.23%Heodo
2020-10-17Attachment_2020_10_17_585872.docdoc 971e189c279099a876618c3226ef35e5afc62b91daf3b8bde466a424fdfaa063n/aHeodo
2020-10-17Attachment.docdoc 3fef345a1fa8f779f98589ca704dff21e59f8842175c3cdab8caeb16e5e61ad2Virustotal results 53.33%Heodo
2020-10-17Attachment-20201017-581.docdoc 6820620122b2210629007eaae85c11949f1d113edfa9e10c0a0678069bcefa83n/aHeodo
2020-10-170825WFS 20201017 G495.docdoc 674b59aa10f963845214c91833225375d26e69ccece07609e8a5425a8d952346n/aHeodo
2020-10-17inf_2020_10_17_HLV1582.docdoc 5422842242a23ce0b01dd8151fb9d86c9c6b41ed43c792e7c4b714cc2cd2a1c4n/aHeodo
2020-10-17rep_DXU399.docdoc c64264c7336d7e9f516999fa287be55be63b634b63f5ebbf1bab24e38ada5e8eVirustotal results 51.61%Heodo
2020-10-17Attachment_20201017_19002.docdoc 1e52bc38ce5e8a3c4da25a7c7e4d8169a31fa22bfdd9e43759ff57d25b40db02n/aHeodo
2020-10-17Attachment_20201017_19002.docdoc 1e52bc38ce5e8a3c4da25a7c7e4d8169a31fa22bfdd9e43759ff57d25b40db02n/aHeodo
2020-10-16file_20201017_EN519.docdoc a9d9b8357ff803bd36d7bd0c12c770487fe774ccd22e81318606bad0f6ddaf90Virustotal results 52.46%Heodo
2020-10-16rep-2020_10_17-86303.docdoc 528b63ef8c44d0a5b08974fb6ad9efa60e0021ce6993d25b30ef1b90c00df222Virustotal results 50.82%Heodo
2020-10-16FILE_2020_10_17_GN514371.docdoc 5ee53916c491a77206e7a09eb75c02983fae90474ddcb7d0099a47113b4675acVirustotal results 50.85%Heodo
2020-10-165005776 566.docdoc c5480c5bcd7c9b06e744ebfca49ef98e45da1200c5e3762d6b47d9825189f3eaVirustotal results 51.61%Heodo
2020-10-16Attachments.docdoc 5c58c91ffdffd84690c6746f6afc2eaeacd03df2e4a83c6e662755624113cf5bVirustotal results 51.61%Heodo
2020-10-16Attachment 20201017 L95290.docdoc 4773da38da0ba3154bbb3b813c803bd6e1f9ab3bad1888f1402f7b17073620ecVirustotal results 51.61%Heodo