URLhaus Database

You are currently viewing the URLhaus database entry for https://bts-ksa.com/wp-content/OCT/LveVNtwEMwvL9gyR/DOC/v70jgw9coqo/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:705016
URL: https://bts-ksa.com/wp-content/OCT/LveVNtwEMwvL9gyR/DOC/v70jgw9coqo/
URL Status:Offline
Host: bts-ksa.com
Date added:2020-10-17 01:41:04 UTC
Last online:2020-10-19 13:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-17 01:42:09 UTC to abuse{at}contabo[dot]de)
Takedown time:2 days, 11 hours, 49 minutes Poor (down since 2020-10-19 13:31:18 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-17BAL_86196387.docdoc 360a5cb7eed923017b4ef07460e7652362cdf1fc0a902516addbb8e244e30134n/aHeodo
2020-10-17BAL_NC0635154690GO.docdoc bd5e318573106192eca830985c93ad07583928c7ba9b1f752ee5ce3e38eea593Virustotal results 51.61%Heodo
2020-10-17Y_WNH_100120_GHF_101720.docdoc c5b951c65f67f1136dedc670dfa0cf0fe59abb9172a0fe5a6011e2882e129e8an/aHeodo
2020-10-1706760864.docdoc 169fa4037e8c45a38a3b2e862d860e955fc810c63682c78155bbbd45820b83bfVirustotal results 54.84%Heodo
2020-10-17PO_10172020EX.docdoc ab13f6f95154d0396465d9bb9d42e49708e2efdd49c259b7189ae2c7c7c2d389Virustotal results 53.23%Heodo
2020-10-17ZX_PO_10172020EX.docdoc 5bc6a9797e0e1b206a0d2d341e88b730f01312279122e98e1dc2873f48b2102an/aHeodo
2020-10-17FILE_WBA_100120_JKB_101720.docdoc 9fddabb44e0d01bdc8e0886790e1e34059ac1aedbe3faf4cdfa66bf9dec923cbVirustotal results 53.23%Heodo
2020-10-17KPS_100120_NMZ_101720.docdoc ff9996026d66c80170010bab3d84d0ba1ecac3a6b87f8e694008feb0bc0b3d4fVirustotal results 53.23%Heodo
2020-10-17INV_AXW_100120_KLN_101720.docdoc 8b422df815c80e86241a4670a69918c21bf0fbdde61aaa753f84e0af70d9f4a4Virustotal results 53.23%Heodo
2020-10-17YW9484655757JR.docdoc 72e665a7d43027e4ad6206ba82bfb44f113e89c81b249b2c9ea29c45faf022ddn/aHeodo
2020-10-17DOC_XMH1LLXNHZ.docdoc 58945b2729339cb8db084de7ca7c3197dc009fa50097bcdf716d8b0c3d125a19Virustotal results 51.61%Heodo
2020-10-17REP_VV3476046327BM.docdoc 127e5f88e44a1886181820087f5a2d1bb09ecec7ca49c027c33c9cdead79c1acn/aHeodo
2020-10-17FILE_PO_10172020EX.docdoc 6d5ed047cba0f40a2bd108fdb285520a5590c29ac64b7a9d32a20719905f1e7cVirustotal results 53.23%Heodo
2020-10-17DOC_LLK_100120_MKZ_101720.docdoc 920a210b924453a21c734f46a853d5eefb835b8f7e33cc3402355037771648c6n/aHeodo
2020-10-17INV_PO_10172020EX.docdoc ca5d768289c225dea34f82176591548fc03963cf653f0a8ea0b6e0f9f71ca3aaVirustotal results 54.84%Heodo
2020-10-17PNT_5685386202905008323686234.docdoc 58a95bd14fdfe2c4e30b7bce237de2fa3351c1bcf0328c91c9333a29a8be15d0Virustotal results 51.61%Heodo
2020-10-17R_4907171992813271861630.docdoc 252e05a52d4bc9d3d266533b1a75bfab674989b8d3a4f0ff8d898529379329afn/aHeodo
2020-10-17KO3408551206SC.docdoc 3cf860a4fc48852cfc15307168a655fe09d970de805123a370c888f18b949aaaVirustotal results 50.00%Heodo
2020-10-17RKO_100120_PTB_101720.docdoc d19c1e922354570a8700f8dc25900a7c8ae4bee4b08908a4c6cad2309eff1ba1n/aHeodo
2020-10-178ZVLB8NDMSQ7.docdoc bb96b8f7ca8418e8d16ada7ed78c33abe3bd24d7ca843033cc73e73e4c606fdaVirustotal results 51.61%Heodo
2020-10-17FILE_4Z3Z4UFDWNITTMF.docdoc cad389f338446345616f9a4f005b47f186be55fdd914d1b88f42bc4f26220685n/aHeodo
2020-10-175A762CP8S.docdoc 055030f2d18fed27b4bc4f3e461f0eceb8308cbc3182ec2eca899c70d9aee715Virustotal results 51.61%Heodo