URLhaus Database

You are currently viewing the URLhaus database entry for http://eduma2.com/ontario2.com/rfeW/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below has been used by bad actors to spread malware in the past, the malicious content has obviously been removed around 2022-12-20. Hence the the URL / website should no longer represent a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists anymore.

ID:	722275
URL:	http://eduma2.com/ontario2.com/rfeW/
URL Status:	Offline
Host:	eduma2.com
Date added:	2020-10-20 07:53:09 UTC
Last online:	2020-10-20 21:XX:XX UTC
Threat:	Malware download
URLhaus blocklist:	Not blocked
Spamhaus DBL :	Not blocked
SURBL :	Not blocked
Quad9 :	Status unknown
AdGuard :	Not blocked
Cloudflare :	Not blocked
dns0.eu :	Status unknown
ProtonDNS :	Status unknown
OpenBLD :	Not blocked
DNS4EU :	Not blocked
Reporter:	Cryptolaemus1
Abuse complaint sent (?):	Yes (2020-10-20 07:54:04 UTC to eig-abuse{at}endurance[dot]com)
Takedown time:	13 hours, 38 minutes (down since 2020-10-20 21:32:18 UTC)
Tags:	emotet epoch2 exe heodo Trickbot

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2020-10-20	9G4DSeK8wxklQpF.exe	exe	27d401c4ffce9927f76d693787e94c6df30e601aedbe3a07d82470c13272cd3e	n/a	Heodo
2020-10-20	r4pBND2H.exe	exe	d7d200b194e0481fef0dc4d45d9fabb420054e0b2c65f5b5cf1428f27989db8b	n/a	Heodo
2020-10-20	J9JfSR5bP7.exe	exe	a7722da76a6fd2cff961e43c31a19464e661dcdee8949d72720084cdb1d58658	n/a	Heodo
2020-10-20	mKvvdWqCuCrFkK8awGG.exe	exe	734ab9fd59edb4380a074e8c72363bb8f5a6f499ca1a3ee191a67f931d5e71e4	17.46%	Heodo
2020-10-20	3u9kHu2ak4.exe	exe	4a3182ab4535d6e23d56a3d60723847ffef20606bb632811b95dbdc8c0b374e7	n/a	Heodo
2020-10-20	wqUKGSmvtH6dY.exe	exe	6ccbf2cdc48fe9c94b87da5df1d1f89e929a6fdbd724e077109571d3d2769ba6	n/a	Heodo
2020-10-20	ssngboojYXTDIVIEC.exe	exe	f3fdeddabe241b0f948738578832b18dd2db9cd9a86f21e12425da906de03a9f	n/a	Heodo
2020-10-20	h.exe	exe	162a2d94958d73f1c73dbdf99dfaec2228bad0fe9b25b6cf09a65a77558f6f18	18.57%	Heodo
2020-10-20	18s7NvGuzph9aWB.exe	exe	5107a59da0aed267d584846c14c45320637e04c192e9e0f998235059978bcb47	n/a	Heodo
2020-10-20	lyuVIvsSoZ1viFXy6oSa.exe	exe	b68f100b52c0db9751c6553add5e94b4a1c70dfb47d418d491bcc98eabe95f13	n/a	Heodo
2020-10-20	DLh8f.exe	exe	250118b5a198aa8bb46319e0cd5e07b63f97f1cc9f9776a2cc4a3d7a6899b64c	17.74%	Heodo
2020-10-20	9c1mKCeE.exe	exe	1013f86a3e7f03290517e7064b03dcd76f7ac3d44c4f585b1053dade69b5cc3b	17.65%	Heodo
2020-10-20	D3myy50hPPOn75SSC.exe	exe	b72c2f1f511f2ff3eec82a5500609f7fda4c4069c4c467b2aa627ebe8639899e	n/a	Heodo
2020-10-20	uvdLhAIf6DoT.exe	exe	58f958e716a2fd35c9f1bad96412c161b9702da7d0005ac26bc0f888616a329f	n/a	Heodo
2020-10-20	2xEbZ.exe	exe	084367b3877e3fcbc7af20d8a4a323f657376f7d94eaab58ed98913f66318596	n/a	Heodo
2020-10-20	FB0bNVuM0mMmlOHz.exe	exe	9d7250cd206753f31e3cbaeade124a862814e59651d62f4a00e9813a46cf5446	17.14%	Heodo
2020-10-20	PuWQfonJAkg4fDaZ1t.exe	exe	d601c0ac958ff78c8cfe9db86b0644b36cd1e9cbe6fc48742ed628361892bda7	n/a	Heodo
2020-10-20	E85UMuelpwLXTf.exe	exe	8b8e3eb3c9efdb2c875324561e16183da3107a6beda197542a91729095295e56	16.18%	Heodo
2020-10-20	a.exe	exe	5e8fac5f3688e7bac2d307c2c577442cd75e9667c5605ea8d8e1688a13c856bc	16.67%	Heodo
2020-10-20	OvwPpYEvSldf7Kqf.exe	exe	e14278a9c159da384032252aa98f146f46777f0c01891134651d518e47330815	16.13%	Heodo
2020-10-20	ukjoSpA.exe	exe	2cc14cdb7b535ec5fbf442159319e252903a2410e63cd54ac69d71caae716b97	n/a	TrickBot
2020-10-20	PAlS9qBSI.exe	exe	00adf0cad601020104df27e0ad81f09063a69a73faa21cd53be697bb0878f6d3	n/a	Heodo
2020-10-20	f8DEqLqjHMh5wN9WI.exe	exe	ad0f7756e06cad3669dd65a058b5d770088c3151e38f63cba5a01c79c603b592	n/a	Heodo
2020-10-20	A4xX.exe	exe	39dff76bf8aa6e13993859ebe9ca084bf623cdba8df91b733e2ddff9e133b2f0	10.77%	Heodo
2020-10-20	e18ec.exe	exe	de322e35d17879f9c945de8c596d50741d19fe6465c17d8d27895f758cc9ef2b	n/a	Heodo
2020-10-20	0Hu.exe	exe	82936604ced63b927896bff5538e5a543825b303bb886a75f298350fe751416c	n/a	Heodo
2020-10-20	sDHWr6QWy4PlvuXHf.exe	exe	da708b663fa1ac7a9d69d100057ec6298b038887c5ccc0ed62294efb6cc63b49	n/a	Heodo
2020-10-20	t2L8F.exe	exe	94ef7a6f0a74b798cbd6217008aa51c43ff248b8eb5b94081b6dde0071902705	11.27%	Heodo
2020-10-20	LPG7X.exe	exe	606d6ac5d9d47848309be461d4e7b1dd12fffb18694d3b61e4770d28da74caa0	19.05%	Heodo
2020-10-20	KqtPF8BikMvCfOa.exe	exe	ef41c26328181e0f17239ad784676feaaae1364aad248aab5fcc9f9ad8d770d9	n/a	Heodo