URLhaus Database

You are currently viewing the URLhaus database entry for http://xn--ltrv66a.net/wp.php/FILE/60109l8hz8/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:725558
URL: http://xn--ltrv66a.net/wp.php/FILE/60109l8hz8/
URL Status:Offline
Host: 推命.net
Date added:2020-10-20 21:06:06 UTC
Last online:2020-10-21 05:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-20 21:08:15 UTC to hostmaster{at}nic[dot]ad[dot]jp)
Takedown time:8 hours, 49 minutes Good (down since 2020-10-21 05:57:15 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-21DOC_C5BJSH4JPPHL9E.docdoc 192d1f4fdc36c10af1e2e207ca659c5b7549c01b189257a12f226c42a6c6b4cfn/aHeodo
2020-10-21PO_10212020EX.docdoc fe1e5c66a4990cc515e5925db68def9f29f1893d9c6d3fa6b47e05f5c5f618ddVirustotal results 46.55%Heodo
2020-10-2130244995.docdoc ef31028a7bfb047b5233493c6b8e14ac6fa49ac6d022b6e016a22276a4be732fVirustotal results 46.67%Heodo
2020-10-2141867050.docdoc 230fc1531e7d113ebf83ea8dad03120965c293da08a2ae82305ac9cb61efe7b8Virustotal results 48.39%Heodo
2020-10-21REP_3402082946.docdoc a22d83a786eb7f5a04facaabb04117ecb5f8cdf09fcbb8405c0a70c97a51f225Virustotal results 43.40%Heodo
2020-10-21DOC_LU0206458443LQ.docdoc 25d12cabe3d39e681a0b8c9ac88206110f66071089e92667ee0fed7bc917e918Virustotal results 36.54%Heodo
2020-10-21CZR_100120_GBB_102120.docdoc 1704417eb4662953f9c73cd7ef716872d3a364dd78aeb7418219a4960968a592n/aHeodo
2020-10-21REP_33039741.docdoc afcfe7ff49c2df7f47347c4c49d64ac3f027b1c79f5d090a0daf526fd65d859dn/aHeodo
2020-10-2130696549.docdoc 2465db836fb8ce33c72ba9c55528a00a290b770a2bb977ecaed539b453c1211bVirustotal results 40.38%Heodo
2020-10-21FILE_10627801.docdoc 47fb7195961f2aef2f52452f43840ae416b6ef31d96ae1bd6a1a74fa7c5f7dddVirustotal results 44.26%Heodo
2020-10-21OK_ADWTI9W.docdoc 1393994f35a8a5910cbc519d9a9d9baa91d4dbc85080bea49d95c152892a2aabn/aHeodo
2020-10-21INV_QV3059807007ZK.docdoc cd0c0ee5979ebfa7ed73a40ee1f879f2b65cc57ed38619fc4f7e186c15e54128Virustotal results 38.89% Heodo
2020-10-20GV3141937046UC.docdoc 681fa75f785a2b6eede8e0045ce0ba666fc0be736b8bba8d23f474b0bc400a7fVirustotal results 39.62%Heodo
2020-10-200DMM02MT.docdoc bbd05af56a4dc95314278a40df6390cfc3ed9f3c4986801470aa7c753f4536fbVirustotal results 32.26%Heodo
2020-10-20IDA_PO_10212020EX.docdoc 8cadf5fc31643a1acc9b991d110e039e7e0520e94783c61d9caf5ccb2481915eVirustotal results 44.64%Heodo