URLhaus Database

You are currently viewing the URLhaus database entry for http://gundemhaber.org/3499016Z/oamo/US which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:75450
URL: http://gundemhaber.org/3499016Z/oamo/US
URL Status:Offline
Host: gundemhaber.org
Date added:2018-11-07 05:20:10 UTC
Last online:2018-11-12 21:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2018-11-07 05:22:05 UTC to info{at}fiberserver[dot]net[dot]tr)
Takedown time:5 days, 16 hours, 0 minutes Bad (down since 2018-11-12 21:22:20 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2018-11-08PAYROLL #16388LSHDS.docdoc 82035d9b995f9232d980f27df349217cb9189b900bdcec85150fc835bf359aedVirustotal results 35.59% Heodo
2018-11-08SEP #134169RZPK.docdoc 3afbb7fe5b55ba5c58e0e3c9a9fe0ca8e66ce68b69ee4b5ff2382976c2949b3fVirustotal results 33.90% Heodo
2018-11-08SWIFT #414476RMIYJF.docdoc aa8dca5caa97ceef58c783b02f7ad4aa5169cc28eddeecb12f1bf7799b121cb5Virustotal results 32.20% 
2018-11-08PAYMENT #76TLVTWJG.docdoc ea36164e20f73599c5c83a2f5e2b55628a5b2a465cd74a8527b292ec79c1c31dn/a Heodo
2018-11-08PAYMENT #24373KIPYC.docdoc eaa60691053dc58f05d2ad7a5e9ffaeee8f53c5a9ebc505915fed05c06809164Virustotal results 28.81% Heodo
2018-11-08BIZ #61DBJC.docdoc 6ea3961b94020b5a942bc013c9d5b9c8444c9a36f442e4a49588db8824f30909Virustotal results 28.81% Heodo
2018-11-08SWIFT #89685ZXNUEJUY.docdoc e6e1e20a21b4043a2f371591597526f09a52bba32f0ff927bdb9694e3ea24a24n/a Heodo
2018-11-08PAYROLL #5880249XSA.docdoc 750977f7a6f6642f593ff5a1bdcfca3efad389a2e9c9eab2aa84cb710ff3fb08Virustotal results 22.03% Heodo
2018-11-08SWIFT #5877618SIZ.docdoc 065ad3cb92a773152f7c827d993c1ee092de9aa050dd0f06a1997ff02dc8a9d0Virustotal results 27.59% Heodo
2018-11-08SWIFT #9808WAP.docdoc 2bfe239def043a1d53ad539cd2e37754d429ea2f629ec31537d4581279b20513Virustotal results 24.14% Heodo
2018-11-08BIZ #31921IYFRAPB.docdoc 37b2cb1bd480c248cb0485580619a3a46d6033e01edd6a34921918a23f80194eVirustotal results 28.81% Heodo
2018-11-08PAYMENT #100663WVSYQTI.docdoc 53b85c79b1013869f61d0ae8cc2b5d5c4b597206438ca1b5d2798ca56ec2a4faVirustotal results 29.31% Heodo
2018-11-07SWIFT #5749AQKSMQY.docdoc 4a2c9082c452d68532bc11d6bb1d684483dc56453f24f7c18b0378bae9a82790Virustotal results 32.76% Heodo
2018-11-07SEP #13SISTV.docdoc 2d134f1e2f7f4854d6ba68266ce65e33d6b60b8d6f76b2a55f345b86ff5c362bVirustotal results 25.86% Heodo
2018-11-07PAYMENT #36BOFXHYP.docdoc 62cb96a1dc38ea7cd8c1738f267ca4ccb0de5253abe722a9b51a247aff9762f8Virustotal results 24.14% Heodo
2018-11-07SEP #7654680JFCFQZ.docdoc f31a737e4c8615dac72aca6d5157aaa8b522903d3956073f1ea86dc33b9ae1f5n/a Heodo
2018-11-07BIZ #29KIKQA.docdoc 8d74c083778f9511c01916d183301686ac09a7011bbfa8f744a5816dc244340aVirustotal results 18.64% Heodo
2018-11-07PAY #373ZJ.docdoc ec383b84e5038f061921a2a41b27d8635465826bce5636b21ede0fe061895972Virustotal results 18.64% Heodo
2018-11-07SWIFT #7BFNKNEBP.docdoc 42d8e974d69dd352062b784121f9df58b30a4b3aea684ce2f9fa418977b4776fVirustotal results 37.93% Heodo
2018-11-07PAYMENT #474LWNOERNF.docdoc 4cf2d368c6075b3cbd98af99904901fd2e6c7cf11fd6cd80ab281b03e8b9d03bVirustotal results 37.29% Heodo
2018-11-07SEP #7QXAXFBV.docdoc 97b5a25165f733e18bf609d53984da8b9c4524865e8e61f1b85a443f25f374ben/a Heodo