URLhaus Database

You are currently viewing the URLhaus database entry for http://betterzhao.xyz/wp-admin/rqNTTh/ which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry



Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:766476
URL: http://betterzhao.xyz/wp-admin/rqNTTh/
URL Status:Offline
Host: betterzhao.xyz
Date added:2020-10-29 19:00:13 UTC
Last online:2020-10-31 01:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Not blocked
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: Cryptolaemus1
Abuse complaint sent (?): Yes (2020-10-29 19:02:11 UTC to google-cloud-compliance{at}google[dot]com)
Takedown time:1 day, 6 hours, 15 minutes Poor (down since 2020-10-31 01:17:42 UTC)
Tags:doc emotet link epoch2 heodo link

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-10-31Untitled_28401950.docdoc ffc63081ade619c07061526c15e53d5dd012da2e842f479fefc0c27f46ce2bebVirustotal results 55.56%Heodo
2020-10-31AR5357059696UM.docdoc 9210f9032280641d080e5abde6a49a3032839cec91f757f2469a4eeeb4080afcVirustotal results 54.69%Heodo
2020-10-31Attachments_0WK1ZJKU9C1NG2I.docdoc 26b30e58ed2342d042367ba0487873439d5c9c28920ddd000bb94b3eac79d94dVirustotal results 54.69%Heodo
2020-10-30FILE_226016987379528.docdoc 14a8572928770f8d61fa05890c3e0a5cd4396bfde2ce2763d533e89d05120d34Virustotal results 25.00%Heodo
2020-10-30dat_559796979473519410.docdoc 22a4eae8735782a3f12e3f7ee5b6d0839cd7c4a8b91dce6ce27e2414b2e5f817Virustotal results 51.56%Heodo
2020-10-30UNTITLED_PO_10312020EX.docdoc 917a6b067e825cb71b0d60b4e428f283cdbf100bcec01e467503d18077125c4cVirustotal results 51.56%Heodo
2020-10-30file_4509876184010082364549.docdoc 5041a2eae4b04f23df9804031b3a30e815e0c2310bf42d82176cb89618617933Virustotal results 55.56%Heodo
2020-10-30SZ3FK0N9S0Q.docdoc 4a1ebe8938ac9ac6ae7b502c4561bf514bc47ccdb87abae9777a5ac526d6540cVirustotal results 54.69%Heodo
2020-10-308Q140HM.docdoc cc0614f4e21c1d63a80e1ddecfd591353e15aa849f754be9d8b709cc6e9841c9Virustotal results 53.12%Heodo
2020-10-30arc_NS8873510555BL.docdoc fee7c3d92d847b227a0310837bdd5bd774db43c7793d9e83c31405a79a35b9cbVirustotal results 33.33%Heodo
2020-10-30Mes_KAW_100120_VWF_103120.docdoc 0df4e83145becd16b2074bb93563596b613e43856bbd653b98a316f5d92ab817Virustotal results 23.44%Heodo
2020-10-30Attachment_PO_10302020EX.docdoc 2004d64ee603572e13a168eca558d2ade8169581208022e51896e0589e07116dVirustotal results 32.81%Heodo
2020-10-30Rep_ZB7576315813NF.docdoc 6061326ca1f6965d9ff04a37eb1defb55b410556500c197c6d8c9207a4432fabVirustotal results 23.44%Heodo
2020-10-30Doc_03483479.docdoc 5fc665986d6e0e5763554e4d9f9db9ccc61b2c20fc408e955d286a458f622f48Virustotal results 47.62%Heodo
2020-10-30Doc_VLM_100120_PGO_103020.docdoc a24c2997fb1b27e97d94e67fa2efe79081cb3329192ef55f1765271679241990Virustotal results 46.88%Heodo
2020-10-30inf_59690287.docdoc 11b78b0507ac7cd6f99f0774c2838059fae12fa3f9b8878e6d5e3075496c37cbVirustotal results 43.75%Heodo
2020-10-30AB_9444880070214461389.docdoc 374433b4b7b6197f4f9f41115f09cafa5907b8b1b2076963bc6c09e4227fd47bVirustotal results 42.86%Heodo
2020-10-30FILE_FDL_100120_TBZ_103020.docdoc 5aeb983f62e296373a25bdde163ab799f0bd688f40567310960f16b815921687n/aHeodo
2020-10-30MES_BK5B90RUIR.docdoc c3a3c4b5fe05e1cabea15022173fa5a6f9fb05c83f0cb2d70441f0d415fb9405n/aHeodo
2020-10-30mes_56832505.docdoc 4eea09772ca2174c6dee225349ae15f55b9e8a91ac3aed6f961a4815ea86f462n/aHeodo
2020-10-30LIST_TZ0608000375ES.docdoc 0b8a8e7a53d7fe5cfe16dbec4b9d21361ce7f6eb2f21c9ece0c5fdea89d09b74Virustotal results 42.86%Heodo
2020-10-30Inf_OLK_100120_GMW_103020.docdoc 1b8a22caf6297a5c5079fc3020d9bc56bfe5b3dea6cdf5f252539d3c076c9c62Virustotal results 42.19%Heodo
2020-10-30Rep_56876800.docdoc 2c35c7c2a35e6c0d057d6a29697d6caeab76363a0040219edbed385309cb15f6Virustotal results 42.19%Heodo
2020-10-30Arc_DG7795754074DC.docdoc 59eb7f8b98e7601aab446fe4f84b586ecf0ff8b5f092b8144441e50eed459684Virustotal results 43.55%Heodo
2020-10-30DAT_SLP_100120_OHC_103020.docdoc d6f5c2f6c473a5df7285cae32d8806ee2c6ee513400416463c34c7f6b3dcc703Virustotal results 42.19%Heodo
2020-10-30inf_04838431.docdoc d81b4a47a2d75a7a58106d5e4e6aaf912f2d33c26eb7fdbb1d31abb9a1883395Virustotal results 45.00%Heodo
2020-10-30FILE_QTB_100120_FGF_103020.docdoc 6270902fc810af901f9685bb0b3251f8cf96445514e9bd288b51d51156701665Virustotal results 25.40%Heodo
2020-10-30Attachments_456940025184675845788154.docdoc 7419637ce4e2a7bf1c8503dd9f1878136c8bc0e38e88521f6500c7c717524be4Virustotal results 29.69%Heodo
2020-10-30list_29822372838557243737.docdoc 0ff00e35cca1451486afc9af5f9ec922a120201c1ad664d440e5511c370bef3cVirustotal results 27.42%Heodo
2020-10-30List_4OU0PUVRJEU01.docdoc b6fe7dca5aa33eedca9590aacbb7a67d89dc6c1a98cee170aca2c47518e01ea1Virustotal results 27.42%Heodo
2020-10-30mes_EF0245189281FK.docdoc 9c96edb7b23fe316d7ea6705b137c283da2aba4f7dab4537a681e7e5d031b0een/aHeodo
2020-10-30arc_72354859.docdoc 84f8bd87a1f8207da3a4722b9eee322be498919fed6323fe33c0ce60ef7aadcfn/aHeodo
2020-10-30FILE_PO_10302020EX.docdoc 07cac58fbfac34bd4e22b0dab98273a45a147dac7d38266ec0749fb5fd85b98dn/aHeodo
2020-10-30Rep_EM8114531757IT.docdoc 78bd1c6e03aab90ba0350183bb9aba52148938c5c4384fb2695473c6540e139an/aHeodo
2020-10-30Doc_08543213.docdoc 8ead4e972ba536f428fbee5bb8f687ff6a1efdae4456aafb1bbb176b37672180n/aHeodo
2020-10-30FILE_BZE_100120_QWP_103020.docdoc 4f6d5190871bdf4ebad7eb4520c7a651e3a2f4d8def1ca783c0efb807bdc7ec3Virustotal results 23.44%Heodo
2020-10-30UNTITLED_132565043086922055945.docdoc 1e363452c2a67d40f01390488a99f68ce6fab805b45eab93ee2db2469bf1b05fn/aHeodo
2020-10-30ARC_AY3999792823RT.docdoc f4983c5881da987bb4dcca9069e0134657dbd559cf50165c0f35c3f1c4595948Virustotal results 40.62%Heodo
2020-10-30ARC_71851138411505469014930.docdoc a120ab7f12256c4b260034ecf26910f2eb405bb2c41ea9d1d78fcd2f529d2debn/aHeodo
2020-10-30Rep_CDIX2220I.docdoc d4acc3a64623dfa14067c44c95b64430f606feb0c118b278da5747c1b0e52da0Virustotal results 41.94%Heodo
2020-10-30dat_PO_10302020EX.docdoc 2a2cd3fa6ea3c1207553da6896b030a743a3893ec1b95b494ba27d6423f8857dn/aHeodo
2020-10-30rep_DB1467859418OD.docdoc 6b88f01b98b04205fdeaca9ab7f387ea479efbb68e1e0a940c909d66e6ed092bn/aHeodo
2020-10-30Attachments_72533898206714688208.docdoc f39a18ddfada38fd5b1f2c0c242c50c50fc842b96af2c528b843c6e8a155379aVirustotal results 37.50%Heodo
2020-10-30List_TX9444604854AO.docdoc 8cb962ad1798941eefe7a5f826ea5bebc726304af0337e53e6e34d59a7715795n/aHeodo
2020-10-30dat_N8SQHBX.docdoc d77f9d8ce192df999a4c7c9564c086962623dc1a6e020f14bf19f264f59d316fn/aHeodo
2020-10-30list_0132388691.docdoc b2312b8854268bd1ca23427d7f7aaf8b3013aa1c4ef1d7676e73a5667418b9e3n/aHeodo
2020-10-30M_PO_10302020EX.docdoc e4c4aa874feb371209199ddd6b159ed4a677b94568dfe6b09351807263dbef9bn/aHeodo
2020-10-30DOC_0SNBHFZS4TQDKF4.docdoc 3f80d6a9b857cead0fb4b3e62572865a798d440a23fab61898596828031204f1n/aHeodo
2020-10-30B1OPNVJ.docdoc 34d285260657003791b2816bffed0a723c26806adb1483d592fb38d3f04d1943n/aHeodo
2020-10-30mes_0AZJ4M1QMP5.docdoc 3faba02f0eb970ef25a2a874736e4f758dd3424cdba2637795ada41385024679Virustotal results 30.16%Heodo
2020-10-30Rep_UHB2DQMXI.docdoc 7ae6e150fde20638c5cc89c0b4c088593eb3879f0f6567e9c4cc14069b9ae204Virustotal results 29.51%Heodo
2020-10-30E_EAZ8T9IRUZQS4.docdoc c2d7ed25c4c34f44dc293833d3ea302d281d24981385c437e411a50ede35e72bn/aHeodo
2020-10-30rep_PO_10302020EX.docdoc 785620ae5f3c011f3939803b6f7da0f097c81d008495ba545b805d7edf1fd707n/aHeodo
2020-10-30File_451503170140908039.docdoc 8774a4e21e5c187c5b68d43c4789009a3eca07aa1193d674b5589938ea46f663n/aHeodo
2020-10-29Dat_1NKKPH6.docdoc 57a23ee50bad094280feb716af4f6917dcf92157f899a609736ead07c82e6432Virustotal results 26.56%Heodo
2020-10-29Arc_36911852.docdoc b716fa67c934451161c1be78e1587b3c68a53b5e219dc5452e9ea883d32a274cn/aHeodo
2020-10-29FILE_X3RM3AS.docdoc f4d2f6dbbb53d79cccef95feda58515350e863a1f1522bf60c830c0230754866n/aHeodo
2020-10-29EEZB_24066943.docdoc c685520233b6d670ab20445051b6688bac6affb5c8b99a71213937d99ac9e380Virustotal results 25.40%Heodo
2020-10-29doc_06030170.docdoc 168c46a9b7c3c72ceb572a447f6317e5b66aca4735ea8e096bc92f0d03628879Virustotal results 34.92%Heodo
2020-10-29mes_QJD_100120_TJN_103020.docdoc d28ab268249104b8e40b88f99670cb44f0cc8c440b22b983193c4e6fa4e0ea95Virustotal results 26.56%Heodo
2020-10-29UNTITLED_374830156169046138.docdoc e5ee1bc6b5f6544f1d789848862c6469f2f32c20627bb4e410a1bc21f0005817n/a 
2020-10-29PX_TK7364050821RK.docdoc 8427c429a000ef90470422cdc8d29bce81566f87f24f9ae2df228dbee3ffe5cen/aHeodo
2020-10-29arc_GKCEX97.docdoc 957fdc10c373706014fb0f314948a99ca0723fcd625cffd748c8d544d32dd4d3n/aHeodo
2020-10-29Inf_GN8750637265KM.docdoc 51657b8a72e7e81349ee2744529184125522759769f93b02aebc3a2d33fddc2bVirustotal results 27.87%Heodo
2020-10-2995468983.docdoc d51925f43c610d0116c831c9282a4b3fcbca83fce4a02bde7f425d81eb7a2243n/aHeodo
2020-10-29rep_26509921.docdoc 0bec0186a4f6a768c04f1e871d8ea6c4ae69a5580342d2310e057acf518c7b00n/a Heodo