URLhaus Database

You are currently viewing the URLhaus database entry for http://198.12.125.17/sss.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

You are viewing an historical record

While the URL referenced below has been used by bad actors to spread malware in the past, the malicious content has obviously been removed around 2022-12-20. Hence the the URL / website should no longer represent a threat. As a result, URLhaus considers this record as historical. This database entry has not impact on the reputation of the website / domain nor does it appear in any of our blocklists anymore.

ID:	896332
URL:	http://198.12.125.17/sss.exe
URL Status:	Offline
Host:	198.12.125.17
Date added:	2020-12-07 13:08:04 UTC
Last online:	2020-12-09 15:XX:XX UTC
Threat:	Malware download
Reporter:	abuse_ch
Abuse complaint sent (?):	Yes (2020-12-07 13:10:03 UTC to abuse{at}colocrossing[dot]com)
Takedown time:	2 days, 2 hours, 29 minutes (down since 2020-12-09 15:39:55 UTC)
Tags:	exe Formbook NanoCore rat

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2020-12-09	n/a	exe	2d66e25ef6e9edfefee476cc8d967809bfebe8f5751c641b13bcdb99b768b754	n/a	NanoCore
2020-12-09	n/a	exe	9822b3db3d4039f26ee8f6f690dcca63094904607a3ec076a4e73fd0aa919103	33.80%	NanoCore
2020-12-08	n/a	exe	debe2f7e0f2e18dff0c54f3809c66256f5741b5cf9e13e065593c005db9c22de	n/a	Formbook
2020-12-08	n/a	exe	5c969bc3816b7a3e70fee5c9aeed0bc8ac2d881845792b21771da4b8c8f43f10	n/a	NanoCore
2020-12-07	n/a	exe	de10e041ff3250edccbe8a5edee50e9812620a3fff80de82545f018ad24cca0b	n/a
2020-12-07	n/a	exe	bdd6660a13a447a54579212db05e971b87d2c2b986ecdd6565d7c47d75d4701f	n/a	NanoCore