bvmatqnam.com.vn: a hospital website address listed by URLhaus for PowerShell scripts and an encrypted file, and what to do

What bvmatqnam.com.vn is, and what we know about it

bvmatqnam.com.vn is not a program on your PC. It is a web address that the abuse.ch project URLhaus lists as a place where malware files were served. The home page answers with the title "Bệnh viện mắt Quảng Nam", which is Vietnamese for Quang Nam Eye Hospital. Our reading is that this is a real hospital website that someone used to store files, but no source we read confirms who put them there or how.

1. 1

   What URLhaus lists

   Three file addresses on bvmatqnam.com.vn, all in a folder called js: tt3.txt, see3.ps1 and pp10.bin. They were added within about three minutes on 13 October 2026, between 05:29 and 05:32 UTC. All three carry the threat label malware_download and the reporter is abuse_ch. At the time of our data, tt3.txt and pp10.bin were marked online and see3.ps1 was marked offline.

2. 2

   What the tags mean

   The tags ps1 and powershell say the file is a PowerShell script. ascii says it is plain readable text, not a compiled program. The tag encrypted on pp10.bin says the content looks scrambled, so that a scanner cannot read it. The file tt3.txt ends in .txt but carries the same tags as see3.ps1, so a harmless looking ending does not mean a harmless file.

3. 3

   What we could not confirm

   We did not download any of the files, so we cannot tell you what the scripts do, which malware family they belong to or where they report to. URLhaus shows tags, not a verdict on each line of code. We also do not know how the files got onto the server, or which program or message makes a victim's PC ask for them.

4. 4

   What this means for you

   If you only saw the name in a firewall log, a blocked request or a warning, you are not infected by that alone. A patient who read the hospital pages did not fetch the scripts. The risk is for a Windows PC where something already ran and went to fetch one of these files.

Kind of threat

A server that hands out two PowerShell script files and one encrypted file, all labelled malware_download by URLhaus

Where the files are

hxxps://bvmatqnam[.]com[.]vn/js/tt3.txt, hxxps://bvmatqnam[.]com[.]vn/js/see3.ps1 and hxxps://bvmatqnam[.]com[.]vn/js/pp10.bin, on the normal secure web port

Domain registered

Not known to us. Our registration lookup (RDAP) found no record for this .com.vn name on 13 October 2026, so we cannot give a date or a registrar

URLhaus entries

3 file addresses, all added on 13 October 2026; 2 online and 1 offline in our copy of the data

Our check

One plain request to the home page from our server: HTTP 200, server software nginx, page title Bệnh viện mắt Quảng Nam. No browser, no clicks

Platform

Windows. PowerShell is a Windows scripting tool, and nothing we read says these files target Mac, iPhone or Android

What we checked on 13 October 2026, and what we could not

Our check was a plain request from our server to https://bvmatqnam.com.vn/, with no browser, no clicks and no download of the listed files. The page answered normally. That clears nothing: a site that serves malware files in one folder can look ordinary on its front page.

What happened to bvmatqnam.com.vn, from the first report to our test

Everything we know happened in one morning. The dates and times come from the URLhaus data we hold and are UTC; we have no registration date and no earlier report.

1. Before 13 October 2026

   No earlier report in our data

   Our database holds no URLhaus entry for this address before 13 October 2026. That does not tell us when the files were first placed on the server, only that nobody reported them to us earlier.

2. 13 October 2026, 05:29 UTC

   tt3.txt is reported

   abuse.ch adds hxxps://bvmatqnam[.]com[.]vn/js/tt3.txt with the tags ascii, powershell and ps1. The ending is .txt, but the tags say it is a PowerShell script. It is marked online.

3. 13 October 2026, 05:30 UTC

   see3.ps1 is reported

   Less than a minute later abuse.ch adds hxxps://bvmatqnam[.]com[.]vn/js/see3.ps1 with the same three tags. By the time of our data it is marked offline, so it was removed or no longer answered.

4. 13 October 2026, 05:32 UTC

   pp10.bin is reported

   hxxps://bvmatqnam[.]com[.]vn/js/pp10.bin is added with the single tag encrypted. It is marked online. This is the only entry that is not a script.

   

5. 13 October 2026, later

   Our plain request

   Our server asks for the home page and receives HTTP 200 from nginx with the hospital title. The site is up, and two of the three files are still marked online.

What the pattern suggests, and what it does not: three files with numbered names, reported minutes apart from one folder, look like one operator's set of stages rather than a stray file. That is our reading of the dates and names. No report says who the operator is or whether the hospital knows.

How a PowerShell script and an encrypted file work together

We did not read these three files, so this section describes how PowerShell is abused in general, using MITRE ATT&CK, and what the tags on this server fit. It is not a description of what these files do.

1. 1

   A first program starts PowerShell

   MITRE ATT&CK describes PowerShell as a Windows command line and scripting tool that criminals use to run their code. Something has to start it first, such as a file a person opened or a program that was already on the PC. We cannot say what that is for this server.

2. 2

   It fetches a script from a web address

   MITRE says attackers use PowerShell to fetch programs from the internet and run them from disk or straight in memory, and names families such as Emotet and Ursnif among those that did. A script file on a server, like tt3.txt or see3.ps1, is the kind of thing such a command asks for.

3. 3

   The script may hide its commands

   MITRE lists Base64 encoded commands as a common way to hide what a PowerShell command does, and notes that the script is plain text. URLhaus tags both scripts ascii, which fits plain text, but we did not read them, so we do not know whether they are scrambled this way.

4. 4

   An encrypted file carries the next stage

   A file tagged encrypted, like pp10.bin, cannot be read by a scanner that looks inside it. A script can fetch it, unscramble it with a key and run the result. Our reading is that this is what the three names are for, but no source we found confirms it.

5. 5

   The policy that is meant to stop scripts does not

   Microsoft says plainly that the PowerShell execution policy is not a security boundary but defense in depth, and that a user can bypass it by typing the script contents at the command line. MITRE names the flags -ep bypass and -exec bypass as ones real malware uses. A default setting on your PC is therefore no protection against such a command.

Microsoft also notes that files fetched with tools such as curl.exe, Invoke-RestMethod or Invoke-WebRequest may not carry the mark that says they came from the internet. That is one reason a script fetched this way can run where a downloaded one would be stopped.

Why a hospital website may host these files, and what its owner can do

A hospital has no reason to serve malware, so the likely reading is that the site was misused. We have no proof of that: nobody has published an analysis of this address. This section is our reading of the facts, plus general steps for a site owner.

1. 1

   If you run this site or its server

   Treat the three files as evidence of a break in. Do not just delete them: note the dates the files were created, copy the server logs, and find how they got there. Google's Search Central page on abuse covers preventing and monitoring abuse on a site and links to its malware cleanup pages, which is where to continue.

2. 2

   Close the way in

   Change every password with access to the site: the hosting panel, FTP or SFTP, the site's admin accounts and the database. Update the site program and all plugins. Remove accounts you do not recognise. A file you delete comes back if the way in stays open.

3. 3

   Check for more than three files

   People who place files like these often leave others. Compare the site with a clean backup, look for recently changed files in /js/ and nearby folders, and check for unfamiliar scheduled jobs on the server. If you cannot do this yourself, ask your hosting provider or a web security specialist.

4. 4

   Report it and tell patients if their data was on the server

   Tell your hosting provider. Ask your national incident response team for help; we did not find the Vietnamese contact point in our sources, so look it up on an official government page. If patient data sat on the same server, ask a lawyer about your duty to inform.

What a PowerShell loader can do on a Windows PC

We do not know what these files carry, so we cannot list what was stolen. What we can say is what PowerShell gives anyone who runs code with it. The list is a range of what is possible, not a finding about this server.

What this can cost you

Reading the hospital site or seeing its name costs nothing. The risks below apply to a Windows PC where a script fetched one of these files and the result ran.

• High

  Passwords and accounts

  If the payload is a stealer or a remote access tool, what you type and what your browser saves can be taken. Changing passwords from the infected PC does not help if something watches the keyboard.

• High

  More malware on the same PC

  A script that fetches an encrypted file is built to bring in a next stage. We cannot say which one. Treat the PC as open to whatever came next.

• Medium

  Files and documents

  Documents, photos and saved sessions on the PC may be exposed if the payload reads files. We have no evidence of this for these files.

• Medium

  Being blamed for the files

  If you run a website and your address is listed, browsers and security tools may warn visitors or block the site until it is cleaned.

• Low

  Nothing, if you only saw the name

  A name in a block list, a log or a warning is not an infection.

What you may notice, and what you may not

Loaders are built to be quiet. The signs below are things to check, not proof, and many victims notice nothing.

How a person ends up asking for these files

Nobody visits bvmatqnam.com.vn/js/ on purpose. The request comes from a program, so the real question is how that program got on the PC. We cannot say for this server, and we found no write-up that does.

1. 1

   A file you were sent

   A document, archive or shortcut that starts PowerShell with a command is a common first step in the cases MITRE describes. If you opened an unexpected attachment around the time you saw this name, that is the first thing to tell anyone helping you.

2. 2

   A fake installer or a cracked program

   Programs from unofficial download pages can contain a small script that fetches the real malware later. This is a general route, not one we tied to this server.

3. 3

   A command you were told to paste

   Pages that tell you to press Windows key plus R and paste a command to prove you are human or to fix an error make you start PowerShell yourself. If you did that, say so when you check the PC.

4. 4

   Another infection already on the PC

   A program already running can ask for new scripts at any time. The 3 files may be a later stage for a PC that was already compromised.

Check your PC before you delete anything

Start with the question that matters: did something on this PC contact bvmatqnam.com.vn, or did you open an unexpected file, run a pasted command or install a program from an unofficial page? If you saw the name in a log from your own network, the device that asked is the one to check. If the answer is yes or you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto, and disconnect it from the network if you can.

1. 1

   Disconnect first

   Turn off Wi-Fi or unplug the network cable. Many loaders need the connection to fetch the next stage or to be controlled.

2. 2

   Find which device asked for the address

   If you came here from a log, a router page or an alert, note the device and the time. Only that device is in question, not every device on the network.

3. 3

   Open Protection history

   In Windows Security > Virus & threat protection > Protection history, look for anything blocked or quarantined at the time of the first contact, especially a PowerShell related name. Microsoft says offline scan results also appear there.

4. 4

   Look at Startup apps

   Open Settings > Apps > Startup. Programs here start with your sign in. Look for names you did not install, with a random name, or from a user folder. Do not delete yet; write down the name.

5. 5

   Open Task Scheduler

   Press Start, type Task Scheduler and open it. In Task Scheduler Library, look for tasks you do not know, with random names, or that run powershell.exe with a long command. Write down the name and the command. We found no source that names a task for this server, so a clean list does not clear the PC.

6. 6

   Look at running processes

   Open Task Manager and look at the Processes tab. A powershell.exe you did not start, or an unknown program with high network use or CPU, is worth a look. Right-click it and choose Open file location to see where it lives.

7. 7

   Check your accounts from another device

   Look at the sign in activity of your email, bank and exchange accounts, and at crypto balances. This is quicker than any file check.

8. 8

   A scan helps, but it does not clear the PC

   A scan with Microsoft Defender or another product can find known files. Treat a clean result the way you treat a clean site test: one data point. We did not infect a PC and no vendor publishes a removal procedure for these files, so the order of the plan is our judgement from Microsoft's pages, not a tested result.

If you use a Mac, an iPhone or an Android phone

The tags describe PowerShell script files, and PowerShell is a Windows tool in this guide's context. We found nothing that says the files on this server affect anything else.