URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2021-09-01 06:08:04	136.144.41.96		Not listed	AS14178 Megacable_Comunicaciones_de_Mexico_S.A._de_C.V.	MX	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2021-10-07 11:58:03	http://136.144.41.96/HCX.exe	Offline	remcos RemcosRAT	c_APT_ure
2021-10-06 09:35:03	http://136.144.41.96/MLK.exe	Offline		Anonymous
2021-09-29 16:00:36	http://136.144.41.96/ABG.exe	Offline	remcos RemcosRAT	AndreGironda
2021-09-01 07:06:03	http://136.144.41.96/hkd.exe	Offline	32 exe NanoCore	zbetcheckin
2021-09-01 06:08:04	http://136.144.41.96/XNO.exe	Offline	RemcosRAT	AndreGironda

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2021-10-07 11:58:03	248a810cd338e14e7cc0753a34b254dff29361b35fa0355df4f9418b33d24b7e	exe		RemcosRAT
2021-09-30 03:55:19	a264700b549e99802394e4c6ade9c64039cac7bfbd6af13708730257771c3d6b	exe		RemcosRAT
2021-09-29 16:00:36	cf6ce67191cc8560c728cef61aa68026540656dc1eb22ce646fc67280bbb7316	exe		RemcosRAT
2021-09-01 14:31:37	75591cb23ef20e0a1bc8d01a392621d608b83ee25bcf37b330d3e966d2c8a50b	exe		RemcosRAT
2021-09-01 07:06:03	b7f93fdcba04537197b4d1a307bf54da300480074376b631c82c1a2c903a5db5	exe		NanoCore
2021-09-01 06:08:04	39de6e1f455747a1e878f070e5b62e306a60bd595d5a1840518cc07972a5c6d1	exe		RemcosRAT