URLhaus Database

Every malware URL on URLhaus is associated with a host. A host can be either an domain name or an IP address (in case the malware URL is hosted on an IP address and doesn't use a domain name).

Database Entry

IP addresses

The table below shows all IP address observed for this particular host (in case the host is a domain name, all A records will be listed - including all historical ones). Please note that the output is limited to 10 entires.

Firstseen (UTC)	IP address	Hostname	SBL	ASN	Country	Active?
2020-09-22 16:31:33	5.34.183.14		Not listed	AS15626 GF-UA	UA	yes

Malware URLs

• URLs
• Payloads

The table below shows all malware URLs that are associated with this particular host.

Dateadded (UTC)	URL	Status	Tags	Reporter
2020-09-22 16:31:33	http://5.34.183.14/libsystem.so	Offline	elf kinsing miner rootkit	r3dbU7z
2020-09-22 16:31:33	http://5.34.183.14/al.sh	Offline	kinsing miner shellscript	r3dbU7z
2020-09-22 16:31:33	http://5.34.183.14/kinsing	Offline	elf kinsing miner	r3dbU7z
2020-09-22 16:31:33	http://5.34.183.14/Application.jar	Offline	java kinsing miner	r3dbU7z
2020-09-22 16:31:33	http://5.34.183.14/ae.sh	Offline	kinsing miner shellscript	r3dbU7z
2020-09-22 16:31:33	http://5.34.183.14/d.sh	Offline	kinsing miner shellscript	r3dbU7z

The table below shows recent payloads delivery by this host.

Firstseen (UTC)	SHA256 hash	File type	Bazaar	Signature
2020-09-23 03:50:34	70a9ae4f2699ecd0b9334a4d4cd9ef80c005580530485cabe0a7538153852f55	elf
2020-09-22 23:37:20	6c1cac326239bf1739bdeb22f74a7506b4b8fc46d55cee9a1067160f1e5ebad4	elf
2020-09-22 21:44:10	126a66c626563e8d1f94be1f29ad2436a565d524a0303dfd05ca837992239f25	elf
2020-09-22 17:05:23	ccfda7239b2ac474e42ad324519f805171e7c69d37ad29265c0a8ba54096033d	elf
2020-09-22 16:58:01	c38c21120d8c17688f9aeb2af5bdafb6b75e1d2673b025b720e50232f888808a	elf		Kinsing