URLhaus Database

You are currently viewing the URLhaus database entry for http://6sz.ru/ee/armv5l which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:3391489
URL: http://6sz.ru/ee/armv5l
URL Status:Offline
Host: 6sz.ru
Date added:2025-01-06 12:55:15 UTC
Last online:2025-02-27 12:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Malware domain
SURBL :Not blocked
Quad9 :Not blocked
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Not blocked
ProtonDNS :Not blocked
OpenBLD :Not blocked
DNS4EU :Blocked
Reporter: NDA0E
Abuse complaint sent (?): Yes (2025-02-26 12:08:04 UTC to abuse{at}proton66[dot]ru)
Takedown time:1 month, 26 days, 3 hours, 27 minutes Bad (down since 2025-03-03 16:23:43 UTC)
Tags:botnetdomain elf gafgyt link mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-02-17n/aelf a1a6926b93bf296992cb31de76246f26d75870245f095e6289b83d5d60c4ef48n/aMirai
2025-01-23n/aelf 19f2b12a00e9fba7b9ddf08b6381204625d2e1dd9981f15d763c46b0077b9cdbn/aMirai
2025-01-22n/aelf 7cc1f6a3b144c2163c85e6d585caae86a0c7860d3ebb852129ea8f1a1a4061d1n/aMirai
2025-01-17n/aelf bd46fe5bde996c0d25b40031c292aec3776997d729e0393666f146b73da45514n/aMirai
2025-01-10n/aelf 8419ca7a15cfcf147d47986cc5a9ca3fc6bd5bcff1a9bbad455227bc214f1eefn/aMirai
2025-01-06n/aelf 1d52652449b7055951f8ba4af56d5e2f8b326fbf9795f471f6dbe732f466d2c1Virustotal results 34.92%Mirai