URLhaus Database

You are currently viewing the URLhaus database entry for http://87.121.84.254/1337/TORRENTOLD-1.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:3481196
URL: http://87.121.84.254/1337/TORRENTOLD-1.exe
URL Status:Offline
Host: 87.121.84.254
Date added:2025-03-18 12:03:04 UTC
Last online:2025-07-20 18:XX:XX UTC
Threat:Malware download Malware download
Reporter: NDA0E
Abuse complaint sent (?): Yes (2025-03-18 12:04:06 UTC to abuse{at}vpsvault[dot]host)
Takedown time:4 months, 4 days, 6 hours, 30 minutes Bad (down since 2025-07-20 18:34:58 UTC)
Tags:exe LummaStealer opendir

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-06-18TORRENTOLD-1.exeexe 66b6fc4a116af7fc4749b6e135206895770cd20344f66b0e1a15a7064041bf0aVirustotal results 44.44%LummaStealer
2025-06-10TORRENTOLD-1.exeexe ff8f729eb7a69bee300d0fbf2b5e1a584b4377fe63ab8df1ee92b4b336eb5059Virustotal results 44.44% 
2025-05-18TORRENTOLD-1.exeexe 796ce3e06bc10916427b847a1b6c2f1eaa9904f95db66e35c28cebec34efc9c5n/aLummaStealer
2025-04-22TORRENTOLD-1.exeexe cdd2f93f781ac93b6c702e9293fdc033ceab5069b657a401fd54a266283260dan/a 
2025-04-12TORRENTOLD-1.exeexe 4ef46582ae95f961c0a0af8262de20681d9fc34ab18ead54a634448c077fd82dn/a LummaStealer
2025-03-23n/aexe 8c0b11ccc08ca9295f15cc23733ce76f88ccb51f06435f29c32ebd200775118bn/aLummaStealer
2025-03-22n/aexe 5b0cc394aecf126212b825164262abe760911ee32d9b3c6aa1f1d3afe328c6f9Virustotal results 30.14% 
2025-03-18n/aexe b80b32ff1d730cfc947db68a4fc546576195bf302d1a05eee31b988fd53ea132Virustotal results 81.94% LummaStealer