URLhaus Database

You are currently viewing the URLhaus database entry for http://cnc.zinomc.com/bot.arm which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3605915
URL: http://cnc.zinomc.com/bot.arm
URL Status:Offline
Host: cnc.zinomc.com
Date added:2025-08-18 15:36:22 UTC
Last online:2025-12-24 15:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Abused domain (botnet C&C)
SURBL :Not blocked
Quad9 :Blocked
AdGuard :Blocked
Cloudflare :Blocked
dns0.eu :Not blocked
ProtonDNS :Blocked
OpenBLD :Blocked
DNS4EU :Blocked
Reporter: BlinkzSec
Abuse complaint sent (?): Yes (2025-12-20 12:46:16 UTC to mh[dot]kctipl{at}gmail[dot]com)
Takedown time:4 months, 7 days, 23 hours, 54 minutes Bad (down since 2025-12-24 15:31:56 UTC)
Tags:botnetdomain elf mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-12-20bot.armelf 3f93796d0e1e97dada8b9e8939018106d8b2edd017ea4717bf5e8e522a0b3b72n/aMirai
2025-12-16bot.armelf 9233a96f6cc89f7414df90f601583f72a21b1f9eadead4e92ca220ad9cbb3529n/aMirai
2025-12-05bot.armelf e379285742e4ecccd3defd15690c8b988eec922da217971b59103c36f4dac814n/aMirai
2025-11-01bot.armelf 69727e5aa9ee80fb61d88303a84ea2e96ad8654d9ef279504ab72c3a45ef8cfdn/aMirai
2025-10-22bot.armelf 904a2c2e6a4535a1cfa71b05f7d58a05d2f150623470aeb5ff533c9f01edafa8n/aMirai
2025-08-26bot.armelf 21f3228e54bc5f221ea8af4bc278b20cb9b0a280537a6afea294af25e82659afVirustotal results 45.31%Mirai
2025-08-21bot.armelf bf52aa2882c92572e329a92518500bf38ddf5cf07afb08b8a7a3f6f9fb6b6001Virustotal results 56.25%Mirai
2025-08-18bot.armelf dea9e875812436f4f9099b65eb16e4edb2b1d0bd341d854aaac37bd2bcd5d5d3Virustotal results 62.50%Mirai