URLhaus Database

You are currently viewing the URLhaus database entry for http://103.176.20.59/skid.arm which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3609786
URL: http://103.176.20.59/skid.arm
URL Status:Offline
Host: 103.176.20.59
Date added:2025-08-23 07:35:24 UTC
Last online:2025-09-26 07:XX:XX UTC
Threat:Malware download Malware download
Reporter: abuse_ch
Abuse complaint sent (?): Yes (2025-08-23 13:54:11 UTC to hm-changed{at}vnnic[dot]vn)
Takedown time:1 month, 3 days, 17 hours, 10 minutes Bad (down since 2025-09-26 07:05:01 UTC)
Tags:elf mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-09-21skid.armelf 8a235a9336092da5a5fd75dc7c04bf109a796cab8cbe52666f972c2c5f3ff285Virustotal results 35.94%Mirai
2025-09-16skid.armelf e16a5e543be159372994cf2bd528b703cfc4ebe667e153a34de20e13de0bc265n/aMirai
2025-09-11skid.armelf d569e9b685ea3cd1c81daad967f6b9e127e4fb31febe17c2eebf90a40482954aVirustotal results 37.50%Mirai
2025-09-10skid.armelf f68a2f3b5572692941b060032b1a71358f98fc4abb377e22aadafd59a82d75e0Virustotal results 38.10%Mirai
2025-09-10skid.armelf 4c2b7fc7a982db5165a95495551b4444938c75ff8c6a986afd781a57e012ed12Virustotal results 35.94%Mirai
2025-09-09skid.armelf 2ce4337ab19513686331013d27cdf60f7c8de70da52bffe6c9ef9e548b407b95Virustotal results 37.50%Mirai
2025-09-04skid.armelf c5a2bb36a3e9ac22e9269bf1da9b36d5f3ecec9ec8171f79fe5c7458fac5f867Virustotal results 39.06%Mirai
2025-09-02skid.armelf 2a160119589e5601c27a057224aa4ab5542d5fe4140a2bda0864d8d92e1cb353Virustotal results 20.31%Mirai
2025-08-23skid.armelf 3b9fb643ee107c4fdc321425bf8801dae55aa9e5c392b6062e463ec8dde0cb9dVirustotal results 12.70%Mirai