URLhaus Database

You are currently viewing the URLhaus database entry for http://87.120.191.44/bins/Hilix.mips which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3615049
URL: http://87.120.191.44/bins/Hilix.mips
URL Status:flame Online (spreading malware for 6 months, 27 days, 12 hours, 26 minutes)
Host: 87.120.191.44
Date added:2025-09-01 05:33:13 UTC
Threat:Malware download Malware download
Reporter: botnetkiller
Abuse complaint sent (?): Yes (2025-09-01 05:34:14 UTC to abuse{at}vpsvault[dot]host)
Tags:elf geofenced mips mirai link ua-wget USA

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-03-26Hilix.mipself e091d927a5337966ed839e5cc8c78cf8d8ded3f6d189360e3f6cd4fd1fb19f81n/aMirai
2026-03-17Hilix.mipself 2be492bfee9ab774a06c31e614ea4864d0fac0777b32eff42c2d172258be3fbcn/aMirai
2026-02-28Hilix.mipself 2e6c6f5a0532054eea876c6d225f1e70d8d24d9952d6aecef799cb6948bc9c0an/aMirai
2026-02-05Hilix.mipself 786b60bd0ec72ddd6b6a5b3862941f60ad4a57283430d4f6e31d334e3c3071e6n/aMirai
2025-09-16Hilix.mipself f4c0d28e1618faea7fa5cce0a8a00459c14b1311e592a8c7e7dbbf41d5788c6an/aMirai
2025-09-01Hilix.mipself c300eaaceb6f174184c70a5a969cec233d2d39880a3522067e3812c26b8b2d24n/aMirai