URLhaus Database

You are currently viewing the URLhaus database entry for http://119.91.141.214:1234/Photo.scr which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

Add tag Remove tag Perform URL rescan Delete this URL Report a False Positive
ID:3699967
URL: http://119.91.141.214:1234/Photo.scr
URL Status:flame Online (spreading malware for 6 months, 21 days, 5 hours, 18 minutes)
Host: 119.91.141.214
Date added:2025-11-08 07:35:06 UTC
Threat:Malware download Malware download
Reporter: Riordz
Abuse complaint sent (?): Yes (2025-11-08 07:36:20 UTC to abuse{at}tencent[dot]com,abuse{at}qq[dot]com,jsquare{at}tencent[dot]com,dreamsruan{at}tencent[dot]com,noc{at}tencent[dot]com,ipas{at}cnnic[dot]cn)
Tags:CoinMiner

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-05-15Photo.screxe 4fc4bb0a0e41f654ea853daf0cf83bdeed62e9870d3dffdd4d7033e4890fdd47n/a CoinMiner
2026-03-18Photo.screxe 1ca0aa0caf5cbf62daf160ea2a893500ad6c7df2f11dcb4ba5a428d254528bc8n/a 
2026-03-17Photo.screxe 12f81a9ba0f2a736fc73d5f856034e643d153665c58c02a33380d73d6944c8fan/a CoinMiner
2026-03-05Photo.screxe eba19969207f461f74d67f791a03e7acd8d3dce7492b2d1e8c341641cb1052b7n/a 
2025-12-03Photo.screxe 4895a8156d36bcfc35300128680bdd47115c4b1b7400d68e848aca2d0903464eVirustotal results 65.28% CoinMiner
2025-12-02Photo.screxe eaf34aa272aa6550ae45d504c10f4d90b6609ec7a57bff4ba4a8e8f273e2736fVirustotal results 3.17% CoinMiner
2025-11-13Photo.screxe ef3f9ba2664eab738bf50c55a56106e0a07eab085dbc6000b9ae43e8f576ff7dn/a CoinMiner
2025-11-08Photo.screxe 617e6896100c4289af8ec35ce7b719ea50c18d006b1e4e4c5fefdbee65b6fbbdVirustotal results 1.59% CoinMiner