URLhaus Database

You are currently viewing the URLhaus database entry for http://130.12.180.64/bins/nklarm7 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3739154
URL: http://130.12.180.64/bins/nklarm7
URL Status:flame Online (spreading malware for 3 days, 5 hours, 37 minutes)
Host: 130.12.180.64
Date added:2025-12-21 14:54:31 UTC
Threat:Malware download Malware download
Reporter: NDA0E
Abuse complaint sent (?): Yes (2025-12-21 14:55:30 UTC to abuse{at}virtualine[dot]org)
Tags:elf mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2025-12-24n/aelf 771f3320988a6433b2a3111af84ac202e51074ecfd76c03a6ffb31a1ca419943n/aMirai
2025-12-24n/aelf e5132364159e296d43da18a6c0857a54738d608b227fad43396ae51e998f5610n/aMirai
2025-12-23n/aelf 068b149939824539fd6ede07625d175f76ebcda67d3816f1591fbc57e5e8e0d8n/aMirai
2025-12-22n/aelf d76029d827359aba3a619bf54644c00513150243b406937e0708eb1282e48886n/aMirai
2025-12-21n/aelf f319eeec62edf5f1d620c09370cee79f461345c98916778e219ed16155a55549n/aMirai
2025-12-21n/aelf a8a957c59b97f53123a9406ded737c532249bb21ecd290c48bdcb9c2a378542en/aMirai