URLhaus Database

You are currently viewing the URLhaus database entry for http://130.12.180.20:36695/sh4 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3745422
URL: http://130.12.180.20:36695/sh4
URL Status:Offline
Host: 130.12.180.20
Date added:2025-12-28 17:21:08 UTC
Last online:2026-01-31 18:XX:XX UTC
Threat:Malware download Malware download
Reporter: botnetkiller
Abuse complaint sent (?): Yes (2025-12-28 17:22:13 UTC to abuse{at}virtualine[dot]org)
Takedown time:1 month, 4 days, 1 hours, 18 minutes Bad (down since 2026-01-31 18:40:27 UTC)
Tags:elf geofenced mirai link SuperH ua-wget USA

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-01-26n/aelf b69541b3230b41bb3c596fba4f79aa8b0cec4d67c147597f74412f44f395c43an/aMirai
2026-01-23n/aelf 0057626e8a5345ea434dc4f3afffb6a6e115ef1b1e684738143cf1125979eca9n/aMirai
2026-01-20n/aelf b272ce3b8fc42545cb06d04ab1fa893c3800596c998f03d1cf797f149f1700a2n/aMirai
2026-01-12n/aelf 742c82579806a741b4fb8203886b9f83b7fde19fbe3b35550da413597002f75dn/aMirai
2026-01-02n/aelf d69985a93616f84f1b2df8db4643e4c10a4dd84b575b643310694e5dbab53fe4n/aMirai
2026-01-01n/aelf f44aebd5b2a9f8e1d9e992a1e8726f451f7d7ee9c773965a8bb9e0dd7e48bd89n/aMirai
2025-12-28n/aelf 7916e2f6e47d71fcc0a48bf85d4bce2a61623035bc91eda55f036f1f6482a956n/aMirai