URLhaus Database

You are currently viewing the URLhaus database entry for http://160.30.159.104/arm5 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3772858
URL: http://160.30.159.104/arm5
URL Status:flame Online (spreading malware for 21 days, 20 hours, 33 minutes)
Host: 160.30.159.104
Date added:2026-02-06 04:32:15 UTC
Threat:Malware download Malware download
Reporter: tolisec
Abuse complaint sent (?): Yes (2026-02-06 04:33:12 UTC to hm-changed{at}vnnic[dot]vn)
Tags:elf mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-02-27n/aelf e809fab39d54f7e46e4c164858b7900f6b46981a9de3d8c6e3d611bfcb0c8c0dn/aMirai
2026-02-09n/aelf 3c54b06a36a4bc0d35bda907e1929ce34fc8f2024df6b582e3e3c2d355ee95aen/aMirai
2026-02-07n/aelf 3b87a28e6591db2f6542d2fd7141dcf67177923a0352247c0f73c964b08bc870n/aMirai
2026-02-06n/aelf c2a4ef2eb8c5ca609540bd3dede8cdacb0505ee466f439733deba18a73eccdbfn/aMirai