URLhaus Database

You are currently viewing the URLhaus database entry for http://216.9.225.23/debug.sh4 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3838913
URL: http://216.9.225.23/debug.sh4
URL Status:flame Online (spreading malware for 22 days, 15 hours, 9 minutes)
Host: 216.9.225.23
Date added:2026-05-04 23:10:16 UTC
Threat:Malware download Malware download
Reporter: botnetkiller
Abuse complaint sent (?): Yes (2026-05-04 23:11:11 UTC to info{at}whitelabelservices[dot]us)
Tags:elf mirai link SuperH ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-05-10n/aelf cd443eed8f0ba949b67742d331c54997323d008d698ce3638cd9bb5f17452ccfn/aMirai
2026-05-09n/aelf 296daf3565d56d80065162c52c0fbc4cf24d7fd0be66da6654acce44d26ee8e4n/aMirai
2026-05-09n/aelf 464cb7488405b11303cc6c4a1e53f6c9e24bfcfa09d119ae8cbe82bc46bac27en/aMirai
2026-05-04n/aelf 608cb699276d1e39bc59a9e5970c45c525c3a898e13335c174b30e2159c448e0n/aMirai