URLhaus Database

You are currently viewing the URLhaus database entry for http://31.56.209.222/zero.armv4l which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3857190
URL: http://31.56.209.222/zero.armv4l
URL Status:Offline
Host: 31.56.209.222
Date added:2026-06-01 20:43:18 UTC
Last online:2026-06-20 09:XX:XX UTC
Threat:Malware download Malware download
Reporter: tolisec
Abuse complaint sent (?): Yes (2026-06-01 20:44:10 UTC to abuse{at}swissnetwork[dot]io)
Takedown time:18 days, 12 hours, 52 minutes Bad (down since 2026-06-20 09:36:58 UTC)
Tags:elf LeetHozer mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-06-10n/aelf ba47271532231975d45c37851b13b4edd6dbe7a1be4fef2e9634c66dcc63c02en/aLeetHozer
2026-06-09n/aelf 11c576b2c3eced4cafcf1b1c9fa2156d2687b28288daa46b9d3a78e976b1d912n/aMirai
2026-06-07n/aelf a4243003d161dd8fd18ceda406aa86693a89cb8db1da4f0955dba0d7d128951en/aMirai
2026-06-06n/aelf 0464d1d248e1b12a39e4e43a84e5bbbb2d4726c5c1aafbb7ecefea334d1528den/aMirai
2026-06-06n/aelf f7cf64bb5fa4c1102645773b7f880dc34a32fa9aac77f57a017b5bf43abcf344n/aMirai
2026-06-06n/aelf 1e2b58b266af07f2787710e5fe515a1b90030e23d6f04e24a9edf015052dc55cn/aMirai
2026-06-01n/aelf 8de18340455bffb35a7df9520fb848e61c548fce9eebbccfdb7eee42fd90bd3cn/aLeetHozer