URLhaus Database

You are currently viewing the URLhaus database entry for http://94.154.43.158/arm4 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3896646
URL: http://94.154.43.158/arm4
URL Status:flame Online (spreading malware for 2 days, 14 hours, 29 minutes)
Host: 94.154.43.158
Date added:2026-08-04 06:34:28 UTC
Threat:Malware download Malware download
Reporter: NDA0E
Abuse complaint sent (?): Yes (2026-08-04 06:35:28 UTC to abuse{at}pitline[dot]net,abusep{at}kharkiv[dot]com)
Tags:censys DEU elf geofenced mirai link ua-wget

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-08-06n/aelf dde5411d955c44f681783d58c927cd7367aa36635906573f25ba67fa59bf61c5n/aMirai
2026-08-06n/aelf d68dfaaf3fafdcf4eb14ac5fc595f28d1437da28d7a684ca57af114d3b0b6482n/aMirai
2026-08-06n/aelf a40094d0a0fcc6fad49a4fbf585327946a9870f4b285b6e1067e2aef5c9d8dfcn/aMirai
2026-08-06n/aelf 863709a3b2ad698aee58280f46803d17f4d2850536e860eece547eb874103325n/aMirai
2026-08-05n/aelf 58344ba1d657d0620d762730bcfca0fc5d7df510777c7984db227e3013f6f356n/aMirai
2026-08-04n/aelf c3a148eb2be5d3ff907f77561644fe0ecde7f39179ed4eb72850d1d6316078cen/aMirai
2026-08-04n/aelf 133d712ef14ede70885452f0e83ead522457954871c5ecce74019df4a81fa62an/aMirai
2026-08-04n/aelf 4dd104330e996a429f67c9d0a6c9dbeb72ecbc18efc6cec3b437ddb67c20b7a2n/aMirai