URLhaus Database

You are currently viewing the URLhaus database entry for http://85.203.4.64/client.exe which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry

ID:	3906114
URL:	http://85.203.4.64/client.exe
URL Status:	Online (spreading malware for 1 month, 27 days, 14 hours, 30 minutes)
Host:	85.203.4.64
Date added:	2026-08-20 07:38:08 UTC
Threat:	Malware download
Reporter:	abuse_ch
Abuse complaint sent (?):	Yes (2026-08-20 07:39:22 UTC to nantawat[dot]pr{at}cloudforest[dot]co[dot]th)
Tags:	AsyncRAT exe

Payload delivery

The table below documents all payloads that URLhaus retrieved from this particular URL.

Firstseen	Filename	File Type	Payload (SHA256)	VT	Signature
2026-10-16	client.exe	exe	2d29b6ca233a505d01e7d48bd0055a7cd2fd8c590d7e9bd132b8e9b55891c826	n/a
2026-10-12	client.exe	exe	2061cd5ec97df3a404d503440dee6e81533591cb8b1fe5b094e750c14f04db65	n/a
2026-10-11	client.exe	exe	172cb9ab2e82ead2757946af852df3e8569cb0ce4dbc9229f7b7e38cedaed11f	n/a
2026-10-07	client.exe	exe	d72338fe12367fe98c61f96e877035cf5c4caf0d2542b2e3922bd6e8afce2cb8	n/a
2026-09-19	client.exe	exe	da9bb5422c3fc73fc27daa8f10c715b27090f883811a6ba7bd84d3228a64e0fc	n/a
2026-09-12	client.exe	exe	25fd0de450dfcefe21d512f84a9da7ad528729b103952e1067179936b3351016	n/a
2026-09-04	client.exe	exe	f9b40dc1f971316dc16b94070a4d8a50df57bd9114cdb1a139bc95e6c499551c	n/a
2026-08-20	client.exe	exe	ef934adf694468560d1c78ec13639dbe21bc5cb93cefee0d1949043479dff61a	n/a
2026-08-20	client.exe	exe	6c03a02ccbf0d1b28709d7df24eecd14d64822851ad881531959b05ce56cc795	n/a	AsyncRAT