URLhaus Database

You are currently viewing the URLhaus database entry for http://221.160.177.162:3493/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry




ID:454373
URL: http://221.160.177.162:3493/Mozi.m+-O+/tmp/netgear;sh+netgear&curpath=/&currentsetting.htm=1
URL Status:Offline
Host: 221.160.177.162
Date added:2020-09-06 14:52:06 UTC
Last online:2020-09-07 03:XX:XX UTC
Threat:Malware download Malware download
Reporter: zbetcheckin
Abuse complaint sent (?): Yes (2020-09-06 14:54:03 UTC to irt{at}nic[dot]or[dot]kr)
Takedown time:13 hours, 1 minutes Good (down since 2020-09-07 03:55:10 UTC)
Tags:bashlite elf gafgyt link mirai link

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2020-09-07n/aelf b9148379ed5d8a4b8ad58ec9f2e755ddef9d90a16522c7df00702ae73272a6f8Virustotal results 46.55% 
2020-09-07n/aelf 2e1a8054c5a8cca472a377cbb33c7c115b12831c24c4e523d3c59732ccc028d8Virustotal results 40.00% 
2020-09-06n/aelf d9b497cae877d5657ac01d54b941f5f452e252c02698d1db8edddc1456de540cVirustotal results 35.59% 
2020-09-06n/aelf e3ee24ce5e90ceeeb100163ae760ffa77844bbf8c37de87fed1840c5fe2404abVirustotal results 46.67% 
2020-09-06n/aelf c2481fa7a1c3d2310a8119c8081466b84e9636994af76d6ec3f935b2e4e3e711Virustotal results 35.00% 
2020-09-06n/aelf e15e93db3ce3a8a22adb4b18e0e37b93f39c495e4a97008f9b1a9a42e1fac2b0Virustotal results 72.88%Mirai