🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cc486a1eda883f3cb4aba85cac02f8049f27285d043d5181327c498c5d33946. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash: 4cc486a1eda883f3cb4aba85cac02f8049f27285d043d5181327c498c5d33946
SHA3-384 hash: dca145d4ef0784804a88aba2d857b5bb4a0e6f8587a097017046e43da165dc5db9a7fc68e4d7a8bf862500ba0cd57640
SHA1 hash: c4a7dd64a2fc71d80dcc343bc82e219ed27e4fe1
MD5 hash: 425db322db75766a10d2fa56d8be93e9
humanhash: nevada-bulldog-batman-alabama
File name:busybox.sh
Download: download sample
Signature Mirai
File size:1'187 bytes
First seen:2025-06-18 17:39:36 UTC
Last seen:2025-06-19 08:16:12 UTC
File type: sh
MIME type:text/plain
ssdeep 24:jcsk+Acsl0AcsQGNIxyzAcszXKLAcsyAAcsPMAcsWYAcsyyVAcsrMAcsQKAcsd8W:jdk+Adl0AdYoAdzXcAdyAAdPMAdWYAdz
TLSH T180215CFD005CF9064E899E99A1296E29E908C9D670D48ECCF55DD472C2AFE38A13C60D
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://103.149.252.178/skibidi/cutearm1bc137841445a32184b981463f26cf92cd5faee96c6530b71788322f6e02b74c Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutearm531bd74459680c387a1eb10667a44b7691101778b2eee79dd9e33c27cf18af7eb Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutearm6e7ed00ebd7a3124bf74c3a1e5de27d55daeba1a6c6dd9b507a5c4435eb87e78c Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutearm7b2510b90cc924b8bde71cb86f3875a466de3a4dff19efa2cc4d93173f38a3381 Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutem68kfc1848906eb6cf539a5009dfa5cbd87b822287242ceb9e04e7bd6f747a1f0a6e Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutemips994d3872166fd7b39d2c05628c86417140f456637e811f9235792c5b667947dd Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutemipsel88fcbf23a8273804bfb89bd72ef93c0d3d5d899a239cde333396d34184d15293 Miraielf ua-wget
http://103.149.252.178/skibidi/cutepowerpcf9d2eec0a3481cac09af0aa96723e831d4a66af87e48347fde818281d62af70e Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutesh4245daaf02866c349c32028beeaec0c428a85ad4a0fe3df40449ad0cdd2942db6 Miraielf gafgyt mirai ua-wget
http://103.149.252.178/skibidi/cutex8672f6704fdb711d1ba20c96a7ef73e7ac2cd41943cc4bdd417cab03417be1eb55 Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutex86_64a6880d908d5fa479ce234db7beed1598d5c8e9304696d3af7dc8cfee07a55e7e Miraielf mirai ua-wget
http://103.149.252.178/skibidi/cutex86_32d2d4f746e5138d2ec2e13b2331be588a2c09b94df979cf30fb128797c5315a64 Miraielf mirai ua-wget

Intelligence


File Origin
# of uploads :
2
# of downloads :
79
Origin country :
DE DE
Vendor Threat Intelligence
Status:
terminated
Behavior Graph:
%3 guuid=b4dcdb86-1900-0000-492e-d07eeb080000 pid=2283 /usr/bin/sudo guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288 /tmp/sample.bin guuid=b4dcdb86-1900-0000-492e-d07eeb080000 pid=2283->guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288 execve guuid=d07cee88-1900-0000-492e-d07ef2080000 pid=2290 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=d07cee88-1900-0000-492e-d07ef2080000 pid=2290 execve guuid=27118cbe-1900-0000-492e-d07e1f090000 pid=2335 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=27118cbe-1900-0000-492e-d07e1f090000 pid=2335 execve guuid=0cd4eebe-1900-0000-492e-d07e20090000 pid=2336 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=0cd4eebe-1900-0000-492e-d07e20090000 pid=2336 clone guuid=d9ee77c0-1900-0000-492e-d07e23090000 pid=2339 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=d9ee77c0-1900-0000-492e-d07e23090000 pid=2339 execve guuid=917c37f7-1900-0000-492e-d07e93090000 pid=2451 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=917c37f7-1900-0000-492e-d07e93090000 pid=2451 execve guuid=d34a89f7-1900-0000-492e-d07e95090000 pid=2453 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=d34a89f7-1900-0000-492e-d07e95090000 pid=2453 clone guuid=ac1815f8-1900-0000-492e-d07e97090000 pid=2455 /usr/bin/busybox net send-data guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=ac1815f8-1900-0000-492e-d07e97090000 pid=2455 execve guuid=0ec26114-1a00-0000-492e-d07ed4090000 pid=2516 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=0ec26114-1a00-0000-492e-d07ed4090000 pid=2516 execve guuid=b0db2f15-1a00-0000-492e-d07ed6090000 pid=2518 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=b0db2f15-1a00-0000-492e-d07ed6090000 pid=2518 clone guuid=dcdb4115-1a00-0000-492e-d07ed7090000 pid=2519 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=dcdb4115-1a00-0000-492e-d07ed7090000 pid=2519 execve guuid=bc41984c-1a00-0000-492e-d07e400a0000 pid=2624 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=bc41984c-1a00-0000-492e-d07e400a0000 pid=2624 execve guuid=43a7184d-1a00-0000-492e-d07e420a0000 pid=2626 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=43a7184d-1a00-0000-492e-d07e420a0000 pid=2626 clone guuid=1403d64e-1a00-0000-492e-d07e480a0000 pid=2632 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=1403d64e-1a00-0000-492e-d07e480a0000 pid=2632 execve guuid=e989ca84-1a00-0000-492e-d07eb30a0000 pid=2739 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=e989ca84-1a00-0000-492e-d07eb30a0000 pid=2739 execve guuid=9f2c1f85-1a00-0000-492e-d07eb50a0000 pid=2741 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=9f2c1f85-1a00-0000-492e-d07eb50a0000 pid=2741 clone guuid=bd1be785-1a00-0000-492e-d07eb90a0000 pid=2745 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=bd1be785-1a00-0000-492e-d07eb90a0000 pid=2745 execve guuid=2bc789c9-1a00-0000-492e-d07e030b0000 pid=2819 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=2bc789c9-1a00-0000-492e-d07e030b0000 pid=2819 execve guuid=476c0eca-1a00-0000-492e-d07e050b0000 pid=2821 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=476c0eca-1a00-0000-492e-d07e050b0000 pid=2821 clone guuid=406d29cb-1a00-0000-492e-d07e090b0000 pid=2825 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=406d29cb-1a00-0000-492e-d07e090b0000 pid=2825 execve guuid=53ca9a00-1b00-0000-492e-d07e6a0b0000 pid=2922 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=53ca9a00-1b00-0000-492e-d07e6a0b0000 pid=2922 execve guuid=dcccd300-1b00-0000-492e-d07e6b0b0000 pid=2923 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=dcccd300-1b00-0000-492e-d07e6b0b0000 pid=2923 clone guuid=2dc1a701-1b00-0000-492e-d07e6e0b0000 pid=2926 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=2dc1a701-1b00-0000-492e-d07e6e0b0000 pid=2926 execve guuid=e3c70338-1b00-0000-492e-d07ebe0b0000 pid=3006 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=e3c70338-1b00-0000-492e-d07ebe0b0000 pid=3006 execve guuid=30799638-1b00-0000-492e-d07ec00b0000 pid=3008 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=30799638-1b00-0000-492e-d07ec00b0000 pid=3008 clone guuid=19ee423c-1b00-0000-492e-d07ec90b0000 pid=3017 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=19ee423c-1b00-0000-492e-d07ec90b0000 pid=3017 execve guuid=581a4b67-1b00-0000-492e-d07e270c0000 pid=3111 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=581a4b67-1b00-0000-492e-d07e270c0000 pid=3111 execve guuid=0ebbbb67-1b00-0000-492e-d07e290c0000 pid=3113 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=0ebbbb67-1b00-0000-492e-d07e290c0000 pid=3113 clone guuid=63ae1869-1b00-0000-492e-d07e2c0c0000 pid=3116 /usr/bin/busybox net send-data guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=63ae1869-1b00-0000-492e-d07e2c0c0000 pid=3116 execve guuid=6426d185-1b00-0000-492e-d07e6c0c0000 pid=3180 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=6426d185-1b00-0000-492e-d07e6c0c0000 pid=3180 execve guuid=98766a86-1b00-0000-492e-d07e6d0c0000 pid=3181 /usr/bin/dash guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=98766a86-1b00-0000-492e-d07e6d0c0000 pid=3181 clone guuid=e9787f86-1b00-0000-492e-d07e6e0c0000 pid=3182 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=e9787f86-1b00-0000-492e-d07e6e0c0000 pid=3182 execve guuid=b4b102bd-1b00-0000-492e-d07ea80c0000 pid=3240 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=b4b102bd-1b00-0000-492e-d07ea80c0000 pid=3240 execve guuid=2c38f2bd-1b00-0000-492e-d07ea90c0000 pid=3241 /home/sandbox/cutex86_64 net guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=2c38f2bd-1b00-0000-492e-d07ea90c0000 pid=3241 execve guuid=d70837be-1b00-0000-492e-d07eac0c0000 pid=3244 /usr/bin/busybox net send-data write-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=d70837be-1b00-0000-492e-d07eac0c0000 pid=3244 execve guuid=add857ef-1b00-0000-492e-d07eef0c0000 pid=3311 /usr/bin/chmod guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=add857ef-1b00-0000-492e-d07eef0c0000 pid=3311 execve guuid=0de1e2ef-1b00-0000-492e-d07ef00c0000 pid=3312 /home/sandbox/cutex86_32 net guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=0de1e2ef-1b00-0000-492e-d07ef00c0000 pid=3312 execve guuid=663f2af0-1b00-0000-492e-d07ef30c0000 pid=3315 /usr/bin/rm delete-file guuid=1da99988-1900-0000-492e-d07ef0080000 pid=2288->guuid=663f2af0-1b00-0000-492e-d07ef30c0000 pid=3315 execve b95ce511-3591-5114-995b-9ce77bb440cb 103.149.252.178:80 guuid=d07cee88-1900-0000-492e-d07ef2080000 pid=2290->b95ce511-3591-5114-995b-9ce77bb440cb send: 93B guuid=d9ee77c0-1900-0000-492e-d07e23090000 pid=2339->b95ce511-3591-5114-995b-9ce77bb440cb send: 94B guuid=ac1815f8-1900-0000-492e-d07e97090000 pid=2455->b95ce511-3591-5114-995b-9ce77bb440cb send: 94B guuid=dcdb4115-1a00-0000-492e-d07ed7090000 pid=2519->b95ce511-3591-5114-995b-9ce77bb440cb send: 94B guuid=1403d64e-1a00-0000-492e-d07e480a0000 pid=2632->b95ce511-3591-5114-995b-9ce77bb440cb send: 94B guuid=bd1be785-1a00-0000-492e-d07eb90a0000 pid=2745->b95ce511-3591-5114-995b-9ce77bb440cb send: 94B guuid=406d29cb-1a00-0000-492e-d07e090b0000 pid=2825->b95ce511-3591-5114-995b-9ce77bb440cb send: 96B guuid=2dc1a701-1b00-0000-492e-d07e6e0b0000 pid=2926->b95ce511-3591-5114-995b-9ce77bb440cb send: 97B guuid=19ee423c-1b00-0000-492e-d07ec90b0000 pid=3017->b95ce511-3591-5114-995b-9ce77bb440cb send: 93B guuid=63ae1869-1b00-0000-492e-d07e2c0c0000 pid=3116->b95ce511-3591-5114-995b-9ce77bb440cb send: 93B guuid=e9787f86-1b00-0000-492e-d07e6e0c0000 pid=3182->b95ce511-3591-5114-995b-9ce77bb440cb send: 96B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=2c38f2bd-1b00-0000-492e-d07ea90c0000 pid=3241->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=8b3328be-1b00-0000-492e-d07eaa0c0000 pid=3242 /home/sandbox/cutex86_64 guuid=2c38f2bd-1b00-0000-492e-d07ea90c0000 pid=3241->guuid=8b3328be-1b00-0000-492e-d07eaa0c0000 pid=3242 clone guuid=17df30be-1b00-0000-492e-d07eab0c0000 pid=3243 /home/sandbox/cutex86_64 net send-data zombie guuid=8b3328be-1b00-0000-492e-d07eaa0c0000 pid=3242->guuid=17df30be-1b00-0000-492e-d07eab0c0000 pid=3243 clone fbf34c2e-28ca-512d-9b01-9151dfcb2221 103.149.252.178:5683 guuid=17df30be-1b00-0000-492e-d07eab0c0000 pid=3243->fbf34c2e-28ca-512d-9b01-9151dfcb2221 send: 78B guuid=de993ebe-1b00-0000-492e-d07ead0c0000 pid=3245 /usr/bin/dash guuid=17df30be-1b00-0000-492e-d07eab0c0000 pid=3243->guuid=de993ebe-1b00-0000-492e-d07ead0c0000 pid=3245 execve guuid=42b4d5be-1b00-0000-492e-d07eaf0c0000 pid=3247 /usr/bin/dash guuid=17df30be-1b00-0000-492e-d07eab0c0000 pid=3243->guuid=42b4d5be-1b00-0000-492e-d07eaf0c0000 pid=3247 execve guuid=d70837be-1b00-0000-492e-d07eac0c0000 pid=3244->b95ce511-3591-5114-995b-9ce77bb440cb send: 96B guuid=59e871be-1b00-0000-492e-d07eae0c0000 pid=3246 /usr/bin/mkdir guuid=de993ebe-1b00-0000-492e-d07ead0c0000 pid=3245->guuid=59e871be-1b00-0000-492e-d07eae0c0000 pid=3246 execve guuid=3dd334bf-1b00-0000-492e-d07eb00c0000 pid=3248 /usr/bin/mv guuid=42b4d5be-1b00-0000-492e-d07eaf0c0000 pid=3247->guuid=3dd334bf-1b00-0000-492e-d07eb00c0000 pid=3248 execve guuid=c23ebbbf-1b00-0000-492e-d07eb10c0000 pid=3249 /usr/bin/chmod guuid=42b4d5be-1b00-0000-492e-d07eaf0c0000 pid=3247->guuid=c23ebbbf-1b00-0000-492e-d07eb10c0000 pid=3249 execve guuid=0de1e2ef-1b00-0000-492e-d07ef00c0000 pid=3312->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ee2315f0-1b00-0000-492e-d07ef10c0000 pid=3313 /home/sandbox/cutex86_32 guuid=0de1e2ef-1b00-0000-492e-d07ef00c0000 pid=3312->guuid=ee2315f0-1b00-0000-492e-d07ef10c0000 pid=3313 clone guuid=883823f0-1b00-0000-492e-d07ef20c0000 pid=3314 /home/sandbox/cutex86_32 net zombie guuid=ee2315f0-1b00-0000-492e-d07ef10c0000 pid=3313->guuid=883823f0-1b00-0000-492e-d07ef20c0000 pid=3314 clone guuid=883823f0-1b00-0000-492e-d07ef20c0000 pid=3314->fbf34c2e-28ca-512d-9b01-9151dfcb2221 con guuid=3f3f3ff0-1b00-0000-492e-d07ef40c0000 pid=3316 /usr/bin/dash guuid=883823f0-1b00-0000-492e-d07ef20c0000 pid=3314->guuid=3f3f3ff0-1b00-0000-492e-d07ef40c0000 pid=3316 execve guuid=b7f42bf1-1b00-0000-492e-d07ef70c0000 pid=3319 /usr/bin/dash guuid=883823f0-1b00-0000-492e-d07ef20c0000 pid=3314->guuid=b7f42bf1-1b00-0000-492e-d07ef70c0000 pid=3319 execve guuid=b007aaf0-1b00-0000-492e-d07ef50c0000 pid=3317 /usr/bin/mkdir guuid=3f3f3ff0-1b00-0000-492e-d07ef40c0000 pid=3316->guuid=b007aaf0-1b00-0000-492e-d07ef50c0000 pid=3317 execve guuid=419c5af1-1b00-0000-492e-d07ef80c0000 pid=3320 /usr/bin/mv guuid=b7f42bf1-1b00-0000-492e-d07ef70c0000 pid=3319->guuid=419c5af1-1b00-0000-492e-d07ef80c0000 pid=3320 execve guuid=e641b2f1-1b00-0000-492e-d07efa0c0000 pid=3322 /usr/bin/chmod guuid=b7f42bf1-1b00-0000-492e-d07ef70c0000 pid=3319->guuid=e641b2f1-1b00-0000-492e-d07efa0c0000 pid=3322 execve
Threat name:
Linux.Downloader.SAgnt
Status:
Malicious
First seen:
2025-06-18 17:40:49 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  3/5
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:RANSOMWARE
Author:ToroGuitar

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 4cc486a1eda883f3cb4aba85cac02f8049f27285d043d5181327c498c5d33946

(this sample)

  
Delivery method
Distributed via web download

Comments