MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60ce9c480fc68325c0c7f2f2956356e02417925f7efaba44409c4b6817c6bfb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Mirai


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments

SHA256 hash: 60ce9c480fc68325c0c7f2f2956356e02417925f7efaba44409c4b6817c6bfb2
SHA3-384 hash: 22586afde0f1285e8b148327accb3f888827ae788bc0c2fd2b0d71a2c71fb7fa911d1a8f79c10b3eb5ec7cc5eeea52d9
SHA1 hash: bec6f82bc6e3225c5f7bb1a4b70faee63bc325c0
MD5 hash: 16b1402ff1397154b7f5a4fc745d4c78
humanhash: beryllium-five-mars-cat
File name:c.sh
Download: download sample
Signature Mirai
File size:1'065 bytes
First seen:2026-08-27 16:49:49 UTC
Last seen:2026-08-27 18:28:36 UTC
File type: sh
MIME type:text/plain
ssdeep 12:oew6XAQewIsQewmv4Qew7c0QewUPXAQewX2mQewgRVR/BgRmPQew+epw+sQewG4K:XhLbRVR/2RmWW6U
TLSH T1CC115CCCE256C683870F8CC475CEF78E593285F69A399E34B32046637C89144B823B1E
Magika batch
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://103.77.246.150/AGbot.armv4l5639cd12033d467d66b54be3dd4b8690ee37e66e22f2244517ee271d3d76696f Miraimirai wraith
http://103.77.246.150/AGbot.armv5lc12d9da55bc424428978518649958b96cc69e656becc434ebabcdff611aad275 Miraimirai wraith
http://103.77.246.150/AGbot.armv6l266feb3ba73d372c4296c2c915cdca8a99385608ad5939608184bf5b6088d6b4 Miraimirai wraith
http://103.77.246.150/AGbot.armv7la68bbc13289408eee17179859665e093c1652968d3828ac3c9105103071164e5 Miraimirai wraith
http://103.77.246.150/AGbot.mips2d1d15d9b95d9a0b1be2ab8123b42c574d608d33889ce0ea66ae58f85343292a Miraielf mirai ua-wget
http://103.77.246.150/AGbot.mipsele8ea23e292f0081715d4bbf4dc5e73a31a37f9d85d0c4dcc09e2a0cea39a6943 Miraielf mirai ua-wget
http://103.77.246.150/AGbot.powerpcf52b133cf9dddd23f290363558a876d4bea367f0980b552ce20b9f2c9ccf277a Miraielf mirai ua-wget
http://103.77.246.150/AGbot.x86_64e3ad6b39c29575a0a2cfbd14414297de7f7a81416ce1b7635762cc1362b55e4e Miraielf mirai ua-wget
http://103.77.246.150/AGbot.i4866d835558331d381e8066d07479c2e602f5c16cd3d14e9cf19d3e8a3cfa71f5bb Miraielf mirai ua-wget
http://103.77.246.150/AGbot.i586b717c65d1876c0945bb8824a9324734b14e0da5ccde1a73244cfeeb82bd2b1be Miraielf mirai ua-wget
http://103.77.246.150/AGbot.i6862dfb415d1a52ab0e3851c880913729634452ef4433d11ac89a3fb7d95804d046 Miraielf mirai ua-wget

Intelligence


File Origin
# of uploads :
2
# of downloads :
74
Origin country :
CZ CZ
Vendor Threat Intelligence
No detections
Status:
terminated
Behavior Graph:
%3 guuid=ca8e9b2e-1a00-0000-556b-1deebd0b0000 pid=3005 /usr/bin/sudo guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013 /tmp/sample.bin guuid=ca8e9b2e-1a00-0000-556b-1deebd0b0000 pid=3005->guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013 execve guuid=6b160d32-1a00-0000-556b-1deec90b0000 pid=3017 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=6b160d32-1a00-0000-556b-1deec90b0000 pid=3017 execve guuid=8bc41d52-1a00-0000-556b-1deef50b0000 pid=3061 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=8bc41d52-1a00-0000-556b-1deef50b0000 pid=3061 execve guuid=9202a352-1a00-0000-556b-1deef60b0000 pid=3062 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=9202a352-1a00-0000-556b-1deef60b0000 pid=3062 clone guuid=b8f3d153-1a00-0000-556b-1deef80b0000 pid=3064 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=b8f3d153-1a00-0000-556b-1deef80b0000 pid=3064 execve guuid=f9688473-1a00-0000-556b-1dee130c0000 pid=3091 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=f9688473-1a00-0000-556b-1dee130c0000 pid=3091 execve guuid=4e601074-1a00-0000-556b-1dee150c0000 pid=3093 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=4e601074-1a00-0000-556b-1dee150c0000 pid=3093 clone guuid=ddfdb674-1a00-0000-556b-1dee180c0000 pid=3096 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=ddfdb674-1a00-0000-556b-1dee180c0000 pid=3096 execve guuid=b2f11d91-1a00-0000-556b-1dee230c0000 pid=3107 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=b2f11d91-1a00-0000-556b-1dee230c0000 pid=3107 execve guuid=d484e691-1a00-0000-556b-1dee280c0000 pid=3112 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=d484e691-1a00-0000-556b-1dee280c0000 pid=3112 clone guuid=ebf47893-1a00-0000-556b-1dee2c0c0000 pid=3116 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=ebf47893-1a00-0000-556b-1dee2c0c0000 pid=3116 execve guuid=a270eab1-1a00-0000-556b-1dee4f0c0000 pid=3151 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=a270eab1-1a00-0000-556b-1dee4f0c0000 pid=3151 execve guuid=3e682bb2-1a00-0000-556b-1dee500c0000 pid=3152 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=3e682bb2-1a00-0000-556b-1dee500c0000 pid=3152 clone guuid=9bb5c6b2-1a00-0000-556b-1dee520c0000 pid=3154 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=9bb5c6b2-1a00-0000-556b-1dee520c0000 pid=3154 execve guuid=b769c3cf-1a00-0000-556b-1dee790c0000 pid=3193 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=b769c3cf-1a00-0000-556b-1dee790c0000 pid=3193 execve guuid=b4a330d0-1a00-0000-556b-1dee7b0c0000 pid=3195 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=b4a330d0-1a00-0000-556b-1dee7b0c0000 pid=3195 clone guuid=13dafad0-1a00-0000-556b-1dee7d0c0000 pid=3197 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=13dafad0-1a00-0000-556b-1dee7d0c0000 pid=3197 execve guuid=c118e2eb-1a00-0000-556b-1deeaa0c0000 pid=3242 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=c118e2eb-1a00-0000-556b-1deeaa0c0000 pid=3242 execve guuid=3e8626ec-1a00-0000-556b-1deeab0c0000 pid=3243 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=3e8626ec-1a00-0000-556b-1deeab0c0000 pid=3243 clone guuid=7541b1ec-1a00-0000-556b-1deeae0c0000 pid=3246 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=7541b1ec-1a00-0000-556b-1deeae0c0000 pid=3246 execve guuid=39159a07-1b00-0000-556b-1deed40c0000 pid=3284 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=39159a07-1b00-0000-556b-1deed40c0000 pid=3284 execve guuid=7e260408-1b00-0000-556b-1deed70c0000 pid=3287 /usr/bin/dash guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=7e260408-1b00-0000-556b-1deed70c0000 pid=3287 clone guuid=6033dd08-1b00-0000-556b-1deedb0c0000 pid=3291 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=6033dd08-1b00-0000-556b-1deedb0c0000 pid=3291 execve guuid=63330b25-1b00-0000-556b-1dee1c0d0000 pid=3356 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=63330b25-1b00-0000-556b-1dee1c0d0000 pid=3356 execve guuid=5c735825-1b00-0000-556b-1dee1d0d0000 pid=3357 /home/sandbox/AGbot.x86_64 mprotect-exec guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=5c735825-1b00-0000-556b-1dee1d0d0000 pid=3357 execve guuid=76d57525-1b00-0000-556b-1dee200d0000 pid=3360 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=76d57525-1b00-0000-556b-1dee200d0000 pid=3360 execve guuid=4fe56243-1b00-0000-556b-1dee5b0d0000 pid=3419 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=4fe56243-1b00-0000-556b-1dee5b0d0000 pid=3419 execve guuid=32a8c543-1b00-0000-556b-1dee5c0d0000 pid=3420 /home/sandbox/AGbot.i486 guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=32a8c543-1b00-0000-556b-1dee5c0d0000 pid=3420 execve guuid=179ae143-1b00-0000-556b-1dee5e0d0000 pid=3422 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=179ae143-1b00-0000-556b-1dee5e0d0000 pid=3422 execve guuid=31588163-1b00-0000-556b-1dee5f0d0000 pid=3423 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=31588163-1b00-0000-556b-1dee5f0d0000 pid=3423 execve guuid=3cf6db63-1b00-0000-556b-1dee600d0000 pid=3424 /home/sandbox/AGbot.i586 guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=3cf6db63-1b00-0000-556b-1dee600d0000 pid=3424 execve guuid=897c0064-1b00-0000-556b-1dee620d0000 pid=3426 /usr/bin/curl net send-data write-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=897c0064-1b00-0000-556b-1dee620d0000 pid=3426 execve guuid=cce75f80-1b00-0000-556b-1dee7c0d0000 pid=3452 /usr/bin/chmod guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=cce75f80-1b00-0000-556b-1dee7c0d0000 pid=3452 execve guuid=ceaec580-1b00-0000-556b-1dee7d0d0000 pid=3453 /home/sandbox/AGbot.i686 guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=ceaec580-1b00-0000-556b-1dee7d0d0000 pid=3453 execve guuid=f267f580-1b00-0000-556b-1dee7f0d0000 pid=3455 /usr/bin/rm delete-file guuid=d88b2f31-1a00-0000-556b-1deec50b0000 pid=3013->guuid=f267f580-1b00-0000-556b-1dee7f0d0000 pid=3455 execve 12b52bb4-a415-5945-b512-c7df26c46692 103.77.246.150:80 guuid=6b160d32-1a00-0000-556b-1deec90b0000 pid=3017->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=b8f3d153-1a00-0000-556b-1deef80b0000 pid=3064->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=ddfdb674-1a00-0000-556b-1dee180c0000 pid=3096->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=ebf47893-1a00-0000-556b-1dee2c0c0000 pid=3116->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=9bb5c6b2-1a00-0000-556b-1dee520c0000 pid=3154->12b52bb4-a415-5945-b512-c7df26c46692 send: 88B guuid=13dafad0-1a00-0000-556b-1dee7d0c0000 pid=3197->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=7541b1ec-1a00-0000-556b-1deeae0c0000 pid=3246->12b52bb4-a415-5945-b512-c7df26c46692 send: 91B guuid=6033dd08-1b00-0000-556b-1deedb0c0000 pid=3291->12b52bb4-a415-5945-b512-c7df26c46692 send: 90B guuid=38c36a25-1b00-0000-556b-1dee1f0d0000 pid=3359 /home/sandbox/AGbot.x86_64 delete-file net send-data zombie guuid=5c735825-1b00-0000-556b-1dee1d0d0000 pid=3357->guuid=38c36a25-1b00-0000-556b-1dee1f0d0000 pid=3359 clone bdba87e9-723a-5b19-ab78-49081f0db563 103.77.246.150:9999 guuid=38c36a25-1b00-0000-556b-1dee1f0d0000 pid=3359->bdba87e9-723a-5b19-ab78-49081f0db563 send: 935B guuid=91d88925-1b00-0000-556b-1dee210d0000 pid=3361 /home/sandbox/AGbot.x86_64 guuid=38c36a25-1b00-0000-556b-1dee1f0d0000 pid=3359->guuid=91d88925-1b00-0000-556b-1dee210d0000 pid=3361 clone guuid=76d57525-1b00-0000-556b-1dee200d0000 pid=3360->12b52bb4-a415-5945-b512-c7df26c46692 send: 88B guuid=d89ad543-1b00-0000-556b-1dee5d0d0000 pid=3421 /home/sandbox/AGbot.i486 guuid=32a8c543-1b00-0000-556b-1dee5c0d0000 pid=3420->guuid=d89ad543-1b00-0000-556b-1dee5d0d0000 pid=3421 clone guuid=179ae143-1b00-0000-556b-1dee5e0d0000 pid=3422->12b52bb4-a415-5945-b512-c7df26c46692 send: 88B guuid=5bfcf163-1b00-0000-556b-1dee610d0000 pid=3425 /home/sandbox/AGbot.i586 guuid=3cf6db63-1b00-0000-556b-1dee600d0000 pid=3424->guuid=5bfcf163-1b00-0000-556b-1dee610d0000 pid=3425 clone guuid=897c0064-1b00-0000-556b-1dee620d0000 pid=3426->12b52bb4-a415-5945-b512-c7df26c46692 send: 88B guuid=5a6fd980-1b00-0000-556b-1dee7e0d0000 pid=3454 /home/sandbox/AGbot.i686 guuid=ceaec580-1b00-0000-556b-1dee7d0d0000 pid=3453->guuid=5a6fd980-1b00-0000-556b-1dee7e0d0000 pid=3454 clone
Threat name:
Document-HTML.Hacktool.Heuristic
Status:
Malicious
First seen:
2026-08-27 16:49:38 UTC
File Type:
Text (Shell)
AV detection:
6 of 36 (16.67%)
Threat level:
  1/5
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 60ce9c480fc68325c0c7f2f2956356e02417925f7efaba44409c4b6817c6bfb2

(this sample)

  
Delivery method
Distributed via web download

Comments