MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0
SHA3-384 hash: d6cf56f660990377ff16558a49adab094eb97f77d8c1357c996bae4442ef0bcca5028eb945c359efbcc59ac43021815c
SHA1 hash: e5af881e0f95f37875bd7985a848971e5e4bff78
MD5 hash: 2528b35372c3e1267bc94f4489c9f241
humanhash: fourteen-cup-paris-sierra
File name:s
Download: download sample
File size:352 bytes
First seen:2026-04-25 00:31:28 UTC
Last seen:2026-04-25 14:38:05 UTC
File type: sh
MIME type:text/plain
ssdeep 6:ebAAj73w5/KiYEGvwW2AVFhGq4XXQZrKGy3D2QZrKGygt9Me9Sn:7AWKZHY4uqDZrKGyT3ZrKGygt9Md
TLSH T117E0D8CE64D08D7038454DE7B061490694CBD88D1BA24FC456C8107F584ED08B293F12
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://195.178.110.204/armv7l77b0b59d2733125c03a25e10bdd7b1b5629cbf80b8627c9aec61b07164d984d0 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
80
# of downloads :
7
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
ps1
First seen:
2026-04-24T22:40:00Z UTC
Last seen:
2026-04-26T18:49:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/225d88cb-3e9e-4c36-81f6-c845dd4b54d0
Behavior Graph:
Download SVG
%3 guuid=df7f7207-1a00-0000-3182-6f9eef0a0000 pid=2799 /usr/bin/sudo guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804 /tmp/sample.bin guuid=df7f7207-1a00-0000-3182-6f9eef0a0000 pid=2799->guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804 execve guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806 /usr/bin/dash guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806 clone guuid=3ebf8b0a-1a00-0000-3182-6f9efb0a0000 pid=2811 /usr/bin/rm delete-file guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=3ebf8b0a-1a00-0000-3182-6f9efb0a0000 pid=2811 execve guuid=5715f80a-1a00-0000-3182-6f9efc0a0000 pid=2812 /usr/bin/rm delete-file guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=5715f80a-1a00-0000-3182-6f9efc0a0000 pid=2812 execve guuid=84634f0b-1a00-0000-3182-6f9efd0a0000 pid=2813 /usr/bin/rm delete-file guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=84634f0b-1a00-0000-3182-6f9efd0a0000 pid=2813 execve guuid=e08cb00b-1a00-0000-3182-6f9efe0a0000 pid=2814 /usr/bin/dash guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=e08cb00b-1a00-0000-3182-6f9efe0a0000 pid=2814 clone guuid=80882e15-1a00-0000-3182-6f9e0c0b0000 pid=2828 /usr/bin/chmod guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=80882e15-1a00-0000-3182-6f9e0c0b0000 pid=2828 execve guuid=7af87015-1a00-0000-3182-6f9e0e0b0000 pid=2830 /usr/bin/dash guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=7af87015-1a00-0000-3182-6f9e0e0b0000 pid=2830 clone guuid=0ea83a16-1a00-0000-3182-6f9e110b0000 pid=2833 /usr/bin/rm delete-file guuid=59244009-1a00-0000-3182-6f9ef40a0000 pid=2804->guuid=0ea83a16-1a00-0000-3182-6f9e110b0000 pid=2833 execve guuid=37e58809-1a00-0000-3182-6f9ef70a0000 pid=2807 /usr/bin/cat guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806->guuid=37e58809-1a00-0000-3182-6f9ef70a0000 pid=2807 execve guuid=f6ee8f09-1a00-0000-3182-6f9ef80a0000 pid=2808 /usr/bin/grep guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806->guuid=f6ee8f09-1a00-0000-3182-6f9ef80a0000 pid=2808 execve guuid=10e19409-1a00-0000-3182-6f9ef90a0000 pid=2809 /usr/bin/grep guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806->guuid=10e19409-1a00-0000-3182-6f9ef90a0000 pid=2809 execve guuid=519d9f09-1a00-0000-3182-6f9efa0a0000 pid=2810 /usr/bin/cut guuid=edeb8109-1a00-0000-3182-6f9ef60a0000 pid=2806->guuid=519d9f09-1a00-0000-3182-6f9efa0a0000 pid=2810 execve guuid=08f9c00b-1a00-0000-3182-6f9eff0a0000 pid=2815 /usr/bin/wget net send-data write-file guuid=e08cb00b-1a00-0000-3182-6f9efe0a0000 pid=2814->guuid=08f9c00b-1a00-0000-3182-6f9eff0a0000 pid=2815 execve 0d6a8e00-ec4e-588b-8e02-8670607dfe9b 195.178.110.204:80 guuid=08f9c00b-1a00-0000-3182-6f9eff0a0000 pid=2815->0d6a8e00-ec4e-588b-8e02-8670607dfe9b send: 136B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0
Gathering data
Threat name:
Script-Shell.Trojan.MiraiB
Create hunting rule
Status:
Malicious
First seen:
2026-04-25 02:26:46 UTC
File Type:
Text (Shell)
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zt34uqxo4ztzc3g6itrdk5wow7aavnjri3gl3vmxrpkglovjtpqa._file
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ccf7ca42eee667916cde44e23576ceb7c00ab53146ccbdd5978bd465baa99be0

(this sample)

Mirai

elf 77b0b59d2733125c03a25e10bdd7b1b5629cbf80b8627c9aec61b07164d984d0

  
URLhaus
https://urlhaus.abuse.ch/url/3812302/
  
Delivery method
Distributed via web download
  
Dropping
MD5 ba0e5097d41e8b8d09c9919df72c77a6
  
Dropping
SHA256 77b0b59d2733125c03a25e10bdd7b1b5629cbf80b8627c9aec61b07164d984d0

Comments