MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f
SHA3-384 hash:	61f5be94da82406ad101284a8bec232a7958bcfcba352a549ac78a4ccc0eb44e49636948ae1e4881588409ee225b8959
SHA1 hash:	039936ac5f6e0334ace339ef774d889342e9858e
MD5 hash:	578e2f8d0c82f481d3aa68263bcf32f6
humanhash:	avocado-sierra-pasta-yellow
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'910 bytes
First seen:	2025-08-25 05:37:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vy7p7N7hyU6GygszPyEKWy2oUy727o7UyfP3by59RyKcgyFpVysSOy4+CyffTy3M:vy7p7N7hyU6GygszPyEKWy2oUy727o7Y
TLSH	T1055128C5A3040C702CA36A57E7B6613C76DA945F29EAAF95D9E4BFE8034EC10F940763
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://89.213.44.31/hiddenbin/boatnet.x86	b99240e52409060b4dba6a685391bde4d21bfde1d4ea7161a426e8e48995249d	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.mips	a9f08bf18aa749cbe0efd8622d9b6493b5063a8f8763824db508cfaaf7dcb814	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.arc	bfdb9deeddac8493ea50b24b869164b389bb979d56b3e4a43d829ceff1b85938	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://89.213.44.31/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://89.213.44.31/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://89.213.44.31/hiddenbin/boatnet.mpsl	f96fa1b4e1248e8b04daf784134df743bc205a36cbb2403e2a193acc07ca8cfa	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.arm	88059f9d40f900eb32146ab9c79d0780eef1a35c14dcfe6551970028de45bbb0	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.arm5	a60e35a65a602247ca916d159e9c9945a355618b1fa53f202995c678675b0ce0	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.arm6	a90a0e7d3ef0722beb2a591de5d394f958a82de81a4bc0b0a78f12260e787467	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.arm7	c3b18649911ed0dc1adc397038531956f563d4981a44d3d7bc5d29868d15aa91	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.ppc	002a2e7d759f2b4dcfe0b09c51928f77a6dcb2a9f8a148a48c07dcd1bf14a48b	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://89.213.44.31/hiddenbin/boatnet.m68k	457b1fb711167a1e9a9602c4946d4dcc56f412b7dc4026784ada76da4bf42072	Mirai	elf mirai ua-wget
http://89.213.44.31/hiddenbin/boatnet.sh4	0fe36740d0c807888116b81d72c7c1d88cb5787952639122bfc491976faf5667	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/6919a0b83fa8f7a167b401c1/reports/c75b3a10-51c5-4d27-b000-ae5d4a9859c2/overview

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/83fed2fb-9a29-4294-8213-8b43b18c90f4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-25 05:38:25 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=al7i3hp2xtfg7z5zd6cn5bxsviuhk75qhzljvtjz2ouqk7qkubxq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250825-gbd37asvav/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/02fe8d9dfabc/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/02fe8d9dfabcca6fe7b91f84de86f2aa28757fb03e569acd39d3a9057e0aa06f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.