MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 10

Intelligence 10 IOCs YARA 1 File information Comments

SHA256 hash:	27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60
SHA3-384 hash:	d8c233b584250b59b289ba4aa62b4c919ea5b16f0238f6daa69069311a605a730a0e22ef17be261d5379c9d981b95cb7
SHA1 hash:	6da48eae36347b163df6be89b963c36acc6f8bf4
MD5 hash:	7d009c3b0c3feacdb42d338be10ad3ac
humanhash:	uranus-nine-table-undress
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2025-11-21 19:36:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v/7s7N7h/p6G/gRzP/ZKW/DoU/7D7o7U/fC3b/89R/Hcg/opV/RSO/N+C/SfT/6C:v/7s7N7h/p6G/gRzP/ZKW/DoU/7D7o7M
TLSH	T13A5129E5420A4D382C636A53E6BE412C32E3A56798F2EF95D9C4BEE8275EC343141B53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://213.209.143.34/hiddenbin/boatnet.x86	dfd25a607524daec552d520132f233d4ef2dfe4ac520f05bd88c29f42f608525	Mirai	32-bit elf mirai x86-32
http://213.209.143.34/hiddenbin/boatnet.mips	a658194043a84a00a97dd4ed8c870b74539a4761021812c1fb479dd10e15b789	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.arc	0bbf112af5e9b32b17758132fb944457794da66d0b488a33ecdaea4aeefa7ea5	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://213.209.143.34/hiddenbin/boatnet.i686	bfe5513737201ebfec6843a77ef754338be3706a53a7dcbdf40d9062b4b9ca4b	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.x86_64	d4eedf664b411c4749fe999ab2027f7661d83e63a901eddf9c758dd536aa61a8	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.mpsl	097405094c5cd3c43924a039ae6648128bf47b89f3d4513d900cb2bb2f904e6d	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.arm	0d07138a6f500257da73894005f54ea1caea71a36f8792f1efada3e65ed657b3	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.arm5	3d0fd7cb36080d3f0bc3ce108b008cba4bc1b4cb6a07119b8a9f9590344e8cd3	Mirai	32-bit elf mirai Mozi
http://213.209.143.34/hiddenbin/boatnet.arm6	e3aff0f8ca86b02790ef08e213d0228ced542f28ddfcba9d67e66f314234a197	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.arm7	1611c6fe24bdd1fda5a269bedb8c7704a658b97fa54c5d3253326af26358a663	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.ppc	4c5109b455886fd2ead5853dd33e08e55276f670c9cc7e74483ccbeb61ff3095	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.spc	7185dd06295bbd5f4d5d0b442127a76350c2ee5ae00112cfae6fd4140ec8e3ed	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.m68k	f2e9b36410c9c9d9e54fa497cd992a7b3517fdab431fe423ac1a442945a63592	Mirai	elf mirai ua-wget
http://213.209.143.34/hiddenbin/boatnet.sh4	ac18d182b1cc51d86c4e7745264f50b2625163beaf0c58da0beb464feeae83b9	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

medusa mirai

Link:

https://www.filescan.io/uploads/6920bf6eeecb08e4aa43e6ca/reports/61fb10c0-ca7a-4b61-b132-37eb6da81cc9/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-21T13:54:00Z UTC

Last seen:

2025-11-21T20:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/15866ba9-3899-4cdb-99e7-c0a3b1f1f8e6

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-21 17:32:53 UTC

File Type:

Text (Shell)

AV detection:

18 of 24 (75.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e7voi7zbdq2looi5ouhxaciexbqziuujqsnwndzx5ksvqrxmbrqa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251121-ybxzqsep4s/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/27eae47f211c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/27eae47f211c34b7391d750f700904b861945289849b668f37eaa55846ec0c60

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.