MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29eae7a3fc0f8f73775f7202b9b7972c62a40320b7331588db4e8cf560749719. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	29eae7a3fc0f8f73775f7202b9b7972c62a40320b7331588db4e8cf560749719
SHA3-384 hash:	caedf01dfbe29e4cd1bbc6d2a5fe603ffba0a863432d089a2f01ba63b2e416cdbfd23fca0be4fb1cee8686087838950c
SHA1 hash:	01899c680da79b2e7302f5898e150254bd7ef207
MD5 hash:	d2fc82c2b868db8956bd1a152673f5a7
humanhash:	mexico-victor-yankee-lamp
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'896 bytes
First seen:	2025-03-11 14:01:51 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vh8b8Uh/sxUh+RyUhv8J8gUhN+bUhpa24Uh/SdGUhA/SpUhZqnUhUDEUh30lUh7W:vh8b8Uh/sxUh+RyUhv8ygUhN+bUhpa2d
TLSH	T14A51528D31118B757CF77813A2B97A48F6C491812685FE96D6CC34F88E8CF1528D59A3
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://160.191.245.152/dlr/blah.x86	2ce9fb3fae4dd2c0540e15c416d79a33933b714551d6016b28ddaa0f52a06913	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.mips	1e74b70fafd03b372bd8f0b932ae682ab2ea7b73f69744dfc26e24385f23f569	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.arc	1e74b70fafd03b372bd8f0b932ae682ab2ea7b73f69744dfc26e24385f23f569	Mirai	elf opendir
http://160.191.245.152/dlr/blah.i468	1e74b70fafd03b372bd8f0b932ae682ab2ea7b73f69744dfc26e24385f23f569	Mirai	elf opendir
http://160.191.245.152/dlr/blah.i686	1e74b70fafd03b372bd8f0b932ae682ab2ea7b73f69744dfc26e24385f23f569	Mirai	elf opendir
http://160.191.245.152/dlr/blah.x86_64	1305be49b5c56dcf02fe33cf6517e1eeb98f7cbdcca5126187f15c974d27b445	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.mpsl	ae40589ca011bbeeab71412a1d1ecaab9a8f5757815c11832a1cb775691d8b58	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.arm	5f612b06a6807b8e5be3470a5fffe2341278910fd5b04fc558bb263ee9217fa9	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.arm5	51288104da90512c06fa48467a8116365982035cfe8e8b9ce552d0547562e867	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.arm6	6b8faa24f772912d3db092f4c1d8f1201b43f676c750c0a707af7b0ddab581f0	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.arm7	148c15fe0313e85c686eb12040e7110409dee4734909e82fce8f987e2b3ba252	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.ppc	7942fbd002e0b1a152f368e0831a1206504063ec2a8556bcb153cf6dac29c79b	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.spc	04cb1630dc7bf2fbcfa7455c19d89b847d2da9fed1452713219056c2e2d46cdd	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.m68k	cbc0a3f10117b1ce2394feec34e60f8ddfdc4e2ebbfc2ede0497c7223449c8ea	Mirai	elf mirai opendir
http://160.191.245.152/dlr/blah.sh4	44891b0983075ae2003f11fcd1032b84880290c5dc1dd616175ddb8b8e97f201	Mirai	elf mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67d043b0dff6bd921908344dlinux22vpnfull_triage

Tags:

downloader shellcode mirai agent

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/67d042643c5f644bd94d51ef/reports/61b29218-4d09-4654-b2f2-17cb17b88b9b/overview

Result

Verdict:

MALICIOUS

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/29eae7a3fc0f8f73775f7202b9b7972c62a40320b7331588db4e8cf560749719

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/29eae7a3fc0f8f73775f7202b9b7972c62a40320b7331588db4e8cf560749719/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-03-11 14:02:09 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fhvopi74b6hxg527oibltn4xfrrkiazaw4zrlcg3j2gpkydus4mq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/250311-rb6tbav1ez/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Mirai

Mirai family

Malware Config

C2 Extraction:

huyhoangluvnhi.duckdns.org

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/29eae7a3fc0f/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/29eae7a3fc0f8f73775f7202b9b7972c62a40320b7331588db4e8cf560749719

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.