MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2a3ec1cfa64742dc0d0a5faf1dbc70e4673560f379cd62f1886588e66761e7fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	2a3ec1cfa64742dc0d0a5faf1dbc70e4673560f379cd62f1886588e66761e7fb
SHA3-384 hash:	2f29764c9a1b7647071c09c7d93c8ab5328af22ed8dddae25e67c8ce828185cfb59c8ff8715772d000fd72037b08e85e
SHA1 hash:	8a35717b46614d264f7d6be052f81a89287b513c
MD5 hash:	c2ba8804055d9de2230ecf39c7e02b32
humanhash:	ink-seven-undress-network
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	3'000 bytes
First seen:	2025-08-10 12:45:13 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v/7C7N7h/B6G/gpzP/xKW/zoU/7z7o7U/f43b/S9R/Hcg/upV/pSO/V+C/IfT/Qa:v/7C7N7h/B6G/gpzP/xKW/zoU/7z7o7y
TLSH	T11651D0C546646F302C67AA27E7BA823830C5A1D218F36FD5DFC8BAE0265ED743248753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://144.172.106.204/hiddenbin/boatnet.x86	2a5795e54917f8a915ab935ff999907ac87e6e50a607ebc78d96857ada956773	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.mips	bad48193d0873180a3886a3579061a2d6d66f02676ef780d7e51e2eb940512f4	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.arc	d6fe30d964a51f4d8b7ec7c3450755fd1c709a4fa0d3a7ca03692cbbf2d5fae8	Mirai	elf geofenced mirai opendir ua-wget USA
http://144.172.106.204/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://144.172.106.204/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://144.172.106.204/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://144.172.106.204/hiddenbin/boatnet.mpsl	81cbdf63e606a8dfd87876637606ddac4c62071113ac9399499bd462daa1f72b	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.arm	41403914940e53a2ae9fb5847b191cb641d9a1cd23f0dc47756837f8716c6ab0	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.arm5	a0d24a84f957a286351e96be4d433e88aa9dc86f898eddae130b7f729fae69bc	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.arm6	fee8ca6a03348366ad7fbe4c1f1d6a7e2094c99ad94c491a9abbc8cd6170b3dc	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.arm7	38ca13f7cd388e41b7469dbb090e4ab52b311fb8b39b8c4639c01a0efe00fe4a	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.ppc	e39d8087068c390e914335db00b1e6454533a70d7a3331c4efc684cae916f3a8	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.spc	b056327226b7964209133f2f966478bc71fdee126d67ffcf3cf2617bb3ffb0cd	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.m68k	37d52e4ecead921c4c316abf2c72e5dba63ffbc721ad53a499d2ee08a7431a05	Mirai	elf mirai ua-wget
http://144.172.106.204/hiddenbin/boatnet.sh4	b9aded86b5325a14caf8fa77e0aceca164e7881582e0edb44beaaa67f42dc7dd	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4ab78a0c-020f-49b0-9491-97c2739769f4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2a3ec1cfa64742dc0d0a5faf1dbc70e4673560f379cd62f1886588e66761e7fb

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2a3ec1cfa64742dc0d0a5faf1dbc70e4673560f379cd62f1886588e66761e7fb/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-10 12:47:37 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fi7mdt5gi5bnydikl6xr3pdq4rttkyhtphgwf4mimweomz3b475q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250810-pz1abszzct/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2a3ec1cfa647/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/2a3ec1cfa64742dc0d0a5faf1dbc70e4673560f379cd62f1886588e66761e7fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.