MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258
SHA3-384 hash:	5765e5e291eab7eb35579922c618364e3d6b8aacc9f6a53618802d6f16c5299f911c3ca255a38afe3561bb349b850ed8
SHA1 hash:	af87583e37d4a73756935151946ddca95a84592f
MD5 hash:	5742009453bb1f4ec7a7f842f060fe0e
humanhash:	maine-bacon-tango-july
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'794 bytes
First seen:	2025-09-29 10:22:38 UTC
Last seen:	2025-09-29 23:31:42 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItC5JU5Jbx5JJ5Jdt5J9e5e5dx5JAUU5Js5J15J2t5Jr5JlZ5Jz5J5ffe5Jg+xk:iciBNHNAl6hIbbj5ffws
TLSH	T13551E7C9322381F1ED625936A7BB090CB8D059E7ECD9EFC149D8BAB8415CE1D7C48693
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.235.116.149/bins/camp.arc	n/a	n/a	elf ua-wget
http://91.235.116.149/bins/camp.x86	2cb695d1061b00122ba8d34ea6392b211fb877adb17e8af703ee0f9e2ce02c55	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.x86_64	n/a	n/a	elf ua-wget
http://91.235.116.149/bins/camp.i686	n/a	n/a	elf ua-wget
http://91.235.116.149/bins/camp.mips	74251a5df2b0ec08c0b094c38f6c7f1325863d494684b7bf6e4a36eedc66866c	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.mips64	n/a	n/a	elf ua-wget
http://91.235.116.149/bins/camp.mpsl	3ea227337fe2f49b1f922c5cf2e70f8751013386d25b0d76a764838d83f8c22b	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.arm	3255db4516c797a7fa1f2b74121385e6cf92dcc8c72e5b5ae2c5dd7614214b0f	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.arm5	325eb6648b9acd9fed67278fceaf9d9776bb515ad5fe562a5311e1c823414936	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.arm6	3b874ffb4f6f156207b83535cf0f0e02d6a921da606d3124a6f1ad916cd7273c	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.arm7	f125a40ac48d8cebf9f8b078c531afeea4c36621b946d1ea253b58c54a406f9d	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.ppc	5d895af08bcd53b95462607ff125b935db86b86bb2547269d1053cb29019421e	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.sparc	n/a	n/a	elf ua-wget
http://91.235.116.149/bins/camp.m68k	f3bf8071a9406dab27787dddb32a8b7d52929a3f1710bfc087aadf1f682cef5c	Mirai	elf mirai ua-wget
http://91.235.116.149/bins/camp.sh4	5c9e6686c6e7c9a8da64b6b4d378c64a7388464550eaedbe5761b41c2aeaebca	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-29T05:38:00Z UTC

Last seen:

2025-09-29T05:38:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/36811685-8d86-4768-97ca-3afb773f7872

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-09-29 10:23:19 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fovtlkyyxarrz5jtxau6uqulmq3bcc3efzy7iosn673ylgzeijma._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:echobot family:mirai antivm botnet defense_evasion discovery linux trojan

Link:

https://tria.ge/reports/250929-me2ljsaq2t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (2186702) amount of remote hosts

Creates a large amount of network flows

Detected Echobot

Echobot

Echobot family

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2bab35ab18b8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.12

Link:

https://yomi.yoroi.company/submissions/2bab35ab18b8231cf533b829ea428b6436110b642e71f43a4df7f7859b244258

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.