MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77
SHA3-384 hash:	57d02b93a04e1c4c46a91a97451f8766d11c7223228209d67dc9bcfd31481a047a70744d02aeef8987a6e690a0ad18f8
SHA1 hash:	b00559c510e879322af20ec419c684e1bf0fe8fe
MD5 hash:	1759a00a1cd0d24f3454f1a3f1ead54f
humanhash:	cardinal-ceiling-eight-alpha
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'940 bytes
First seen:	2025-08-02 07:10:00 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vy7n7N7hyA6Gyg4zPywKWyGoUy7G7o7Uyfh3by39RyqcgyTpVy4SOyE+CyxfTypW:vy7n7N7hyA6Gyg4zPywKWyGoUy7G7o7c
TLSH	T146518EC952644E302C67EE27E7BF823C34C2949258E5AFD5DDD8BBE8466EE243240753
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.20.102.84/hiddenbin/boatnet.x86	e418f53781c5d6bc5178cbf749acd183a07b64153bea93c7ff983ad802ccd127	Mirai	elf geofenced mirai ua-wget USA x86
http://103.20.102.84/hiddenbin/boatnet.mips	029976c5ee296126234c93e18967f1b81df7858257a56a1fdb91d619983c687b	Mirai	elf geofenced mips mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.arc	6ee9971401f153985e573d28ff985876e57a095b25f36da104210919b74d3865	Mirai	arc elf geofenced mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://103.20.102.84/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://103.20.102.84/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://103.20.102.84/hiddenbin/boatnet.mpsl	542a19874c1a7a3e00cbe5336c6d6f6f6e1e69edb4066a54571c670ad50425f6	Mirai	elf geofenced mips mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.arm	6a8733ec975dd23bc50c4feb6efba1506caad29c9e6acab96d0d048970196c98	Mirai	arm elf geofenced mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.arm5	4e6a4a61b3ce2b17d017bb3fed94b51c6a0fa5bbb64c5f57e72e9cd12ff2e263	Mirai	arm elf geofenced mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.arm6	68b4636d3f0719054812f9d3043899842bc0d0066a54d1291e71842098731ef0	Mirai	arm elf geofenced mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.arm7	cdf5f2dab000cec33a46ec6e9d01c3fff51c74f7134eb2d9d34661fda085e399	Mirai	arm elf geofenced mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.ppc	n/a	n/a	elf geofenced mirai PowerPC ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.spc	34cbe43e894ca1ee6058798c8a44794b7d7b5ecc9f393104218ab546ac692a85	Mirai	elf geofenced mirai sparc ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.m68k	778068939d54554d1d80975f4a1b50da05764147ccb380fefa30e83d2df4f168	Mirai	elf geofenced m68k mirai ua-wget USA
http://103.20.102.84/hiddenbin/boatnet.sh4	2461c8f1e4f1ce15b8ffd21595382e5efba62f2781ec8eaccdb53064189ffb84	Mirai	elf geofenced mirai SuperH ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d9df9717-d7bc-4d0a-993d-e7bc6e586e6f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-02 06:18:45 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=g7ctngfg2uhqa3w6smmeitd3nrg5wziat3gwh6g7bzr5a7vs3v3q._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250802-hzmkxacp5w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/37c53698a6d5/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/37c53698a6d50f006ede9318444c7b6c4ddb65009ecd63f8df0e63d07eb2dd77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.