MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a
SHA3-384 hash:	429da6e74428a2224759bcc62c0ce6c5775cc7060b56d67d4fbe82984608f474750aa22ba5811b735e3ed03355f37ef9
SHA1 hash:	17656dd314b29fd75bb859f05403b5a15e961c75
MD5 hash:	61808d6289115b182ef43bf36d4caf53
humanhash:	illinois-six-high-sink
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2025-11-04 02:45:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vXe78e7N7hXe9e6GXeglezPXeNeKWXe7eoUXe77e7o7UXefGe3bXese9RXe/ecgL:vu797N7hug6GugozPuQKWuyoUu7y7o7I
TLSH	T10B518F8542444D7828A7FB16B6B7492C34819062ACFB7FD5DEE4EAE0065FF1432C8793
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://179.61.132.175/hiddenbin/boatnet.x86	3d76a6783f70f3bd2022d9c0f2224f4fd1b9af6d77b6afb26f8cc571ec4fa9ed	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.mips	4a4ea4191364f06fe18d2085b3821654af57c2cddb18e339d009f7b4a307652d	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.arc	68bf99be77c1c761d7a5649ae614b00ab568f09430ef64ff3003b7a7d43a15d2	Mirai	elf geofenced mirai opendir ua-wget USA
http://179.61.132.175/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://179.61.132.175/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://179.61.132.175/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://179.61.132.175/hiddenbin/boatnet.mpsl	f991c28eedbf49cba8120deaf6d0f14e3feefcebf1574154a0ffd264e8057b65	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.arm	deb9be9ef3007eb4c01154d9bdab41ebcfa0a8f73ee499710d7658b9653f2f2c	Mirai	elf geofenced mirai opendir ua-wget USA
http://179.61.132.175/hiddenbin/boatnet.arm5	23156dcb23986e8be8f8c46cb53ba803e16105fb8a55adcd3216f61df0ab5fe4	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.arm6	fe11b23bd5fac1969f261962207cad3ad114e458aa015901fcc2445e98af8bf6	Mirai	elf geofenced mirai opendir ua-wget USA
http://179.61.132.175/hiddenbin/boatnet.arm7	6f6482285b6b10d52abea3a274b1de0beebd573baa91771b6d9a0961f984234e	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.ppc	db3f899d142d3d4d8ecf60017e8ba1098bcac4274449e53d24657b4dddee1f1e	Mirai	elf geofenced mirai opendir ua-wget USA
http://179.61.132.175/hiddenbin/boatnet.spc	89e76b8c5c304f67df2fd9f7dff15752ddb9b92ace007b5dfebdbcf663af804e	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.m68k	9ab4ba1c18231e62d013e63a752347f216759292ba7a80c92bc21680eb8f69e0	Mirai	elf mirai ua-wget
http://179.61.132.175/hiddenbin/boatnet.sh4	261f68f37940818bbdf2cc42681a87e4fdb9793d19906fb2539409ef0caf1791	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-03T23:53:00Z UTC

Last seen:

2025-11-04T10:24:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/17979e59-3d92-4266-a7f2-b3378299721f

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-11-04 02:46:05 UTC

File Type:

Text (Shell)

AV detection:

18 of 24 (75.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h7cku7ue5mpdzc4somrixici4noyafif64lk7xs2x66z2nbjivna._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251104-c9c7bsxphq/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3fc4aa7e84eb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.80

Link:

https://yomi.yoroi.company/submissions/3fc4aa7e84eb1e3c8b9273228ba048e35d801505f716afde5abfbd9d3429455a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.