MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6
SHA3-384 hash:	4a9ce249d18012884f08984f8ca9ccbd84797f8b756655557fd3c71d0cb3c24fa7af331bad66b2fe0edf328eda97f1b7
SHA1 hash:	c6a255b14220f3eab3be574ce2e4db2b63d5e6fa
MD5 hash:	2190e369f0cce2361a5fbac2e1d3814f
humanhash:	jersey-november-winter-tango
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'970 bytes
First seen:	2025-07-05 13:09:04 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:v827327N7h82226G82gO2zP82m2KW8242oU827427o7U82fV23b82H29R8202cgd:v827327N7h82226G82gO2zP82m2KW82V
TLSH	T19D518B8543664C70ED67AA27F6B6812CB0C1D0932CE1EFD5DDCAAAF0069ED243640793
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://156.238.225.44/hiddenbin/boatnet.x86	d87cf38b8231bbe5607c7172ca0cf652905def0358581c95897ad5396d23c8c6	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.mips	4be6c28430931fe2eab71a23520bfdc49ae850aaa92142ced28ee40b13363ab3	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.arc	86d1bc0721f9c2d8315dabecd39483db1836769ff850504a451946a18c71f956	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://156.238.225.44/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://156.238.225.44/hiddenbin/boatnet.x86_64	9c4e8f3106206aaf5ceb38c0feaad3dff2f4de87486988fef580acb9ee13c09f	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.mpsl	dfb30e8ddc29209f7778fe0ec031f5f2b46945fee21c47bba9ee0ff5abe399df	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.arm	61bd1c2f3c90e1954753a001593cbac94414ea3be771ec3c4f463326daca733d	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.arm5	c6ea08652420777e2072021db491a1a47c338ae3f69035441d872ad4434164ce	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.arm6	a9dcdca745ddd11e53b6d2ed82fad3d54a09dc5628f43d6767d3bb8e34cfa94c	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.arm7	916cf7e36cee07e175041566e2894812f874fef84c96c75c76336d3c6342c0fa	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.ppc	5432f3caa45385056579f0bba463790b31760e012fc058f169d58c9e23a836a7	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.spc	bebbccbe5247dd3119ad99885f5f4d2ab17a73e098e8c9c02800e8427541e2fa	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.m68k	45460cc00335bbe8b147d59a0cc518a877b865087f04c97ff1aa8522979e29b2	Mirai	elf mirai ua-wget
http://156.238.225.44/hiddenbin/boatnet.sh4	c59cee2450e948e9eea4b53685f5c6161fe43d3098d19b8e76672e5dc4dda7ab	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68692402900df8e7f8671314linux22vpnfull_triage

Tags:

trojandownloader downloader agent

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e1631784-08c1-4897-8652-104a7598f7af

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6/

Verdict:

Malicious

Threat:

Linux.Downloader.Medusa

Link:

https://tip.neiki.dev/file/4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-07-05 12:51:31 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iytk2qekhxulwss5v3wa3qbeeo5rrg6ildjiedz4tehjobpd4xta._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250705-qdxsrahj3z/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/4626ad408a3de8bb4a5daeec0dc02423bb189bc858d2820f3c990e9705e3e5e6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.