MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46
SHA3-384 hash:	ac6007de81e98d1b032d9025c31458804adbc46cda0abf0c05e026a69f695e3e5ff931526ae47b35645f77bb4c1ffad5
SHA1 hash:	d58bf0c5e6fd654f747d2a2b9d416ad82aaa9e64
MD5 hash:	d0e577bfa998fd4ced0ddc198473287e
humanhash:	social-six-louisiana-thirteen
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'910 bytes
First seen:	2025-12-02 15:06:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vh7u7N7hhP6GhgHzPh/KWhloUh7l7o7Uhfw3bh+9RhZcghqpVhHSOhz+ChAfThYu:vh7u7N7hhP6GhgHzPh/KWhloUh7l7o7A
TLSH	T17651E7C543880C70AC67EB33E7B6417C33C591D798E26BE5D9CABAE90A5ED143540B93
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://81.94.156.24/hiddenbin/boatnet.x86	7c19fbd082b182d79d4d2048e15b799d2e025f6c111aa96ce864759a9be1192d	Mirai	botnet mirai qbot x86
http://81.94.156.24/hiddenbin/boatnet.mips	c28b4174ebab5aad08afdfe2fc9cc262fd7979061a3a5f7f95fcb36fdf1f02c6	Mirai	botnet mips mirai qbot
http://81.94.156.24/hiddenbin/boatnet.arc	adc3c7389f91aecee41943e1632c1ffd4b688c1164150556b58a3deed2a6d4b7	Mirai	arc botnet mirai qbot
http://81.94.156.24/hiddenbin/boatnet.i468	n/a	n/a	botnet i468 mirai qbot
http://81.94.156.24/hiddenbin/boatnet.i686	n/a	n/a	botnet i686 mirai qbot
http://81.94.156.24/hiddenbin/boatnet.x86_64	n/a	n/a	botnet mirai qbot x86_64
http://81.94.156.24/hiddenbin/boatnet.mpsl	1a1bbc359c5726f1ae1bc0348b776765109e9e8054c14ca83f20a2698b2f9d3e	Mirai	botnet mirai mpsl qbot
http://81.94.156.24/hiddenbin/boatnet.arm	5260e0a774f60b73183f342e90d226b1324096c905aa0cfb63405a28383a7975	Mirai	arm botnet mirai qbot
http://81.94.156.24/hiddenbin/boatnet.arm5	f96b0691d85e12b72e979b34a742b6a1b1151744d1fec6ab28a9a231aa59104f	Mirai	arm5 botnet mirai qbot
http://81.94.156.24/hiddenbin/boatnet.arm6	7ae30d8e300cc62274da2bfef5c4c98568affc8dae7af54bca951032a0acd8ea	Mirai	arm6 botnet mirai qbot
http://81.94.156.24/hiddenbin/boatnet.arm7	8eeac085e446e6aa3545a76ca7066a0dde341aa09626075a7323d973dd10b231	Mirai	arm7 botnet mirai qbot
http://81.94.156.24/hiddenbin/boatnet.ppc	03ecfe746094ad49858e63c7bcee4798fa5d65d93760d561121bcddada9f0b05	Mirai	botnet mirai ppc qbot
http://81.94.156.24/hiddenbin/boatnet.spc	93fb5c2e8cab764edb729a464c06fe3161081a9ddf820bbc53b668281f2a3701	Mirai	botnet mirai qbot spc
http://81.94.156.24/hiddenbin/boatnet.m68k	7d7bc55bea834df5495755ad77c5713bb21655e6a13b4acc42b0364e086412b5	Mirai	botnet m68k mirai qbot
http://81.94.156.24/hiddenbin/boatnet.sh4	87c5cae1999e278e79bc9255af80ed64fbf8403049b34831a3737e824dcfc86e	Mirai	botnet mirai qbot sh4

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/692f00ac99fdf99ec95c986c/reports/a6d15c2b-7d32-41f3-9751-576452ed0ff7/overview

Result

Gathering data

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-12-02 15:07:26 UTC

File Type:

Text (Shell)

AV detection:

23 of 36 (63.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=izvz5e6boqmed4onkvb6nui6zol6qkcddwuocpkymcnh4qj2h5da._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251202-shgy7sgr2z/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai family

Mirai

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/466b9e93c174/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/466b9e93c1741841f1cd5543e6d11ecb97e828431da8e13d58609a7e413a3f46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.