MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a
SHA3-384 hash:	b2548fd1fd45ca888e733c5f36f676656e7c4d5a12960c1eee933137b2272e5f614e644d4b3eb2de482413b8e1eef36c
SHA1 hash:	f3ed2160a79e50a5d296b4acceb2de7925a1a205
MD5 hash:	cc1760c1a898dd5fee088d7e37f30eb2
humanhash:	nebraska-comet-idaho-blue
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'794 bytes
First seen:	2026-03-12 01:51:23 UTC
Last seen:	2026-03-14 08:45:46 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iEzLmzLVzLVzL7zL5zLtxEzLazLVzL6zLTzLtzLBzL4zLIz:iE3m3V3V37353LE3a3V363T3t3B343Iz
TLSH	T1EB5140D6F75206306F7AAEA7B9B64805B19990A39DD0A906F4FC7CFD528CE0C30906C3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.141.26.73/bins/sora.arc	9b9832e1543cec7b332c9cc47897d16216d042a2a8ba351130a4c84c3005818a	Mirai	arc elf mirai opendir ua-wget
http://45.141.26.73/bins/sora.x86	3247319c4f6220528565e6dc67893af871eb946ce9fb519b46c6a2ccb24dfc31	Mirai	32-bit elf mirai x86-32
http://45.141.26.73/bins/sora.x86_64	2f94b3aef184e009a4a8a6c1958d44734a0ddf2f29807e2ca2500fb0dbfc512f	Mirai	64-bit elf mirai x86-64
http://45.141.26.73/bins/sora.i686	da38555c7e2a1a01ff071455be3b9a50124633aabe902b6aa3ac96f5302b3e4c	Mirai	elf mirai opendir ua-wget x86
http://45.141.26.73/bins/sora.mips	8d6c715294ff2a9bda70ef9bf4c730280fbca6fe4da717116ecb0ad7d26938ab	Mirai	elf mips mirai opendir ua-wget
http://45.141.26.73/bins/sora.mips64	n/a	n/a	n/a
http://45.141.26.73/bins/sora.mpsl	d6de8e3161a50b85bd7ba8169ed7374139fe27d08ed4695862a70a012b93e419	Mirai	elf mips mirai opendir ua-wget
http://45.141.26.73/bins/sora.arm	6f27a543fd302747782dcab22e7e81ebb1b37b272ff8a460765b856c202c06a5	Mirai	arm elf mirai opendir ua-wget
http://45.141.26.73/bins/sora.arm5	8e102c0c72beeb13e0302ff51629d7e76d659fbf409fff37bacdf94532241a23	Mirai	arm elf mirai opendir ua-wget
http://45.141.26.73/bins/sora.arm6	edd2e49303aa96953f7427eb7972348aaca4f48c8cc6498f1c1d97f699db2a25	Mirai	arm elf mirai opendir ua-wget
http://45.141.26.73/bins/sora.arm7	4cf1333f5de389e2627636314215400ad59fdb34bca093d2e4e4ac8667cd9a29	Mirai	arm elf mirai opendir ua-wget
http://45.141.26.73/bins/sora.ppc	dd37c287059afdf784e603100a2313eb5db5f393d360577d60e29fd38d18e091	Mirai	elf mirai opendir PowerPC ua-wget
http://45.141.26.73/bins/sora.sparc	n/a	n/a	n/a
http://45.141.26.73/bins/sora.m68k	d07c62f2e31fdb1d62c42c2bbaa0b3140ea79218220525b784bbf399307457f9	Mirai	elf m68k mirai opendir ua-wget
http://45.141.26.73/bins/sora.sh4	3f78233884ca029b470e74c40554927465ebf539ebe8c119779f22dc8ffd1473	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f60aebeb-8efc-4bf5-95b6-d73e589b0f34

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-03-12 01:52:27 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kb4sazbtmb75nxa26o7vftw44gr34kjajcw2gm4ged7jv3rgfa5a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260312-cajj3ag18n/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/507920643360/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/5079206433607fd6dc1af3bf52cedce1a3be292048ada3338620fe9aee26283a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh