MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c
SHA3-384 hash:	037ac288863e9537c127643d34d23214663aba8676c4ce50ad8395a7f88d869208f8bfe723f00255e630e06efe9940e8
SHA1 hash:	719397e15e8dc8d415bc9aa070da5d002e91dd53
MD5 hash:	d26c1c172f59959c1d7a200593e51e09
humanhash:	spaghetti-green-utah-cup
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'977 bytes
First seen:	2026-05-27 19:54:23 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:iA7B7N7hAe6GAgmzPAOKWAUoUA7U7o7UAfz3bAR9RAIcgAtpVAmSOAi+CADfTAry:iA7B7N7hAe6GAgmzPAOKWAUoUA7U7o7Y
TLSH	T1FF51B4C542440C3C28637A13E6B68228328594D2ACE97B95DED8BFF0475FE5873A1753
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://50.56.159.185/hiddenbin/boatnet.x86	7358e2d3808a50712cdb6f86be4961e36622b4214408c85ec8731f5c9ebd3b85	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.mips	63b55e92c9e18352d180b602a20853b7cacce51b0b51724917bbf43a48f7a027	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.arc	6297684517909983f054dd231a580d29267f960982465132a00e1455aa5ac519	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://50.56.159.185/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://50.56.159.185/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://50.56.159.185/hiddenbin/boatnet.mpsl	cd6390f302128eabab87e1ad144d84344e016facf335e1f2fe7124d1b7c498f3	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.arm	1fc9446ea2e0bce14c249aed20c6012cdf3cdaf43129f4348d083f0d052fb4ea	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.arm5	e29002dde4dc845fb3af8315e05750fd1b54dc53a146f606ef6fdadf8d02e37c	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.arm6	594f1d72141f3b14051ad4f3a0a6e263119d7fafbb4764fba5e90511d09d2f60	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.arm7	ad831f1ff636c6073172de6d7bcedc2b3479c2707d28cc287e34fbf85cf4692c	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.ppc	e892f709059fd7714ecde6587484a25076de19676258a4d3c32fd05e38dcea35	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://50.56.159.185/hiddenbin/boatnet.m68k	93ba7b7d1a11150ef2dd7dc55475e7393a751ac32c46da6cdd10d99ddcae1af0	Mirai	mirai opendir
http://50.56.159.185/hiddenbin/boatnet.sh4	b42ebdb7847c218c1ae7d7d82f4c882d45070a97b5735efe7c7837c1630f60cc	Mirai	mirai opendir

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-27T16:25:00Z UTC

Last seen:

2026-05-28T00:01:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/00f81f53-707c-4784-bc60-ea9290ea00be

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-05-27 18:09:42 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k7iw3dkglsvqobchcnxqrwqpwqhw6na67f74526wfc6ewp4hum6a._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260527-ynh2cag12r/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/57d16d8d465c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/57d16d8d465cab070447136f08da0fb40f6f341ef97fceebd628bc4b3f87a33c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh