MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad
SHA3-384 hash:	1fe319a88a3ea519a0882bd08ea4f4d2374928d7c45d3833e5cf2a138d4bce57f3a3b3258472a7dfbc1989abfa5a46fe
SHA1 hash:	f559c6cc5343a20982b36d1dffd96ad9e76ec95f
MD5 hash:	25b3ac866000a46000003790758706af
humanhash:	bacon-red-winner-aspen
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'940 bytes
First seen:	2025-08-21 16:09:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vT+78+7N7hT+J+6GT+gh+zPT+Z+KWT+P+oUT+7P+7o7UT+fG+3bT+s+9RT+L+cgp:vT+78+7N7hT+J+6GT+gh+zPT+Z+KWT+4
TLSH	T1DF515BF541D41D741CA36E17E7765B3833829856A8FA6BA5EDEEBBE0028FC103141B93
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://202.155.94.72/hiddenbin/boatnet.x86	178ad34c30463b23cd931f7ceda4f22e2c3cd4097fd996fc8ac91dd960447f8e	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.mips	1c65af98ad8f153036fe1d567e2f10c767fdc0552d35ffebaa5131cdc5f7546b	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.arc	8e0bcaf1ffb9fe3f2914f914e834895d310cc3a29ca1292f8c25a14e9aca5372	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.i468	n/a	n/a	elf ua-wget
http://202.155.94.72/hiddenbin/boatnet.i686	n/a	n/a	elf ua-wget
http://202.155.94.72/hiddenbin/boatnet.x86_64	n/a	n/a	elf ua-wget
http://202.155.94.72/hiddenbin/boatnet.mpsl	35b663ae1becc6c768d182da19a814281e5941a19092f888641856390ef3a5d0	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.arm	312747411e24caccda1570bca3e38db39542b8a1c6bee73dde9f60c18b4610ef	Mirai	32-bit elf mirai Mozi
http://202.155.94.72/hiddenbin/boatnet.arm5	00b68f72b2d26d994bfa4b93f511878fbf4f37a6f453a60d7814f0282338efe8	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.arm6	5ce6cd5dd0a5faf888b17a1fdc25c55efc5c871a420e44040a7be3e31058aa1a	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.arm7	994d3a3c6d7a0fc23b3b2789c5ed98a6101516757ab65bc4d8780a980c32ec06	Mirai	32-bit elf mirai Mozi
http://202.155.94.72/hiddenbin/boatnet.ppc	c15345e365885c2417073ea2ffd7ca527a636d17d2b0871413c4d874e9d4f8aa	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.spc	n/a	n/a	elf ua-wget
http://202.155.94.72/hiddenbin/boatnet.m68k	56d513cbbddef4b7e1601199d8942598d2342647555bb7c297a96dfac09b1858	Mirai	elf mirai ua-wget
http://202.155.94.72/hiddenbin/boatnet.sh4	d22088d3b78fd430d9d7eccd930a8968af308eb3bcbc32cf51e2424090967d92	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6dbc3804-5a7d-4b6c-9ca3-0cc06cbbbd3d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2025-08-21 16:03:41 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lnnh6sdenfvubwjzueols75krfxxqia5sxxufzal2ugwsunx7wwq._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250821-tnvb6avqy5/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

Malware Config

C2 Extraction:

202.155.94.72

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/5b5a7f486469/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/5b5a7f4864696b40d939a11cb97faa896f78201d95ef42e40bd50d6951b7fdad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.