MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6063eae6f91c29dbfa3fa8cd98fe0859bc82c5a2ac5da1d17e8067e75f7bc3c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6063eae6f91c29dbfa3fa8cd98fe0859bc82c5a2ac5da1d17e8067e75f7bc3c8
SHA3-384 hash:	bf5ec18106739093a706078bf5e67ae3f078c05090aceba431ddd5e30b4d96c75bfe3afadca4a9603ac44b5b98e15052
SHA1 hash:	89fc4534b140f52ebef84420b843e3d0f4236ccc
MD5 hash:	0ce735d692827eb3c30a642449846d80
humanhash:	blue-nebraska-table-fruit
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	3'724 bytes
First seen:	2025-01-04 13:26:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:i/3F3ex3A3a32B3WE3B3c3N3W3Q3M3L3swz:k1uxQKGBnxM9Gg878W
TLSH	T1A2719191DA4201741C9A9772A9BB55AAF045B3C734E33B0FF6987CF5618DF006487EE1
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677937f974a2bd296e269886linux22vpnfull_triage

Tags:

ransomware medusa virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug busybox lolbin remote

Link:

https://www.filescan.io/uploads/67793727d8e3c9589c5d61c5/reports/28500ade-1489-4391-8ff9-c1cda52568ff/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6063eae6f91c29dbfa3fa8cd98fe0859bc82c5a2ac5da1d17e8067e75f7bc3c8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6063eae6f91c29dbfa3fa8cd98fe0859bc82c5a2ac5da1d17e8067e75f7bc3c8/

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-04 13:27:04 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mbr6vzxzdqu5x6r7vdgzr7qilg6ifrncvro2dul6qbt6ox33ypea._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai botnet:lzrd antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250104-qp3s5stmap/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

UPX packed file

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Mirai

Mirai family

VMRay Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/6063eae6f91c/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6063eae6f91c29dbfa3fa8cd98fe0859bc82c5a2ac5da1d17e8067e75f7bc3c8